diff --git a/.github/workflows/publish-ghcr.yml b/.github/workflows/publish-ghcr.yml
index 077bda824..e86901d23 100644
--- a/.github/workflows/publish-ghcr.yml
+++ b/.github/workflows/publish-ghcr.yml
@@ -367,6 +367,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish GitHub Release for product tag
+        id: publish_release
         env:
           GH_TOKEN: ${{ secrets.RELEASE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.prepare.outputs.version }}
@@ -394,6 +395,7 @@ jobs:
 
           if gh release view "$tag" >/dev/null 2>&1; then
             echo "GitHub Release $tag already exists; skip."
+            echo "created=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -410,8 +412,50 @@ jobs:
             --latest
 
           rm -f "$notes_file"
+          echo "created=true" >> "$GITHUB_OUTPUT"
           echo "Published GitHub Release $tag (images ready)"
 
+      - name: Announce GitHub Release in Discord
+        if: ${{ steps.publish_release.outputs.created == 'true' }}
+        continue-on-error: true
+        env:
+          DISCORD_MAIN_WEBHOOK_URL: ${{ secrets.DISCORD_MAIN_WEBHOOK_URL }}
+          GH_TOKEN: ${{ secrets.RELEASE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DISCORD_MAIN_WEBHOOK_URL:-}" ]; then
+            echo "::notice::DISCORD_MAIN_WEBHOOK_URL is not configured; skipping the Discord release announcement."
+            exit 0
+          fi
+
+          # Custom Discord payloads use the base webhook endpoint. Also accept
+          # URLs copied from the native GitHub integration setup for convenience.
+          webhook_url="${DISCORD_MAIN_WEBHOOK_URL%/github}"
+          payload_file="$(mktemp)"
+          trap 'rm -f "$payload_file"' EXIT
+
+          gh release view "$VERSION" \
+            --json name,body,url,publishedAt,tagName \
+            | node scripts/release/build-discord-release-payload.mjs \
+            > "$payload_file"
+
+          curl \
+            --fail-with-body \
+            --silent \
+            --show-error \
+            --retry 3 \
+            --retry-all-errors \
+            --connect-timeout 10 \
+            --max-time 30 \
+            --header 'Content-Type: application/json' \
+            --data-binary "@$payload_file" \
+            "$webhook_url"
+
+          echo "Announced GitHub Release $VERSION in Discord"
+
   notify-ops:
     name: Notify ops repository
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0285bd558..f19d2d94f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,33 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 0.26.0 (2026-07-29)
+
+This release expands Linear and GitHub workflows, makes release information easier to find, and improves setup and task reliability.
+
+### Highlights
+
+- Set up and manage Linear, link user accounts, and start app-mention, issue-delegation, scheduled, and direct Linear tasks.
+- Create or fork a GitHub repository from Roomote, then bootstrap an empty repository and configure its environment automatically.
+- Manage GitHub labels, milestones, and project status values safely from Roomote tasks.
+- Find the running Roomote version easily, verify Teams credentials during setup, and start sandboxes more reliably through transient broker failures.
+
+### Minor changes
+
+- Announce newly published Roomote releases in Discord with the release title, notes, link, timestamp, and Roomote branding when a main-channel webhook is configured.
+- Set up and manage Linear from onboarding or Settings, link user accounts, and start app-mention, issue-delegation, scheduled, and direct Linear tasks with the correct workspace and account context.
+- Create a new GitHub repository or fork an existing one from Roomote, then automatically detect empty repositories, add their initial commit, and configure a working environment.
+- Manage GitHub labels, milestones, and project status values from Roomote tasks with scoped credentials, confirmation for destructive changes, and read-back verification.
+- See the running Roomote version from the signed-in user menu, open release details, and revisit the latest What's New notice without administrator access.
+
+### Patch changes
+
+- Hide self-hosted license controls from cloud deployments while keeping license management available to self-hosted administrators.
+- Make task conversations easier to follow by showing request-input questions as distinct quoted context, refining mobile task chrome, quoting web follow-ups in GitHub replies, and keeping internal routing context out of Slack and Discord quotes.
+- Retry transient compute-broker upload failures during sandbox startup so momentary upstream errors no longer prevent task environments from starting.
+- Choose the model used by the Onboarding Agent when editing an existing environment, matching the model selection already available when creating one.
+- Verify Microsoft Teams bot credentials with Microsoft before saving them, so a wrong app id, client secret, or tenant id fails the save with a message naming the field instead of reporting a configured bot that cannot authenticate. Teams settings now also reports when the saved credentials stop authenticating, and explains why the Teams app package cannot be pre-filled from a malformed App (Client) ID.
+
 ## 0.25.0 (2026-07-28)
 
 This release expands account and diagnostics configuration while making task execution and Slack automation more reliable.
diff --git a/apps/api/src/handlers/github/__tests__/handleInstallationRepositoriesChange.test.ts b/apps/api/src/handlers/github/__tests__/handleInstallationRepositoriesChange.test.ts
new file mode 100644
index 000000000..5fa5fac32
--- /dev/null
+++ b/apps/api/src/handlers/github/__tests__/handleInstallationRepositoriesChange.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+
+const { mockFindFirst, mockSyncGitHubInstallation } = vi.hoisted(() => ({
+  mockFindFirst: vi.fn(),
+  mockSyncGitHubInstallation: vi.fn(),
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    query: {
+      githubInstallations: {
+        findFirst: mockFindFirst,
+      },
+    },
+  },
+  githubInstallations: {
+    installationId: 'installation_id',
+  },
+  eq: (column: unknown, value: unknown) => ({ eq: [column, value] }),
+}));
+
+vi.mock('@roomote/github', () => ({
+  syncGitHubInstallation: mockSyncGitHubInstallation,
+}));
+
+import { handleInstallationRepositoriesChange } from '../handleInstallationRepositoriesChange';
+
+describe('handleInstallationRepositoriesChange', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockFindFirst.mockResolvedValue({ installedByUserId: 'user-1' });
+    mockSyncGitHubInstallation.mockResolvedValue({
+      success: true,
+      githubInstallation: {},
+      repositories: [{ id: 'repo-1' }, { id: 'repo-2' }],
+    });
+  });
+
+  it('resyncs the installation attributed to the installing user', async () => {
+    const response = await handleInstallationRepositoriesChange({
+      installation: { id: 42 },
+    });
+
+    expect(mockSyncGitHubInstallation).toHaveBeenCalledWith({
+      userId: 'user-1',
+      installationId: 42,
+    });
+    expect(response.status).toBe('ok');
+    expect(response.metadata).toEqual({ repositoryCount: 2 });
+  });
+
+  it('short-circuits when the payload has no installation id', async () => {
+    const response = await handleInstallationRepositoriesChange({});
+
+    expect(response).toEqual({ status: 'ok', message: 'missing_installation' });
+    expect(mockFindFirst).not.toHaveBeenCalled();
+    expect(mockSyncGitHubInstallation).not.toHaveBeenCalled();
+  });
+
+  it('short-circuits for installations this deployment has not synced', async () => {
+    mockFindFirst.mockResolvedValue(undefined);
+
+    const response = await handleInstallationRepositoriesChange({
+      installation: { id: 42 },
+    });
+
+    expect(response).toEqual({ status: 'ok', message: 'unknown_installation' });
+    expect(mockSyncGitHubInstallation).not.toHaveBeenCalled();
+  });
+
+  it('reports an error when the resync fails', async () => {
+    mockSyncGitHubInstallation.mockResolvedValue({
+      success: false,
+      error: 'boom',
+    });
+
+    const response = await handleInstallationRepositoriesChange({
+      installation: { id: 42 },
+    });
+
+    expect(response.status).toBe('error');
+    expect(response.message).toContain('boom');
+  });
+});
diff --git a/apps/api/src/handlers/github/__tests__/isFromKnownInstallation.test.ts b/apps/api/src/handlers/github/__tests__/isFromKnownInstallation.test.ts
index b67111a9e..d4fe060ea 100644
--- a/apps/api/src/handlers/github/__tests__/isFromKnownInstallation.test.ts
+++ b/apps/api/src/handlers/github/__tests__/isFromKnownInstallation.test.ts
@@ -97,6 +97,34 @@ describe('isFromKnownInstallation', () => {
     ).resolves.toBe(false);
   });
 
+  it('allows installation_repositories events from a known installation', async () => {
+    mockFindFirst.mockResolvedValue({ id: 'installation-row' });
+
+    const payload = JSON.stringify({
+      action: 'added',
+      installation: { id: 456 },
+      repositories_added: [{ id: 1, full_name: 'acme/new-repo' }],
+    });
+
+    await expect(
+      isFromKnownInstallation('installation_repositories', payload),
+    ).resolves.toBe(true);
+  });
+
+  it('rejects repository.created events from an unknown installation', async () => {
+    mockFindFirst.mockResolvedValue(undefined);
+
+    const payload = JSON.stringify({
+      action: 'created',
+      installation: { id: 789 },
+      repository: { id: 1, full_name: 'acme/new-repo' },
+    });
+
+    await expect(isFromKnownInstallation('repository', payload)).resolves.toBe(
+      false,
+    );
+  });
+
   it('rejects non-created installation events from an unknown installation', async () => {
     mockFindFirst.mockResolvedValue(undefined);
 
diff --git a/apps/api/src/handlers/github/handleInstallationRepositoriesChange.ts b/apps/api/src/handlers/github/handleInstallationRepositoriesChange.ts
new file mode 100644
index 000000000..aa51b2ea3
--- /dev/null
+++ b/apps/api/src/handlers/github/handleInstallationRepositoriesChange.ts
@@ -0,0 +1,53 @@
+import { db, eq, githubInstallations } from '@roomote/db/server';
+import * as GitHub from '@roomote/github';
+
+import type { WebhookResponse } from '../../types';
+
+interface InstallationRepositoriesChangePayload {
+  installation?: { id?: number } | null;
+}
+
+/**
+ * Resync an installation's repository list when its accessible repositories
+ * change on GitHub: `installation_repositories.added/removed` (selected-repos
+ * installs) and `repository.created/deleted/renamed` (all-repos installs emit
+ * these instead). A full resync is used rather than a narrow upsert because
+ * these payloads omit fields the `repositories` row needs (default branch,
+ * clone URL), and `syncRepositories` already handles upsert + deactivation.
+ */
+export async function handleInstallationRepositoriesChange(
+  payload: InstallationRepositoriesChangePayload,
+): Promise<WebhookResponse> {
+  const installationId = payload.installation?.id;
+
+  if (typeof installationId !== 'number') {
+    return { status: 'ok', message: 'missing_installation' };
+  }
+
+  const installation = await db.query.githubInstallations.findFirst({
+    where: eq(githubInstallations.installationId, installationId),
+    columns: { installedByUserId: true },
+  });
+
+  if (!installation) {
+    return { status: 'ok', message: 'unknown_installation' };
+  }
+
+  const result = await GitHub.syncGitHubInstallation({
+    userId: installation.installedByUserId,
+    installationId,
+  });
+
+  if (!result.success) {
+    return {
+      status: 'error',
+      message: `Failed to resync installation ${installationId}: ${result.error}`,
+    };
+  }
+
+  return {
+    status: 'ok',
+    message: `Resynced installation ${installationId}`,
+    metadata: { repositoryCount: result.repositories.length },
+  };
+}
diff --git a/apps/api/src/handlers/github/handlePrComment.ts b/apps/api/src/handlers/github/handlePrComment.ts
index 6efcfd116..91e2f201a 100644
--- a/apps/api/src/handlers/github/handlePrComment.ts
+++ b/apps/api/src/handlers/github/handlePrComment.ts
@@ -854,6 +854,7 @@ async function deliverFollowUpToExistingTask({
   taskId,
   userId,
   message,
+  quoteText = message,
   status,
   taskPhase,
   commenterDisplayName,
@@ -861,6 +862,7 @@ async function deliverFollowUpToExistingTask({
   taskId: string;
   userId?: string | null;
   message: string;
+  quoteText?: string;
   status: RunStatus;
   taskPhase: string | null;
   commenterDisplayName?: string;
@@ -890,6 +892,7 @@ async function deliverFollowUpToExistingTask({
           taskId,
           userId: senderUserId,
           message,
+          quoteText,
           senderMode: 'github_pr_follow_up',
           ...(commenterDisplayName
             ? { workerQuoteUserName: commenterDisplayName }
@@ -899,6 +902,7 @@ async function deliverFollowUpToExistingTask({
           taskId,
           userId: senderUserId,
           message,
+          quoteText,
           senderMode: 'github_pr_follow_up',
           ...(commenterDisplayName
             ? { workerQuoteUserName: commenterDisplayName }
@@ -932,12 +936,14 @@ async function resumeExistingTaskAndDeliverFollowUp({
   userId,
   sourceRunId,
   message,
+  quoteText = message,
   resumePromptFallbackTask,
 }: {
   taskId: string;
   userId?: string | null;
   sourceRunId: number;
   message: string;
+  quoteText?: string;
   resumePromptFallbackTask: SnapshotResumePromptFallbackTask;
 }) {
   const sourceRun = await findLatestTaskRun(taskId, {
@@ -984,6 +990,7 @@ async function resumeExistingTaskAndDeliverFollowUp({
       taskId,
       userId,
       message,
+      quoteText,
       status: sourceRun.status,
       taskPhase: sourceRun.taskPhase,
     });
@@ -1028,6 +1035,7 @@ async function resumeExistingTaskAndDeliverFollowUp({
     // Carry the follow-up on the resume run itself so the resumed worker can
     // send it after the harness session is actually ready.
     resumePrompt: message,
+    resumeQuoteText: quoteText,
     resumePromptSource: 'github',
     resumePromptFallbackTask,
   } satisfies TaskPayload<typeof TaskPayloadKind.SnapshotResume>;
@@ -1504,12 +1512,14 @@ export async function handlePrComment(
             userId: reviewer.properties.userId,
             sourceRunId: activePrOwner.runId,
             message: followUpMessage,
+            quoteText: mention.body ?? '',
             resumePromptFallbackTask,
           })
         : await deliverFollowUpToExistingTask({
             taskId: activePrOwner.taskId,
             userId: reviewer.properties.userId,
             message: followUpMessage,
+            quoteText: mention.body ?? '',
             status: activePrOwner.status,
             taskPhase: activePrOwner.taskPhase,
             commenterDisplayName,
diff --git a/apps/api/src/handlers/github/index.ts b/apps/api/src/handlers/github/index.ts
index da069691b..838e4e10a 100644
--- a/apps/api/src/handlers/github/index.ts
+++ b/apps/api/src/handlers/github/index.ts
@@ -38,6 +38,7 @@ import { handleWorkflowRunCompleted } from './handleWorkflowRunCompleted';
 
 // Repository metadata sync:
 import { handleRepositoryEdited } from './handleRepositoryEdited';
+import { handleInstallationRepositoriesChange } from './handleInstallationRepositoriesChange';
 
 // Utilities:
 import { isFromKnownInstallation } from './isFromKnownInstallation';
@@ -462,6 +463,26 @@ github.post('/', async (c) => {
       ),
     );
 
+    // Keep the stored repository list in sync as repos appear, disappear, or
+    // change access. Selected-repos installs emit `installation_repositories`;
+    // all-repos installs emit `repository.created/deleted` instead. Not gated
+    // on isRepoSkipped: the row must exist even for skipped repos.
+    webhooks.on(
+      ['installation_repositories.added', 'installation_repositories.removed'],
+      ({ id, name, payload }) =>
+        recordWebhook(id, `${name}.${payload.action}`, payload, () =>
+          handleInstallationRepositoriesChange(payload),
+        ),
+    );
+
+    webhooks.on(
+      ['repository.created', 'repository.deleted', 'repository.renamed'],
+      ({ id, name, payload }) =>
+        recordWebhook(id, `${name}.${payload.action}`, payload, () =>
+          handleInstallationRepositoriesChange(payload),
+        ),
+    );
+
     webhooks.on('workflow_run.completed', ({ id, name, payload }) =>
       recordWebhook(id, `${name}.${payload.action}`, payload, async () => {
         if (isRepoSkipped(payload.repository.full_name)) {
diff --git a/apps/api/src/handlers/linear/__tests__/linear-routing-confirmation.test.ts b/apps/api/src/handlers/linear/__tests__/linear-routing-confirmation.test.ts
index 422f87adb..8afb86e0f 100644
--- a/apps/api/src/handlers/linear/__tests__/linear-routing-confirmation.test.ts
+++ b/apps/api/src/handlers/linear/__tests__/linear-routing-confirmation.test.ts
@@ -13,6 +13,7 @@ const {
   findLinearUserMcpConnectionByIdentityMock,
   getValidAccessTokenMock,
   createMcpOauthReplayMock,
+  resolveDeploymentEnvVarMock,
 } = vi.hoisted(() => ({
   redisMock: {
     eval: vi.fn().mockResolvedValue(null),
@@ -31,6 +32,7 @@ const {
   findLinearUserMcpConnectionByIdentityMock: vi.fn(),
   getValidAccessTokenMock: vi.fn(),
   createMcpOauthReplayMock: vi.fn(),
+  resolveDeploymentEnvVarMock: vi.fn().mockResolvedValue('test-linear-secret'),
 }));
 
 vi.mock('@roomote/env', async (importOriginal) => {
@@ -154,6 +156,7 @@ vi.mock('@roomote/db/server', async (importOriginal) => {
     },
     linearAuthTokens: {},
     webhooks: { id: 'id', deliveryId: 'deliveryId' },
+    resolveDeploymentEnvVar: resolveDeploymentEnvVarMock,
     eq: vi.fn(),
     and: vi.fn(),
   };
@@ -293,6 +296,11 @@ describe('linear routed task startup', () => {
     );
 
     expect(response.status).toBe(200);
+    expect(resolveDeploymentEnvVarMock).toHaveBeenCalledWith(
+      'R_LINEAR_WEBHOOK_SECRET',
+      db,
+      { R_LINEAR_WEBHOOK_SECRET: 'test-linear-secret' },
+    );
     expect(emitThought).toHaveBeenCalledWith(
       'session-1',
       'Getting started...',
@@ -319,4 +327,155 @@ describe('linear routed task startup', () => {
     expect(emitElicitation).not.toHaveBeenCalled();
     expect(redisMock.set).not.toHaveBeenCalled();
   });
+
+  it('uses the session user when a direct delegation has no creator', async () => {
+    vi.mocked(routeTask).mockResolvedValue({
+      status: 'routed',
+      result: {
+        workspace: { type: 'all_repositories' },
+        reasoning: 'Best fit for review work',
+      },
+    });
+
+    const payload = makePayload({
+      agentSession: {
+        ...makePayload().agentSession,
+        creator: undefined,
+        user: { id: 'linear-user-1', name: 'Linear User' },
+      },
+    });
+    const { rawBody, headers } = createSignedRequest(payload);
+
+    const response = await app.request(
+      new Request('http://localhost/linear', {
+        method: 'POST',
+        headers,
+        body: rawBody,
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(findLinearUserMcpConnectionByIdentityMock).toHaveBeenCalledWith({
+      linearUserId: 'linear-user-1',
+      linearOrganizationId: 'linear-org-1',
+    });
+    expect(createLinearAgentRun).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-1' }),
+    );
+  });
+
+  it('starts a trusted Linear automation without a human identity', async () => {
+    vi.mocked(routeTask).mockResolvedValue({
+      status: 'routed',
+      result: {
+        workspace: { type: 'all_repositories' },
+        reasoning: 'Best fit for review work',
+      },
+    });
+
+    const payload = makePayload({
+      agentSession: {
+        ...makePayload().agentSession,
+        creator: undefined,
+        user: undefined,
+      },
+    });
+    const { rawBody, headers } = createSignedRequest(payload);
+
+    const response = await app.request(
+      new Request('http://localhost/linear', {
+        method: 'POST',
+        headers,
+        body: rawBody,
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(findLinearUserMcpConnectionByIdentityMock).not.toHaveBeenCalled();
+    expect(createLinearAgentRun).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: undefined }),
+    );
+  });
+
+  it('uses all repositories when automation routing fails', async () => {
+    vi.mocked(routeTask).mockRejectedValue(new Error('routing unavailable'));
+
+    const payload = makePayload({
+      agentSession: {
+        ...makePayload().agentSession,
+        creator: undefined,
+        user: undefined,
+      },
+    });
+    const { rawBody, headers } = createSignedRequest(payload);
+
+    const response = await app.request(
+      new Request('http://localhost/linear', {
+        method: 'POST',
+        headers,
+        body: rawBody,
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(createLinearAgentRun).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: undefined,
+        repo: ALL_REPOSITORIES,
+      }),
+    );
+  });
+
+  it('rejects an unidentified prompted session', async () => {
+    const payload = makePayload({
+      action: 'prompted',
+      agentSession: {
+        ...makePayload().agentSession,
+        creator: undefined,
+        user: undefined,
+      },
+    });
+    const { rawBody, headers } = createSignedRequest(payload);
+
+    const response = await app.request(
+      new Request('http://localhost/linear', {
+        method: 'POST',
+        headers,
+        body: rawBody,
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(findLinearUserMcpConnectionByIdentityMock).not.toHaveBeenCalled();
+    expect(createLinearAgentRun).not.toHaveBeenCalled();
+  });
+
+  it('requires account linking when a direct delegation user is unlinked', async () => {
+    findLinearUserMcpConnectionByIdentityMock.mockResolvedValue(null);
+
+    const payload = makePayload({
+      agentSession: {
+        ...makePayload().agentSession,
+        creator: undefined,
+        user: { id: 'linear-user-2', name: 'Unlinked User' },
+      },
+    });
+    const { rawBody, headers } = createSignedRequest(payload);
+
+    const response = await app.request(
+      new Request('http://localhost/linear', {
+        method: 'POST',
+        headers,
+        body: rawBody,
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    expect(emitElicitation).toHaveBeenCalledWith(
+      'session-1',
+      'Please link your Roomote account to continue.',
+      expect.objectContaining({ signal: 'auth' }),
+    );
+    expect(createLinearAgentRun).not.toHaveBeenCalled();
+  });
 });
diff --git a/apps/api/src/handlers/linear/index.ts b/apps/api/src/handlers/linear/index.ts
index dd0247d0c..88dbe8533 100644
--- a/apps/api/src/handlers/linear/index.ts
+++ b/apps/api/src/handlers/linear/index.ts
@@ -15,15 +15,16 @@ import {
 import { Env } from '@roomote/env';
 import {
   type RoutingDebugInfo,
-  type RoutingWorkspace,
   enqueueTask,
-  routeTask,
-  buildLinearRoutingContext,
 } from '@roomote/cloud-agents/server';
 import { buildTaskStartingText } from '@roomote/communication/chat-messages';
 import { getRedis } from '@roomote/redis';
 import { postRouterDebugMessage } from '@roomote/slack';
-import { setTrustedRunActingUserOnSuccess } from '@roomote/db/server';
+import {
+  db,
+  resolveDeploymentEnvVar,
+  setTrustedRunActingUserOnSuccess,
+} from '@roomote/db/server';
 import {
   createMcpOauthReplay,
   findLinearDeploymentMcpConnectionByIdentity,
@@ -48,12 +49,14 @@ import {
   cancelLinearTaskRun,
   parseAgentSessionEventPayload,
   createLinearAgentRun,
-  startElicitationFallback,
   findPendingSelection,
   handleElicitationResponse,
   deletePendingSelection,
   enrichSessionComments,
+  resolveLinearTaskDestination,
   type CreateLinearAgentRunResult,
+  type LinearWorkspaceSelection,
+  type ResolvedLinearTaskDestination,
 } from '@roomote/linear';
 
 import type { WebhookResponse } from '../../types';
@@ -114,37 +117,7 @@ const AUTH_TOKEN_EXPIRY_MS = 15 * 60 * 1000;
  * Result of workspace mapping that properly distinguishes between
  * repository names and environment IDs.
  */
-interface WorkspaceSelection {
-  repo?: string;
-  environmentId?: string;
-}
-
-/**
- * Maps a routing workspace to the appropriate repo/environmentId fields.
- *
- * @param workspace - The workspace selection from the LLM router
- * @returns Object with either repo or environmentId populated
- */
-function mapWorkspaceToSelection(
-  workspace: RoutingWorkspace,
-): WorkspaceSelection {
-  switch (workspace.type) {
-    case 'environment':
-      return { environmentId: workspace.id };
-    case 'all_repositories':
-      return { repo: ALL_REPOSITORIES };
-  }
-}
-
-/**
- * Derives the workspace type from a WorkspaceSelection.
- */
-function deriveWorkspaceType(
-  ws: WorkspaceSelection,
-): 'environment' | 'all_repositories' {
-  if (ws.environmentId) return 'environment';
-  return 'all_repositories';
-}
+type WorkspaceSelection = LinearWorkspaceSelection;
 
 /**
  * Maps an elicitation workspace type + value to the appropriate WorkspaceSelection.
@@ -197,16 +170,7 @@ function postLinearFinalRouterDebug({
   });
 }
 
-interface RoutedLinearTask {
-  workspaceSelection: WorkspaceSelection;
-  workspaceDisplayName: string;
-  workspaceType: 'environment' | 'all_repositories';
-  kickoffMessage?: string;
-  reasoning?: string;
-  routingDebug?: RoutingDebugInfo;
-  routingDurationMs?: number;
-  userRoute?: string;
-}
+type RoutedLinearTask = ResolvedLinearTaskDestination;
 
 async function startLinearTask({
   linearClient,
@@ -217,7 +181,7 @@ async function startLinearTask({
 }: {
   linearClient: LinearClient;
   payload: AgentSessionEventPayload;
-  userId: string;
+  userId?: string;
   routedTask: RoutedLinearTask;
   agentSession: AgentSessionEventPayload['agentSession'];
 }): Promise<WebhookResponse> {
@@ -302,7 +266,11 @@ linear.post('/', async (c) => {
 
   // Verify webhook signature
   const signature = headers['linear-signature'] ?? '';
-  const webhookSecret = Env.R_LINEAR_WEBHOOK_SECRET;
+  const webhookSecret = await resolveDeploymentEnvVar(
+    'R_LINEAR_WEBHOOK_SECRET',
+    db,
+    { R_LINEAR_WEBHOOK_SECRET: Env.R_LINEAR_WEBHOOK_SECRET },
+  );
 
   if (!webhookSecret) {
     console.error('[LinearWebhook] R_LINEAR_WEBHOOK_SECRET not configured');
@@ -432,12 +400,14 @@ async function handleAgentSessionEvent(
     return handleStopSignal(sessionId, linearClient, agentSession.issue.id);
   }
 
-  // Extract Linear user ID from the webhook payload - always use agentSession.creator
-  const linearUserId = agentSession.creator?.id;
+  // Direct issue delegations can omit human identity entirely. The signed
+  // webhook and org-level connection establish the trusted automation caller.
+  const linearUserId =
+    agentSession.creator?.id ?? agentSession.user?.id ?? agentActivity?.userId;
 
-  if (!linearUserId) {
+  if (!linearUserId && action === 'prompted') {
     console.error(
-      `[LinearWebhook] No Linear user ID found for session ${sessionId} - agentSession.creator is missing`,
+      `[LinearWebhook] No Linear user ID found for prompted session ${sessionId}`,
     );
     await linearClient.emitError(
       sessionId,
@@ -446,95 +416,107 @@ async function handleAgentSessionEvent(
     return { status: 'error', message: 'No Linear user ID in payload' };
   }
 
-  // Check if this Linear user is linked to a Roomote account
-  console.log(
-    `[LinearWebhook] Checking user mapping for linearUserId=${linearUserId}`,
-  );
+  let userId: string | undefined;
 
-  const userMapping = await findLinearUserMcpConnectionByIdentity({
-    linearUserId,
-    linearOrganizationId: organizationId,
-  });
+  if (linearUserId) {
+    console.log(
+      `[LinearWebhook] Checking user mapping for linearUserId=${linearUserId}`,
+    );
 
-  console.log(
-    `[LinearWebhook] User mapping result: ${userMapping ? `found (userId=${userMapping.userId})` : 'not found'}`,
-  );
+    const userMapping = await findLinearUserMcpConnectionByIdentity({
+      linearUserId,
+      linearOrganizationId: organizationId,
+    });
 
-  if (!userMapping) {
     console.log(
-      `[LinearWebhook] Linear user ${linearUserId} not linked - emitting auth signal`,
+      `[LinearWebhook] User mapping result: ${userMapping ? `found (userId=${userMapping.userId})` : 'not found'}`,
     );
 
-    const authToken = generateAuthToken();
+    if (!userMapping) {
+      console.log(
+        `[LinearWebhook] Linear user ${linearUserId} not linked - emitting auth signal`,
+      );
 
-    await createMcpOauthReplay({
-      token: authToken,
-      payload, // Store the original payload to replay after auth
-      userId: null,
-      mcpId: 'linear',
-      connectionId: null,
-      connectionRole: LINEAR_USER_CONNECTION_ROLE,
-      sessionId,
-      redirectTo: null,
-      metadata: {
-        linearUserId,
-        linearOrganizationId: organizationId,
-      },
-      expiresAt: new Date(Date.now() + AUTH_TOKEN_EXPIRY_MS),
-    });
+      const authToken = generateAuthToken();
 
-    const authUrl = `${getAuthBaseUrl()}/api/mcp-oauth/replay/${authToken}`;
-    console.log(`[LinearWebhook] Auth URL created for session ${sessionId}`);
+      await createMcpOauthReplay({
+        token: authToken,
+        payload, // Store the original payload to replay after auth
+        userId: null,
+        mcpId: 'linear',
+        connectionId: null,
+        connectionRole: LINEAR_USER_CONNECTION_ROLE,
+        sessionId,
+        redirectTo: null,
+        metadata: {
+          linearUserId,
+          linearOrganizationId: organizationId,
+        },
+        expiresAt: new Date(Date.now() + AUTH_TOKEN_EXPIRY_MS),
+      });
 
-    // Emit an auth elicitation signal
-    console.log(
-      `[LinearWebhook] Emitting auth elicitation for session ${sessionId}`,
-    );
-    const authResult = await linearClient.emitElicitation(
-      sessionId,
-      `Please link your ${PRODUCT_NAME} account to continue.`,
-      {
-        signal: 'auth',
-        signalMetadata: {
-          url: authUrl,
-          userId: linearUserId,
-          providerName: PRODUCT_NAME,
+      const authUrl = `${getAuthBaseUrl()}/api/mcp-oauth/replay/${authToken}`;
+      console.log(`[LinearWebhook] Auth URL created for session ${sessionId}`);
+
+      // Emit an auth elicitation signal
+      console.log(
+        `[LinearWebhook] Emitting auth elicitation for session ${sessionId}`,
+      );
+      const authResult = await linearClient.emitElicitation(
+        sessionId,
+        `Please link your ${PRODUCT_NAME} account to continue.`,
+        {
+          signal: 'auth',
+          signalMetadata: {
+            url: authUrl,
+            userId: linearUserId,
+            providerName: PRODUCT_NAME,
+          },
         },
-      },
-    );
+      );
 
-    console.log(
-      `[LinearWebhook] Auth elicitation result: ${JSON.stringify(authResult)}`,
-    );
+      console.log(
+        `[LinearWebhook] Auth elicitation result: ${JSON.stringify(authResult)}`,
+      );
+
+      if (!authResult.success) {
+        console.error(
+          `[LinearWebhook] Failed to emit auth signal: ${authResult.error}`,
+        );
+      }
 
-    if (!authResult.success) {
+      return { status: 'ok' };
+    }
+
+    if (!userMapping.userId) {
       console.error(
-        `[LinearWebhook] Failed to emit auth signal: ${authResult.error}`,
+        `[LinearWebhook] Linear link for user ${linearUserId} is missing a Roomote user id`,
+      );
+      await linearClient.emitError(
+        sessionId,
+        'Your Linear account link is incomplete. Please reconnect your account and try again.',
       );
+      return { status: 'error', message: 'Linked user id is missing' };
     }
 
-    return { status: 'ok' };
-  }
-
-  // User is linked - update userId to the linked user
-  const userId = userMapping.userId;
-  if (!userId) {
-    console.error(
-      `[LinearWebhook] Linear link for user ${linearUserId} is missing a Roomote user id`,
+    userId = userMapping.userId;
+    console.log(
+      `[LinearWebhook] Linear user ${linearUserId} is linked to Roomote user ${userId}`,
     );
-    await linearClient.emitError(
-      sessionId,
-      'Your Linear account link is incomplete. Please reconnect your account and try again.',
+  } else {
+    console.log(
+      `[LinearWebhook] Starting trusted Linear automation for session ${sessionId}`,
     );
-    return { status: 'error', message: 'Linked user id is missing' };
   }
 
-  console.log(
-    `[LinearWebhook] Linear user ${linearUserId} is linked to Roomote user ${userId}`,
-  );
-
   // Check if this is a follow-up prompt for an existing session
   if (action === 'prompted') {
+    if (!userId) {
+      return {
+        status: 'error',
+        message: 'No linked user for prompted session',
+      };
+    }
     // First, check for an active task run. When a job is running (e.g. waiting
     // on ask_followup_question), the user's reply must be delivered to it
     // immediately. This takes priority over routing confirmation and
@@ -907,189 +889,41 @@ async function handleAgentSessionEvent(
     agentSession,
   );
 
-  let workspaceSelection: WorkspaceSelection = { repo: ALL_REPOSITORIES };
-
   console.log(`[LinearWebhook] Attempting to route Linear task`);
-
-  try {
-    // Production routing already resolves the correct workspace, so keep the
-    // existing Linear task description input and only change the kickoff flow.
-    const taskDescription =
-      agentSession.comment?.body ||
-      agentSession.issue.description ||
-      agentSession.issue.title;
-
-    // Build routing context with all relevant Linear data
-    const routingContext = await buildLinearRoutingContext({
-      userId,
-      taskDescription,
-      issueIdentifier: agentSession.issue.identifier,
-      issueTitle: agentSession.issue.title,
-      issueDescription: agentSession.issue.description,
-      projectName: agentSession.issue.project?.name,
-      teamName: agentSession.issue.team?.name,
-      guidance: agentSession.guidance,
-      previousComments: enrichedSession.previousComments?.map((c) => ({
-        body: c.body,
-        username: c.user?.name,
-      })),
-      apiBaseUrl: Env.TRPC_URL ?? Env.R_APP_URL,
-    });
-
-    // Attempt LLM routing
-    const routingStart = Date.now();
-    const routingDecision = await routeTask(routingContext);
-    const routingDurationMs = Date.now() - routingStart;
-
-    if (routingDecision.status === 'platform_answer') {
-      const responseResult = await linearClient.emitResponse(
-        sessionId,
-        routingDecision.result.answer,
-      );
-
-      if (!responseResult.success) {
-        console.error(
-          `[LinearWebhook] Failed to emit platform answer to Linear: ${responseResult.error}`,
-        );
-      }
-
-      return { status: 'ok' };
-    }
-
-    if (routingDecision.status === 'routed') {
-      const { result } = routingDecision;
-
-      console.log(
-        `[LinearWebhook] LLM routing decision: ` +
-          `workspace=${result.workspace.type}${result.workspace.type === 'environment' ? `(${result.workspace.name})` : ''}, ` +
-          `reasoning="${result.reasoning}"`,
-      );
-
-      const ws = mapWorkspaceToSelection(result.workspace);
-
-      const wsDesc =
-        ws.repo === ALL_REPOSITORIES
-          ? 'all repos'
-          : ws.repo ||
-            (result.workspace.type === 'environment'
-              ? result.workspace.name
-              : `environment(${ws.environmentId})`);
-
-      return startLinearTask({
-        linearClient,
-        payload,
-        userId,
-        routedTask: {
-          workspaceSelection: ws,
-          workspaceDisplayName: wsDesc,
-          workspaceType: deriveWorkspaceType(ws),
-          ...(result.kickoffMessage
-            ? { kickoffMessage: result.kickoffMessage }
-            : {}),
-          reasoning: result.reasoning,
-          routingDebug: result.debug,
-          routingDurationMs,
-        },
-        agentSession: enrichedSession,
-      });
-    } else {
-      console.log(
-        `[LinearWebhook] LLM routing fell back: ${routingDecision.reason}`,
-      );
-    }
-  } catch (routingError) {
-    console.error(
-      `[LinearWebhook] LLM routing error, falling back to default:`,
-      routingError instanceof Error
-        ? routingError.message
-        : String(routingError),
-    );
-  }
-
-  // If routing was not used or failed, use the elicitation fallback flow
-  console.log(
-    `[LinearWebhook] LLM routing not available or failed, starting elicitation fallback for session ${sessionId}`,
-  );
-
-  const fallbackResult = await startElicitationFallback({
-    sessionId,
-    linearOrganizationId: organizationId,
-    userId,
+  const destinationResult = await resolveLinearTaskDestination({
     payload,
+    agentSession: enrichedSession,
+    userId,
     linearClient,
+    apiBaseUrl: Env.TRPC_URL ?? Env.R_APP_URL,
   });
 
-  if (fallbackResult.status === 'error') {
-    console.error(
-      `[LinearWebhook] Elicitation fallback error: ${fallbackResult.message}`,
-    );
-
-    const errorResult = await linearClient.emitError(
+  if (destinationResult.status === 'platform_answer') {
+    const responseResult = await linearClient.emitResponse(
       sessionId,
-      `Failed to start workspace selection: ${fallbackResult.message}`,
+      destinationResult.answer,
     );
 
-    if (!errorResult.success) {
+    if (!responseResult.success) {
       console.error(
-        `[LinearWebhook] Failed to emit error to Linear: ${errorResult.error}`,
+        `[LinearWebhook] Failed to emit platform answer to Linear: ${responseResult.error}`,
       );
     }
 
-    return { status: 'error', message: fallbackResult.message };
+    return { status: 'ok' };
   }
 
-  // Check if the elicitation completed immediately (e.g., only one workspace)
-  if (fallbackResult.pendingSelection.step === 'completed') {
-    const selectedRepo =
-      fallbackResult.pendingSelection.selectedRepo ?? ALL_REPOSITORIES;
-
-    const wsOptions = fallbackResult.pendingSelection
-      .workspaceOptions as Array<{
-      type: 'all' | 'environment';
-      id: string;
-      name: string;
-    }> | null;
-
-    const matchedWs = wsOptions?.find((ws) => ws.id === selectedRepo);
-
-    if (matchedWs?.type === 'environment') {
-      workspaceSelection = { environmentId: matchedWs.id };
-    } else if (selectedRepo === ALL_REPOSITORIES) {
-      workspaceSelection = { repo: ALL_REPOSITORIES };
-    } else {
-      workspaceSelection = { repo: selectedRepo };
-    }
-
-    console.log(
-      `[LinearWebhook] Elicitation auto-completed with workspace=${JSON.stringify(workspaceSelection)}`,
-    );
-
-    await deletePendingSelection(sessionId);
-  } else {
+  if (destinationResult.status === 'awaiting_selection') {
     console.log(
       `[LinearWebhook] Elicitation started, awaiting workspace selection for session ${sessionId}`,
     );
-
     return { status: 'ok' };
   }
 
-  // Create the task run
-  const runResult = await createLinearAgentRun({
-    agentSession: enrichedSession,
-    payload,
-    userId,
-    repo: workspaceSelection.repo,
-    environmentId: workspaceSelection.environmentId,
-  });
-
-  if (runResult.status === 'error') {
-    console.error(
-      `[LinearWebhook] Failed to create task run: ${runResult.message}`,
-    );
-
+  if (destinationResult.status === 'error') {
     const errorResult = await linearClient.emitError(
       sessionId,
-      `Failed to start agent: ${runResult.message}`,
+      `Failed to start workspace selection: ${destinationResult.message}`,
     );
 
     if (!errorResult.success) {
@@ -1098,20 +932,16 @@ async function handleAgentSessionEvent(
       );
     }
 
-    return { status: 'error', message: runResult.message };
+    return { status: 'error', message: destinationResult.message };
   }
 
-  console.log(
-    `[LinearWebhook] Created ${describeLinearRunResult(runResult)} for session ${sessionId}`,
-  );
-
-  await updateLinearSessionTaskUrlForDirectLaunch({
+  return startLinearTask({
     linearClient,
-    sessionId,
-    runResult,
+    payload,
+    userId,
+    routedTask: destinationResult.destination,
+    agentSession: enrichedSession,
   });
-
-  return { status: 'ok' };
 }
 
 /**
diff --git a/apps/api/src/handlers/tasks/__tests__/sendMessageToTask.test.ts b/apps/api/src/handlers/tasks/__tests__/sendMessageToTask.test.ts
index ec4f933bc..b48e4b5e0 100644
--- a/apps/api/src/handlers/tasks/__tests__/sendMessageToTask.test.ts
+++ b/apps/api/src/handlers/tasks/__tests__/sendMessageToTask.test.ts
@@ -222,6 +222,7 @@ describe('sendMessageToTask', () => {
     ).toBeLessThan(mockSendPromptMutate.mock.invocationCallOrder[0]!);
     expect(mockSendPromptMutate).toHaveBeenCalledWith({
       prompt: 'Continue as the new sender.',
+      quoteText: 'Continue as the new sender.',
       autoSteerWhenQueued: true,
     });
   });
@@ -362,6 +363,7 @@ describe('sendMessageToTask', () => {
     });
     expect(mockSendPromptMutate).toHaveBeenCalledWith({
       prompt: 'Please keep the existing payout logic.',
+      quoteText: 'Please keep the existing payout logic.',
       source: 'web',
       clientMessageId: 'client-1',
     });
@@ -394,6 +396,7 @@ describe('sendMessageToTask', () => {
     expect(mockTrackLatestUserMessageForSlackQuote).not.toHaveBeenCalled();
     expect(mockSendPromptMutate).toHaveBeenCalledWith({
       prompt: 'This stays in the web UI only.',
+      quoteText: 'This stays in the web UI only.',
     });
   });
 
@@ -495,6 +498,7 @@ describe('sendMessageToTask', () => {
     expect(mockTrackLatestUserMessageForSlackQuote).not.toHaveBeenCalled();
     expect(mockSendPromptMutate).toHaveBeenCalledWith({
       prompt: 'Please keep the existing payout logic.',
+      quoteText: 'Please keep the existing payout logic.',
     });
   });
 
@@ -519,6 +523,8 @@ describe('sendMessageToTask', () => {
     expect(mockTrackLatestUserMessageForSlackQuote).not.toHaveBeenCalled();
     expect(mockSendPromptMutate).toHaveBeenCalledWith({
       prompt: '<github-pr-follow-up>Route this through the existing PR task.',
+      quoteText:
+        '<github-pr-follow-up>Route this through the existing PR task.',
       userName: 'Ada Lovelace',
     });
   });
@@ -550,6 +556,7 @@ describe('sendMessageToTask', () => {
     });
     expect(mockSteerTaskMutate).toHaveBeenCalledWith({
       prompt: 'Pause the implementation and inspect the failing test.',
+      quoteText: 'Pause the implementation and inspect the failing test.',
     });
   });
 
@@ -608,6 +615,8 @@ describe('sendMessageToTask', () => {
     expect(mockUserFindFirst).toHaveBeenCalledWith(expect.anything());
     expect(mockSteerTaskMutate).toHaveBeenCalledWith({
       prompt: '<github-pr-follow-up>Route this through the existing PR task.',
+      quoteText:
+        '<github-pr-follow-up>Route this through the existing PR task.',
       userName: 'Ada Lovelace',
     });
   });
@@ -630,6 +639,8 @@ describe('sendMessageToTask', () => {
     expect(mockUserFindFirst).not.toHaveBeenCalled();
     expect(mockSteerTaskMutate).toHaveBeenCalledWith({
       prompt: '<github-pr-follow-up>Route this through the existing PR task.',
+      quoteText:
+        '<github-pr-follow-up>Route this through the existing PR task.',
       userName: 'octocat',
     });
   });
@@ -651,6 +662,8 @@ describe('sendMessageToTask', () => {
     });
     expect(mockSteerTaskMutate).toHaveBeenCalledWith({
       prompt: '<github-pr-follow-up>Route this through the existing PR task.',
+      quoteText:
+        '<github-pr-follow-up>Route this through the existing PR task.',
     });
   });
 
diff --git a/apps/api/src/handlers/tasks/manageSourceControl.ts b/apps/api/src/handlers/tasks/manageSourceControl.ts
index c7ce752f5..1ee30b6ab 100644
--- a/apps/api/src/handlers/tasks/manageSourceControl.ts
+++ b/apps/api/src/handlers/tasks/manageSourceControl.ts
@@ -1,6 +1,12 @@
 import type { Context } from 'hono';
 import type { ContentfulStatusCode } from 'hono/utils/http-status';
 import { z } from 'zod';
+import {
+  claimLatestUserMessageForReplyQuote,
+  completeClaimedLatestUserMessageForReplyQuote,
+  restoreClaimedLatestUserMessageForReplyQuote,
+} from '@roomote/communication/messages';
+import { resolveSourceControlProviderFromPayload } from '@roomote/types';
 
 import {
   createOrUpdateSourceControlPullRequestForTaskRun,
@@ -27,6 +33,27 @@ import {
 } from '../mcp/proxy-utils';
 import { logHandlerError } from '../utils';
 
+const GITHUB_REPLY_QUOTE_MAX_LENGTH = 280;
+
+function formatGitHubReplyQuote(params: {
+  userName: string;
+  text: string;
+}): string | null {
+  const userName = params.userName.replace(/\s+/g, ' ').trim();
+  const text = params.text.trim();
+
+  if (!userName || !text) {
+    return null;
+  }
+
+  const truncated =
+    text.length <= GITHUB_REPLY_QUOTE_MAX_LENGTH
+      ? text
+      : `${text.slice(0, GITHUB_REPLY_QUOTE_MAX_LENGTH - 3).trimEnd()}...`;
+
+  return `> **${userName}:** ${truncated.replaceAll('\n', '\n> ')}`;
+}
+
 /**
  * POST /api/mcp/tasks/:taskId/source_control
  *
@@ -66,6 +93,57 @@ export async function manageSourceControl(
       runId: auth.authContext.runId,
       taskId,
     });
+    const isGitHubTask =
+      resolveSourceControlProviderFromPayload(taskRun.payload) === 'github';
+    const bodyInput = 'body' in input ? input : null;
+    const shouldQuote =
+      isGitHubTask &&
+      (input.action === 'reply_to_pull_request_comment' ||
+        input.action === 'create_pull_request_comment' ||
+        input.action === 'create_issue_comment') &&
+      typeof bodyInput?.body === 'string';
+    const pendingQuoteClaim = shouldQuote
+      ? await claimLatestUserMessageForReplyQuote('github', taskRun.id)
+      : null;
+    const pendingQuote = pendingQuoteClaim?.message ?? null;
+
+    if (pendingQuote && typeof bodyInput?.body === 'string') {
+      const quote = formatGitHubReplyQuote(pendingQuote);
+      if (quote) {
+        bodyInput.body = `${quote}\n\n${bodyInput.body}`;
+      }
+    }
+
+    const restoreQuoteAfterFailure = async () => {
+      if (pendingQuoteClaim) {
+        await restoreClaimedLatestUserMessageForReplyQuote(
+          'github',
+          taskRun.id,
+          pendingQuoteClaim,
+        );
+      }
+    };
+
+    const completeQuoteAfterSuccess = async () => {
+      if (pendingQuoteClaim) {
+        await completeClaimedLatestUserMessageForReplyQuote(
+          'github',
+          taskRun.id,
+          pendingQuoteClaim,
+        );
+      }
+    };
+
+    const runWithQuoteRestorationOnFailure = async <T>(
+      operation: () => Promise<T>,
+    ): Promise<T> => {
+      try {
+        return await operation();
+      } catch (error) {
+        await restoreQuoteAfterFailure();
+        throw error;
+      }
+    };
 
     switch (input.action) {
       case 'create_or_update_pull_request':
@@ -88,22 +166,28 @@ export async function manageSourceControl(
       case 'create_pull_request_comment':
       case 'resolve_pull_request_thread':
       case 'submit_pull_request_review':
-      case 'update_pull_request_comment':
-        return c.json(
-          await writeSourceControlPullRequestForTaskRun({
+      case 'update_pull_request_comment': {
+        const writeResult = await runWithQuoteRestorationOnFailure(() =>
+          writeSourceControlPullRequestForTaskRun({
             taskRun,
             input,
           }),
         );
+        await completeQuoteAfterSuccess();
+        return c.json(writeResult);
+      }
       case 'get_issue':
       case 'list_issue_comments':
-      case 'create_issue_comment':
-        return c.json(
-          await manageSourceControlIssueForTaskRun({
+      case 'create_issue_comment': {
+        const issueResult = await runWithQuoteRestorationOnFailure(() =>
+          manageSourceControlIssueForTaskRun({
             taskRun,
             input,
           }),
         );
+        await completeQuoteAfterSuccess();
+        return c.json(issueResult);
+      }
     }
   } catch (error) {
     if (error instanceof z.ZodError) {
diff --git a/apps/api/src/handlers/tasks/sendMessageToTask.ts b/apps/api/src/handlers/tasks/sendMessageToTask.ts
index 45112394c..e9959b1ff 100644
--- a/apps/api/src/handlers/tasks/sendMessageToTask.ts
+++ b/apps/api/src/handlers/tasks/sendMessageToTask.ts
@@ -462,6 +462,7 @@ async function resumeTaskFromSnapshot({
   taskId,
   userId,
   message,
+  quoteText,
   images,
   source,
   clientMessageId,
@@ -472,6 +473,7 @@ async function resumeTaskFromSnapshot({
   taskId: string;
   userId: string;
   message: string;
+  quoteText: string;
   images?: string[];
   source?: string;
   clientMessageId?: string;
@@ -567,7 +569,7 @@ async function resumeTaskFromSnapshot({
     payload,
     slackThreadTs: channelBindings?.slackThreadTs ?? null,
     userId,
-    message,
+    message: quoteText,
     senderMode,
   });
 
@@ -720,6 +722,7 @@ export async function sendMessageToTask({
   userId,
   authContext,
   message,
+  quoteText = message,
   images,
   source,
   clientMessageId,
@@ -730,6 +733,7 @@ export async function sendMessageToTask({
   userId: string;
   authContext?: AuthTokenContext | RunTokenContext;
   message: string;
+  quoteText?: string;
   images?: string[];
   source?: string;
   clientMessageId?: string;
@@ -787,6 +791,7 @@ export async function sendMessageToTask({
         taskId,
         userId: linkedReviewHandoff.senderUserId,
         message,
+        quoteText,
         images,
         source,
         clientMessageId,
@@ -829,7 +834,7 @@ export async function sendMessageToTask({
         payload: run.payload as Record<string, unknown> | null,
         slackThreadTs: channelBindings?.slackThreadTs ?? null,
         userId: senderUserId,
-        message,
+        message: quoteText,
         senderMode,
       });
 
@@ -861,6 +866,7 @@ export async function sendMessageToTask({
         call: (client) =>
           client.commands.sendPrompt.mutate({
             prompt: message,
+            quoteText,
             ...(followUpPromptSource ? { source: followUpPromptSource } : {}),
             ...(normalizedClientMessageId
               ? { clientMessageId: normalizedClientMessageId }
@@ -927,6 +933,7 @@ export async function steerMessageToTask({
   taskId,
   userId,
   message,
+  quoteText = message,
   images,
   senderMode,
   workerQuoteUserName,
@@ -934,6 +941,7 @@ export async function steerMessageToTask({
   taskId: string;
   userId: string;
   message: string;
+  quoteText?: string;
   images?: string[];
   senderMode?: SendMessageSenderMode;
   /**
@@ -967,6 +975,7 @@ export async function steerMessageToTask({
         taskId,
         userId,
         message,
+        quoteText,
         images,
         sourceRun: run as LatestTaskRun,
         channelBindings,
@@ -1000,7 +1009,7 @@ export async function steerMessageToTask({
         payload: run.payload as Record<string, unknown> | null,
         slackThreadTs: channelBindings?.slackThreadTs ?? null,
         userId,
-        message,
+        message: quoteText,
         senderMode,
       });
 
@@ -1026,6 +1035,7 @@ export async function steerMessageToTask({
         call: (client) =>
           client.commands.steerTask.mutate({
             prompt: message,
+            quoteText,
             ...(resolvedQuoteUserName
               ? { userName: resolvedQuoteUserName }
               : {}),
diff --git a/apps/docs/environments.mdx b/apps/docs/environments.mdx
index e029c9e53..cffe40df0 100644
--- a/apps/docs/environments.mdx
+++ b/apps/docs/environments.mdx
@@ -41,6 +41,21 @@ The setup task is meant to produce a working environment Roomote can reuse. If
 it cannot finish, adjust the input and try again from
 **Settings > Environments**.
 
+## Start from a brand-new repository
+
+You do not need an existing codebase to set up an environment. From
+**Settings > Environments > New** (or the onboarding repo-selection step),
+choose **Create a new repository** to open github.com with the right owner
+pre-filled — either a brand-new repository or a fork of an existing one by
+URL. Once you create it on GitHub, it appears in the repository list
+automatically; if the GitHub App only has access to selected repositories,
+grant it access to the new repository first.
+
+An empty repository is fine. When you start setup against a repository with
+no commits, Roomote pushes a minimal initial commit (a README and a
+.gitignore) to the default branch and creates a basic environment. Building
+the actual project is then just your first task in that environment.
+
 ## What to include
 
 Add enough context for Roomote to start productively:
diff --git a/apps/docs/integrations/linear.mdx b/apps/docs/integrations/linear.mdx
index 47da38a8a..5dcb92acd 100644
--- a/apps/docs/integrations/linear.mdx
+++ b/apps/docs/integrations/linear.mdx
@@ -15,9 +15,26 @@ priority, or discussion.
 ## Setup
 
 <Steps>
-  <Step title="Connect Linear">
-    In Roomote, go to **Settings > Integrations** and connect your Linear
-    workspace.
+  <Step title="Set up the OAuth app">
+    On a self-hosted deployment, an administrator goes to **Settings >
+    Integrations**, selects **Set it up**, and then selects **Create Linear
+    app** to open the pre-filled manifest. The app name defaults to the same
+    `roomote-<deployment-hostname>` convention used by the GitHub setup. After
+    creating the private app, copy its client ID, client secret, and webhook
+    secret back into Roomote. Roomote encrypts the saved credentials.
+  </Step>
+  <Step title="Connect the workspace">
+    Select **Enable Linear**, approve the app in Linear, and return to Roomote.
+    Deployments that provide `R_LINEAR_CLIENT_ID`,
+    `R_LINEAR_CLIENT_SECRET`, and `R_LINEAR_WEBHOOK_SECRET` in the runtime
+    environment continue to use those values and skip the in-app setup.
+  </Step>
+  <Step title="Update or remove saved credentials">
+    A deployment administrator can return to **Settings > Integrations** and
+    select **Configure** on Linear. Saving a new client ID or client secret
+    disconnects the current workspace so it can be authorized again. Removing
+    saved credentials disables Linear but does not delete the app in Linear.
+    Credentials managed by the deployment environment must be changed there.
   </Step>
   <Step title="Link your user account">
     Link your Linear identity when prompted so Roomote can associate issue
diff --git a/apps/docs/providers/source-control/github.mdx b/apps/docs/providers/source-control/github.mdx
index 9fc69c78e..10910d222 100644
--- a/apps/docs/providers/source-control/github.mdx
+++ b/apps/docs/providers/source-control/github.mdx
@@ -80,6 +80,7 @@ Grant these repository permissions:
 - **Code scanning alerts**: Read-only
 - **Issues**: Read and write
 - **Metadata**: Read-only
+- **Organization projects**: Read and write
 - **Pull requests**: Read and write
 - **Workflows**: Read and write
 
@@ -127,6 +128,12 @@ Subscribe to these events:
 GitHub Apps also receive `installation` and `installation_repositories`
 events automatically; you do not need to subscribe to them in the app form.
 
+Roomote uses the **Repository** and `installation_repositories` events to
+pick up newly created or newly granted repositories without a manual refresh.
+If your app was created before the **Repository** event was part of the
+manifest, confirm it is enabled under the app's **Permissions & events** page
+— GitHub has no API to update an app's event subscriptions.
+
 ## Save credentials
 
 Copy these values into the `/setup` manual form, deployment env vars, or your
@@ -155,6 +162,34 @@ Install the GitHub App on the repositories Roomote should use. Then sign in,
 complete the GitHub step in `/setup`, and confirm repository sync sees the
 expected repositories.
 
+If you add Organization projects permission to an existing app, an organization
+owner must approve the updated permission before Roomote can manage project
+items.
+
+## Daily GitHub management
+
+Roomote tasks can manage routine repository work through the GitHub App
+installation. Requests default to the repository mapped to the task:
+
+- list, create, edit, delete, and apply labels to issues or pull requests
+- create, update, delete, and report progress for milestones; assign issues to milestones
+- list accessible GitHub Projects V2, inspect an issue or pull request's Status,
+  and update an existing project item's single-select Status field
+
+Read-only requests, creations, and additive label actions run directly. Before
+editing, replacing, assigning, clearing, moving, or deleting an item, Roomote
+shows the proposed change and asks for confirmation. Deletions name the resource
+and URL in that confirmation. After a write, Roomote reads the result back and
+shares its GitHub URL.
+
+Projects V2 operations require the **Organization projects** permission above.
+If a project or Status field is ambiguous, Roomote asks you to choose one. An
+issue or pull request that is not already on a project is reported as such;
+Roomote does not add it automatically.
+
+Native GitHub saved views are not currently supported. Roomote can share an
+issue-search URL, but it does not represent that URL as a saved GitHub view.
+
 ## Start work from issues and pull requests
 
 Once the app is installed and an environment maps the repository:
diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index b56c1c2f1..ca2cdc982 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -40,6 +40,10 @@ const nextConfig: NextConfig = {
     '/*': [...webEnvFiles, '../docs/**/*'],
   },
   experimental: {
+    // Next 16 enables Turbopack's persistent dev cache by default. In this
+    // monorepo its periodic writes and compactions can monopolize a CPU core,
+    // so keep the cache in memory for the current dev-server session instead.
+    turbopackFileSystemCacheForDev: false,
     serverActions: {
       bodySizeLimit: '20mb', // Increase body size limit for image uploads.
     },
diff --git a/apps/web/public/elements/about.png b/apps/web/public/elements/about.png
new file mode 100644
index 000000000..33ce7693b
Binary files /dev/null and b/apps/web/public/elements/about.png differ
diff --git a/apps/web/src/app/(authenticated)/home/OnboardingCard.client.test.tsx b/apps/web/src/app/(authenticated)/home/OnboardingCard.client.test.tsx
new file mode 100644
index 000000000..16309b426
--- /dev/null
+++ b/apps/web/src/app/(authenticated)/home/OnboardingCard.client.test.tsx
@@ -0,0 +1,294 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+
+import type { OnboardingLinkableProvider } from '@/app/(onboarding)/onboarding/types';
+
+let isAdmin = true;
+let linkableProviders: OnboardingLinkableProvider[] = [];
+let enabledMcpIds: string[] = [];
+let linkedMcpIds: string[] = [];
+let orgHasLinear = false;
+let userHasLinkedLinear = false;
+
+const {
+  mockPush,
+  mockReplace,
+  mockAuthenticateSlack,
+  mockAuthenticateGitHub,
+  mockAuthenticateLinear,
+} = vi.hoisted(() => ({
+  mockPush: vi.fn(),
+  mockReplace: vi.fn(),
+  mockAuthenticateSlack: vi.fn(),
+  mockAuthenticateGitHub: vi.fn(),
+  mockAuthenticateLinear: vi.fn(),
+}));
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: mockPush, replace: mockReplace }),
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn(), success: vi.fn() } }));
+
+vi.mock('@/hooks/useUser', () => ({
+  useAuthorizedUser: () => ({ isAdmin }),
+}));
+
+vi.mock('@/hooks/mcp-connections', () => ({
+  useDeploymentMcpEnablements: () => ({
+    data: enabledMcpIds.map((mcpId) => ({ mcpId, enabled: true })),
+    isPending: false,
+  }),
+  useUserMcpConnections: () => ({
+    data: linkedMcpIds.map((mcpId) => ({ mcpId, authStatus: 'authenticated' })),
+    isPending: false,
+  }),
+  useConnectMcp: () => ({ isPending: false, mutate: vi.fn() }),
+}));
+
+vi.mock('@/hooks/github', () => ({
+  useAuthenticateGitHubAccount: () => ({
+    isPending: false,
+    mutate: mockAuthenticateGitHub,
+  }),
+}));
+
+vi.mock('@/hooks/slack', () => ({
+  useAuthenticateSlackAccount: () => ({
+    isPending: false,
+    mutate: mockAuthenticateSlack,
+  }),
+}));
+
+vi.mock('@/hooks/linear', () => ({
+  useAuthenticateLinearAccount: () => ({
+    isPending: false,
+    mutate: mockAuthenticateLinear,
+  }),
+}));
+
+vi.mock('@/hooks/linked-accounts', () => ({
+  useAuthenticateAdoAccount: () => ({ isPending: false, mutate: vi.fn() }),
+  useAuthenticateBitbucketAccount: () => ({
+    isPending: false,
+    mutate: vi.fn(),
+  }),
+  useAuthenticateGiteaAccount: () => ({ isPending: false, mutate: vi.fn() }),
+  useAuthenticateGitLabAccount: () => ({ isPending: false, mutate: vi.fn() }),
+  useAuthenticateMicrosoftTeamsAccount: () => ({
+    isPending: false,
+    mutate: vi.fn(),
+  }),
+}));
+
+vi.mock('@/trpc/client', () => ({
+  useTRPC: () => ({
+    onboarding: {
+      status: { queryOptions: () => ({ queryKey: ['onboarding'] }) },
+    },
+    automations: {
+      onboardingStatus: { queryOptions: () => ({ queryKey: ['automations'] }) },
+    },
+  }),
+}));
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: (options: { queryKey: string[] }) =>
+    options.queryKey[0] === 'onboarding'
+      ? {
+          data: {
+            linkableProviders,
+            orgHasLinear,
+            userHasLinkedLinear,
+          },
+          isPending: false,
+        }
+      : { data: { hasEnabledAutomations: true }, isPending: false },
+}));
+
+vi.mock('motion/react', async () => {
+  const { forwardRef } = await import('react');
+
+  return {
+    AnimatePresence: ({ children }: { children: React.ReactNode }) => children,
+    motion: {
+      div: forwardRef<
+        HTMLDivElement,
+        React.ComponentPropsWithoutRef<'div'> & {
+          initial?: unknown;
+          animate?: unknown;
+          exit?: unknown;
+          variants?: unknown;
+          transition?: unknown;
+        }
+      >(
+        (
+          {
+            initial: _initial,
+            animate: _animate,
+            exit: _exit,
+            variants: _variants,
+            transition: _transition,
+            ...props
+          },
+          ref,
+        ) => <div ref={ref} {...props} />,
+      ),
+    },
+  };
+});
+
+vi.mock('@/components/settings/McpIcon', () => ({
+  McpIcon: ({ name }: { name: string }) => <span>{name}</span>,
+}));
+
+vi.mock('@/components/settings/DiscordLinkAccountStep', () => ({
+  DiscordLinkAccountStep: () => <div>Discord link flow</div>,
+}));
+
+vi.mock('@/components/settings/TelegramLinkAccountStep', () => ({
+  TelegramLinkAccountStep: () => <div>Telegram link flow</div>,
+}));
+
+import { OnboardingCard } from './OnboardingCard';
+
+function dismissCard() {
+  fireEvent.click(screen.getAllByRole('button', { name: 'Dismiss' })[0]!);
+}
+
+beforeEach(() => {
+  isAdmin = true;
+  linkableProviders = [];
+  enabledMcpIds = [];
+  linkedMcpIds = [];
+  orgHasLinear = false;
+  userHasLinkedLinear = false;
+  localStorage.clear();
+  vi.clearAllMocks();
+});
+
+it('prioritizes communication accounts before source-control accounts', () => {
+  linkableProviders = [
+    {
+      id: 'github',
+      category: 'source-control',
+      label: 'GitHub',
+      configured: true,
+      linked: false,
+    },
+    {
+      id: 'discord',
+      category: 'communication',
+      label: 'Discord',
+      configured: true,
+      linked: false,
+    },
+    {
+      id: 'slack',
+      category: 'communication',
+      label: 'Slack',
+      configured: true,
+      linked: false,
+    },
+  ];
+
+  render(<OnboardingCard />);
+  expect(screen.getByText('Link your Slack account')).toBeInTheDocument();
+  dismissCard();
+  expect(screen.getByText('Link your Discord account')).toBeInTheDocument();
+  dismissCard();
+  expect(screen.getByText('Link your GitHub account')).toBeInTheDocument();
+});
+
+it('does not offer Slack installation, but links an installed Slack account', () => {
+  linkableProviders = [
+    {
+      id: 'slack',
+      category: 'communication',
+      label: 'Slack',
+      configured: false,
+      linked: false,
+    },
+  ];
+
+  render(<OnboardingCard />);
+  expect(
+    screen.queryByText(/Chat with Roomote on Slack/),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.getByText('Enable Notion for your workspace'),
+  ).toBeInTheDocument();
+});
+
+it('uses the requested admin integration setup order', () => {
+  render(<OnboardingCard />);
+
+  for (const name of [
+    'Notion',
+    'Sentry',
+    'Linear',
+    'Jira',
+    'Vercel',
+    'Supabase',
+    'PostHog',
+    'Grafana',
+    'Asana',
+  ]) {
+    expect(
+      screen.getByText(`Enable ${name} for your workspace`),
+    ).toBeInTheDocument();
+    dismissCard();
+  }
+});
+
+it('opens the highlighted integration settings for admin setup', () => {
+  render(<OnboardingCard />);
+
+  fireEvent.click(screen.getByRole('button', { name: 'Set it up' }));
+  expect(mockPush).toHaveBeenCalledWith(
+    '/settings/integrations?highlight=notion',
+  );
+});
+
+it('does not show workspace setup to non-admins and prompts enabled personal MCP links', () => {
+  isAdmin = false;
+  enabledMcpIds = ['notion'];
+
+  render(<OnboardingCard />);
+  expect(screen.getByText('Link your Notion account')).toBeInTheDocument();
+  expect(
+    screen.queryByText('Enable Notion for your workspace'),
+  ).not.toBeInTheDocument();
+});
+
+it('starts Slack linking directly', () => {
+  linkableProviders = [
+    {
+      id: 'slack',
+      category: 'communication',
+      label: 'Slack',
+      configured: true,
+      linked: false,
+    },
+  ];
+  render(<OnboardingCard />);
+
+  fireEvent.click(screen.getByRole('button', { name: 'Link' }));
+  expect(mockAuthenticateSlack).toHaveBeenCalledWith('/', expect.any(Object));
+});
+
+it('opens the Discord account-link dialog directly', () => {
+  linkableProviders = [
+    {
+      id: 'discord',
+      category: 'communication',
+      label: 'Discord',
+      configured: true,
+      linked: false,
+    },
+  ];
+  render(<OnboardingCard />);
+
+  fireEvent.click(screen.getByRole('button', { name: 'Link' }));
+  expect(screen.getByText('Discord link flow')).toBeInTheDocument();
+});
diff --git a/apps/web/src/app/(authenticated)/home/OnboardingCard.tsx b/apps/web/src/app/(authenticated)/home/OnboardingCard.tsx
index 2d65b6e7c..a1c6f41d7 100644
--- a/apps/web/src/app/(authenticated)/home/OnboardingCard.tsx
+++ b/apps/web/src/app/(authenticated)/home/OnboardingCard.tsx
@@ -1,16 +1,11 @@
 'use client';
 
 import { useQuery } from '@tanstack/react-query';
-import { useEffect, useRef, useState } from 'react';
+import { useEffect, useRef, useState, type ReactNode } from 'react';
 import { useSearchParams, useRouter } from 'next/navigation';
+import { AnimatePresence, motion } from 'motion/react';
 import { toast } from 'sonner';
-import {
-  getMcpIntegrationConnectionScope,
-  isSelfServeMcpIntegration,
-  isDeploymentScopedMcpIntegration,
-  MCP_INTEGRATIONS,
-  PRODUCT_NAME,
-} from '@roomote/types';
+import { MCP_INTEGRATIONS } from '@roomote/types';
 
 import { useAuthorizedUser } from '@/hooks/useUser';
 import {
@@ -18,17 +13,26 @@ import {
   useUserMcpConnections,
   useConnectMcp,
 } from '@/hooks/mcp-connections';
+import { useAuthenticateGitHubAccount } from '@/hooks/github';
+import { useAuthenticateSlackAccount } from '@/hooks/slack';
+import { useAuthenticateLinearAccount } from '@/hooks/linear';
 import {
-  useGitHubInstallations,
-  useAuthenticateGitHubAccount,
-} from '@/hooks/github';
-import { useSlackInstallation, useConnectSlack } from '@/hooks/slack';
-import { useLinearInstallation, useConnectLinear } from '@/hooks/linear';
-import { useGitHubLinkedAccount } from '@/hooks/linked-accounts';
+  useAuthenticateAdoAccount,
+  useAuthenticateBitbucketAccount,
+  useAuthenticateGiteaAccount,
+  useAuthenticateGitLabAccount,
+  useAuthenticateMicrosoftTeamsAccount,
+} from '@/hooks/linked-accounts';
 import { useTRPC } from '@/trpc/client';
 import { SETTINGS_PATHS } from '@/lib/settings';
 
 import {
+  BrandIcon,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
   Github,
   LinearLogo,
   Slack,
@@ -38,12 +42,61 @@ import {
   Zap,
 } from '@/components/system';
 import { McpIcon } from '@/components/settings/McpIcon';
+import { DiscordLinkAccountStep } from '@/components/settings/DiscordLinkAccountStep';
+import { TelegramLinkAccountStep } from '@/components/settings/TelegramLinkAccountStep';
 
 const DISMISSED_KEY = 'OnboardingCardsDismissedByOrg';
+const DISMISSED_DEPLOYMENT_KEY = 'deployment';
+
+const ADMIN_INTEGRATION_ORDER = [
+  'notion',
+  'sentry',
+  'linear',
+  'jira',
+  'vercel',
+  'supabase',
+  'posthog',
+  'grafana',
+  'asana',
+] as const;
+
+const PERSONAL_MCP_INTEGRATION_ORDER = ['notion', 'supabase'] as const;
+
+const CARD_EXIT_TRANSITION = {
+  duration: 0.4,
+  ease: 'easeOut',
+} as const;
+
+const CARD_ENTER_TRANSITION = {
+  duration: 0.4,
+  delay: 0.25,
+  ease: 'easeOut',
+} as const;
+
+const CARD_ANIMATION = {
+  initial: { opacity: 0, y: 20 },
+  animate: { opacity: 1, y: 0, transition: CARD_ENTER_TRANSITION },
+  exit: { opacity: 0, y: -20, transition: CARD_EXIT_TRANSITION },
+} as const;
+
+const COMMUNICATION_PROVIDER_ORDER = [
+  'slack',
+  'microsoft',
+  'telegram',
+  'discord',
+] as const;
+
+const SOURCE_CONTROL_PROVIDER_ORDER = [
+  'github',
+  'gitlab',
+  'gitea',
+  'bitbucket',
+  'ado',
+] as const;
 
 type CardConfig = {
   id: string;
-  icon: React.ReactNode;
+  icon: ReactNode;
   label: string;
   buttonLabel: string;
   onClick: () => void;
@@ -52,24 +105,27 @@ type CardConfig = {
   visible: boolean;
 };
 
-const DISMISSED_DEPLOYMENT_KEY = 'deployment';
+type LinkableProviderId =
+  | 'slack'
+  | 'microsoft'
+  | 'telegram'
+  | 'discord'
+  | 'github'
+  | 'gitlab'
+  | 'gitea'
+  | 'bitbucket'
+  | 'ado';
 
 function readDismissedCardIds(): string[] {
   try {
     const raw = localStorage.getItem(DISMISSED_KEY);
-    if (!raw) {
-      return [];
-    }
+    if (!raw) return [];
 
     const parsed = JSON.parse(raw) as Record<string, string[]>;
     const dismissed = parsed[DISMISSED_DEPLOYMENT_KEY];
-    if (!Array.isArray(dismissed)) {
-      return [];
-    }
-
-    return dismissed.filter(
-      (value): value is string => typeof value === 'string',
-    );
+    return Array.isArray(dismissed)
+      ? dismissed.filter((value): value is string => typeof value === 'string')
+      : [];
   } catch {
     return [];
   }
@@ -79,7 +135,6 @@ function writeDismissedCardIds(ids: string[]): void {
   try {
     const raw = localStorage.getItem(DISMISSED_KEY);
     const parsed = raw ? (JSON.parse(raw) as Record<string, string[]>) : {};
-
     parsed[DISMISSED_DEPLOYMENT_KEY] = ids;
     localStorage.setItem(DISMISSED_KEY, JSON.stringify(parsed));
   } catch {
@@ -87,9 +142,13 @@ function writeDismissedCardIds(ids: string[]): void {
   }
 }
 
-/**
- * Shows at most one onboarding guidance card at a time, in priority order.
- */
+function getMcpIntegration(id: string) {
+  const integration = MCP_INTEGRATIONS.find((entry) => entry.id === id);
+  if (!integration) throw new Error(`Unknown MCP integration: ${id}`);
+  return integration;
+}
+
+/** Shows at most one onboarding guidance card at a time, in priority order. */
 export function OnboardingCard() {
   const { isAdmin } = useAuthorizedUser();
   const searchParams = useSearchParams();
@@ -97,114 +156,44 @@ export function OnboardingCard() {
   const trpc = useTRPC();
   const shouldShowSuggestedTasksCard =
     searchParams.get('link_suggested') === 'true';
-
-  const { data: githubInstallations = [], isPending: githubPending } =
-    useGitHubInstallations();
-  const { data: slackInstallation, isPending: slackPending } =
-    useSlackInstallation();
-  const { data: linearInstallation, isPending: linearPending } =
-    useLinearInstallation();
-  const { data: githubLinkedAccount, isPending: githubAccountPending } =
-    useGitHubLinkedAccount();
+  const onboarding = useQuery(trpc.onboarding.status.queryOptions());
   const enablements = useDeploymentMcpEnablements();
   const userMcpConnections = useUserMcpConnections();
   const connectMcp = useConnectMcp();
-  const mcpPending = enablements.isPending || userMcpConnections.isPending;
   const { data: automationOnboardingStatus, isPending: automationsPending } =
     useQuery(trpc.automations.onboardingStatus.queryOptions());
 
-  const promotedMcpIntegrations = mcpPending
-    ? []
-    : MCP_INTEGRATIONS.filter((integration) =>
-        isSelfServeMcpIntegration(integration),
-      )
-        .map((integration, index) => ({ integration, index }))
-        .filter(({ integration }) => Boolean(integration.homepageCard))
-        .filter(({ integration }) =>
-          isDeploymentScopedMcpIntegration(integration)
-            ? isAdmin
-            : (enablements.data ?? []).some(
-                (entry) => entry.mcpId === integration.id && entry.enabled,
-              ),
-        )
-        .filter(
-          ({ integration }) =>
-            !isDeploymentScopedMcpIntegration(integration) || isAdmin,
-        )
-        .filter(
-          ({ integration }) =>
-            !(userMcpConnections.data ?? []).some(
-              (connection) =>
-                connection.mcpId === integration.id &&
-                connection.authStatus === 'authenticated',
-            ),
-        )
-        .sort((left, right) => {
-          const leftPriority = left.integration.homepageCard?.priority ?? 0;
-          const rightPriority = right.integration.homepageCard?.priority ?? 0;
-
-          if (leftPriority === rightPriority) {
-            return left.index - right.index;
-          }
-
-          return rightPriority - leftPriority;
-        })
-        .map(({ integration }) => integration);
-
+  const authenticateSlackAccount = useAuthenticateSlackAccount();
+  const authenticateGitHubAccount = useAuthenticateGitHubAccount();
+  const authenticateLinearAccount = useAuthenticateLinearAccount();
+  const authenticateMicrosoftTeamsAccount =
+    useAuthenticateMicrosoftTeamsAccount();
+  const authenticateGitLabAccount = useAuthenticateGitLabAccount();
+  const authenticateGiteaAccount = useAuthenticateGiteaAccount();
+  const authenticateBitbucketAccount = useAuthenticateBitbucketAccount();
+  const authenticateAdoAccount = useAuthenticateAdoAccount();
+  const [linkDialog, setLinkDialog] = useState<'telegram' | 'discord' | null>(
+    null,
+  );
   const [dismissed, setDismissed] = useState<Record<string, boolean>>({});
-
-  const connectSlack = useConnectSlack('/', {
-    onError: () => {
-      toast.error('Failed to connect Slack. Please try again.');
-    },
-  });
-
-  const connectLinear = useConnectLinear('/', {
-    onError: () => {
-      toast.error('Failed to connect Linear. Please try again.');
-    },
-  });
-
-  const authenticateGitHubAccount = useAuthenticateGitHubAccount({
-    onSuccess: (result) => {
-      if (result.success) {
-        window.location.href = result.url;
-      } else {
-        toast.error(result.error);
-      }
-    },
-    onError: () =>
-      toast.error('Failed to link GitHub account. Please try again.'),
-  });
-
   const connectionToastedRef = useRef(false);
 
   useEffect(() => {
-    if (connectionToastedRef.current) {
-      return;
-    }
+    if (connectionToastedRef.current) return;
 
     const slackConnected = searchParams.get('slack') === 'connected';
     const linearConnected = searchParams.get('linear') === 'connected';
+    if (!slackConnected && !linearConnected) return;
 
-    if (slackConnected || linearConnected) {
-      connectionToastedRef.current = true;
-
-      if (slackConnected) {
-        toast.success('Slack connected successfully');
-      }
-
-      if (linearConnected) {
-        toast.success('Linear connected successfully');
-      }
+    connectionToastedRef.current = true;
+    if (slackConnected) toast.success('Slack account linked successfully');
+    if (linearConnected) toast.success('Linear account linked successfully');
 
-      // Remove the query params from the URL without a full navigation
-      const url = new URL(window.location.href);
-      url.searchParams.delete('slack');
-      url.searchParams.delete('linear');
-      router.replace(url.pathname + url.search, { scroll: false });
-    }
-  }, [searchParams, router]);
+    const url = new URL(window.location.href);
+    url.searchParams.delete('slack');
+    url.searchParams.delete('linear');
+    router.replace(url.pathname + url.search, { scroll: false });
+  }, [router, searchParams]);
 
   useEffect(() => {
     const dismissedIds = readDismissedCardIds();
@@ -214,18 +203,224 @@ export function OnboardingCard() {
   }, []);
 
   const dismiss = (cardId: string) => {
-    const nextDismissed = {
-      ...dismissed,
-      [cardId]: true,
-    };
-
+    const nextDismissed = { ...dismissed, [cardId]: true };
     setDismissed(nextDismissed);
+    writeDismissedCardIds(
+      Object.entries(nextDismissed)
+        .filter(([, isDismissed]) => isDismissed)
+        .map(([id]) => id),
+    );
+  };
 
-    const nextDismissedIds = Object.entries(nextDismissed)
-      .filter(([, isDismissed]) => isDismissed)
-      .map(([id]) => id);
+  const startOAuthLink = (
+    name: string,
+    mutation: {
+      mutate: (redirect: string, options?: { onError: () => void }) => void;
+    },
+  ) => {
+    mutation.mutate('/', {
+      onError: () => toast.error(`Failed to link ${name}. Please try again.`),
+    });
+  };
+
+  const linkProvider = (providerId: LinkableProviderId) => {
+    switch (providerId) {
+      case 'slack':
+        authenticateSlackAccount.mutate('/', {
+          onSuccess: (result) => {
+            if (result.success) window.location.href = result.url;
+            else toast.error(result.error);
+          },
+          onError: () => toast.error('Failed to link Slack. Please try again.'),
+        });
+        return;
+      case 'github':
+        authenticateGitHubAccount.mutate(
+          { redirect: '/', callbackBackground: 'background' },
+          {
+            onSuccess: (result) => {
+              if (result.success) window.location.href = result.url;
+              else toast.error(result.error);
+            },
+            onError: () =>
+              toast.error('Failed to link GitHub. Please try again.'),
+          },
+        );
+        return;
+      case 'microsoft':
+        startOAuthLink('Microsoft Teams', authenticateMicrosoftTeamsAccount);
+        return;
+      case 'gitlab':
+        startOAuthLink('GitLab', authenticateGitLabAccount);
+        return;
+      case 'gitea':
+        startOAuthLink('Gitea', authenticateGiteaAccount);
+        return;
+      case 'bitbucket':
+        startOAuthLink('Bitbucket Cloud', authenticateBitbucketAccount);
+        return;
+      case 'ado':
+        startOAuthLink('Azure DevOps', authenticateAdoAccount);
+        return;
+      case 'telegram':
+      case 'discord':
+        setLinkDialog(providerId);
+    }
+  };
 
-    writeDismissedCardIds(nextDismissedIds);
+  const isProviderLinkPending = (providerId: LinkableProviderId) => {
+    switch (providerId) {
+      case 'slack':
+        return authenticateSlackAccount.isPending;
+      case 'github':
+        return authenticateGitHubAccount.isPending;
+      case 'microsoft':
+        return authenticateMicrosoftTeamsAccount.isPending;
+      case 'gitlab':
+        return authenticateGitLabAccount.isPending;
+      case 'gitea':
+        return authenticateGiteaAccount.isPending;
+      case 'bitbucket':
+        return authenticateBitbucketAccount.isPending;
+      case 'ado':
+        return authenticateAdoAccount.isPending;
+      default:
+        return false;
+    }
+  };
+
+  const status = onboarding.data;
+  const isIntegrationsPending =
+    onboarding.isPending ||
+    enablements.isPending ||
+    userMcpConnections.isPending;
+  const enabledMcpIds = new Set(
+    (enablements.data ?? [])
+      .filter((entry) => entry.enabled)
+      .map((entry) => entry.mcpId),
+  );
+  const authenticatedMcpIds = new Set(
+    (userMcpConnections.data ?? [])
+      .filter((connection) => connection.authStatus === 'authenticated')
+      .map((connection) => connection.mcpId),
+  );
+
+  const providerIcon = (providerId: LinkableProviderId) => {
+    switch (providerId) {
+      case 'slack':
+        return (
+          <Slack
+            className="size-4 shrink-0 text-muted-foreground"
+            strokeWidth={1}
+          />
+        );
+      case 'github':
+        return (
+          <Github
+            className="size-4 shrink-0 text-muted-foreground"
+            strokeWidth={1}
+          />
+        );
+      case 'microsoft':
+        return (
+          <BrandIcon icon="teams" name="Microsoft Teams" className="size-4" />
+        );
+      default: {
+        const icon = providerId === 'ado' ? 'ado' : providerId;
+        const name =
+          providerId === 'bitbucket' ? 'Bitbucket Cloud' : providerId;
+        return <BrandIcon icon={icon} name={name} className="size-4" />;
+      }
+    }
+  };
+
+  const providerCards: CardConfig[] = (status?.linkableProviders ?? []).map(
+    (provider) => ({
+      id: `link-${provider.id}`,
+      icon: providerIcon(provider.id as LinkableProviderId),
+      label: `Link your ${provider.label} account`,
+      buttonLabel: 'Link',
+      onClick: () => linkProvider(provider.id as LinkableProviderId),
+      disabled: isProviderLinkPending(provider.id as LinkableProviderId),
+      visible:
+        !isIntegrationsPending && provider.configured && !provider.linked,
+    }),
+  );
+
+  const adminIntegrationCards: CardConfig[] = ADMIN_INTEGRATION_ORDER.map(
+    (integrationId) => {
+      const integration = getMcpIntegration(integrationId);
+      const enabled =
+        integrationId === 'linear'
+          ? Boolean(status?.orgHasLinear)
+          : enabledMcpIds.has(integrationId);
+      const settingsId =
+        integrationId === 'sentry' ? 'sentry-mcp' : integrationId;
+      return {
+        id: `enable-${integrationId}`,
+        icon:
+          integrationId === 'linear' ? (
+            <LinearLogo className="size-4 shrink-0 text-muted-foreground" />
+          ) : (
+            <McpIcon icon={integration.icon} name={integration.name} />
+          ),
+        label: `Enable ${integration.name} for your workspace`,
+        buttonLabel: 'Set it up',
+        onClick: () =>
+          router.push(`${SETTINGS_PATHS.integrations}?highlight=${settingsId}`),
+        visible: isAdmin && !isIntegrationsPending && !enabled,
+      };
+    },
+  );
+
+  const personalMcpCards: CardConfig[] = PERSONAL_MCP_INTEGRATION_ORDER.map(
+    (integrationId) => {
+      const integration = getMcpIntegration(integrationId);
+      const isConnected = authenticatedMcpIds.has(integrationId);
+      const isPending =
+        connectMcp.isPending && connectMcp.variables?.mcpId === integrationId;
+      return {
+        id: `link-${integrationId}`,
+        icon: <McpIcon icon={integration.icon} name={integration.name} />,
+        label: `Link your ${integration.name} account`,
+        buttonLabel: 'Link',
+        onClick: () => {
+          connectMcp.mutate(
+            { mcpId: integrationId, redirectTo: '/' },
+            {
+              onSuccess: (url) => {
+                window.location.href = url;
+              },
+              onError: () =>
+                toast.error(
+                  `Failed to link ${integration.name}. Please try again.`,
+                ),
+            },
+          );
+        },
+        disabled: isPending,
+        visible:
+          !isIntegrationsPending &&
+          enabledMcpIds.has(integrationId) &&
+          !isConnected,
+      };
+    },
+  );
+
+  const linearPersonalCard: CardConfig = {
+    id: 'link-linear',
+    icon: <LinearLogo className="size-4 shrink-0 text-muted-foreground" />,
+    label: 'Link your Linear account',
+    buttonLabel: 'Link',
+    onClick: () =>
+      authenticateLinearAccount.mutate('/', {
+        onError: () => toast.error('Failed to link Linear. Please try again.'),
+      }),
+    disabled: authenticateLinearAccount.isPending,
+    visible:
+      !isIntegrationsPending &&
+      Boolean(status?.orgHasLinear) &&
+      !status?.userHasLinkedLinear,
   };
 
   const cards: CardConfig[] = [
@@ -234,196 +429,124 @@ export function OnboardingCard() {
       icon: <Spinner />,
       label: 'Your selected tasks have started.',
       buttonLabel: 'Check their progress',
-      onClick: () => {
-        router.push('/tasks');
-      },
+      onClick: () => router.push('/tasks'),
       dismissible: false,
       visible: shouldShowSuggestedTasksCard,
     },
+    ...COMMUNICATION_PROVIDER_ORDER.flatMap((providerId) =>
+      providerCards.filter((card) => card.id === `link-${providerId}`),
+    ),
+    ...SOURCE_CONTROL_PROVIDER_ORDER.flatMap((providerId) =>
+      providerCards.filter((card) => card.id === `link-${providerId}`),
+    ),
+    ...adminIntegrationCards,
+    ...personalMcpCards,
+    linearPersonalCard,
     {
-      id: 'slack',
-      icon: (
-        <Slack
-          className="size-4 shrink-0 text-muted-foreground"
-          strokeWidth={1}
-        />
-      ),
-      label: 'Chat with Roomote on Slack',
-      buttonLabel: 'Do it',
-      onClick: () => {
-        void (async () => {
-          try {
-            const url = await connectSlack.mutateAsync();
-
-            if (url) {
-              window.location.href = url;
-            }
-          } catch {
-            // Error handled by onError.
-          }
-        })();
-      },
-      disabled: connectSlack.isPending,
-      visible: !slackPending && !slackInstallation,
-    },
-    {
-      id: 'linear',
-      icon: (
-        <LinearLogo
-          className="size-4 shrink-0 text-muted-foreground"
-          strokeWidth={1}
-        />
-      ),
-      label: 'Assign tasks to agents from Linear',
-      buttonLabel: 'Do it',
-      onClick: () => {
-        void (async () => {
-          try {
-            const url = await connectLinear.mutateAsync();
-
-            if (url) {
-              window.location.href = url;
-            }
-          } catch {
-            // Error handled by onError.
-          }
-        })();
-      },
-      disabled: connectLinear.isPending,
-      visible: !linearPending && !linearInstallation,
-    },
-    {
-      id: 'github-account',
+      id: 'automations',
       icon: (
-        <Github
+        <Zap
           className="size-4 shrink-0 text-muted-foreground"
           strokeWidth={1}
         />
       ),
-      label: `Link your GitHub so ${PRODUCT_NAME} acts as you`,
-      buttonLabel: 'Do it',
-      onClick: () => {
-        void (async () => {
-          try {
-            const result = await authenticateGitHubAccount.mutateAsync({
-              redirect: '/',
-              callbackBackground: 'background',
-            });
-
-            if (result.success) {
-              window.location.href = result.url;
-            }
-          } catch {
-            // Error handled by onError.
-          }
-        })();
-      },
-      disabled: authenticateGitHubAccount.isPending,
+      label: 'Automations keep your repos moving in the background',
+      buttonLabel: 'Set them up',
+      onClick: () => router.push(SETTINGS_PATHS.automations),
       visible:
-        !githubPending &&
-        !githubAccountPending &&
-        githubInstallations.length > 0 &&
-        !githubLinkedAccount,
+        !automationsPending &&
+        Boolean(automationOnboardingStatus) &&
+        !automationOnboardingStatus?.hasEnabledAutomations,
     },
   ];
 
-  cards.push(
-    ...promotedMcpIntegrations.map((integration) => ({
-      id: `${integration.id}-connect`,
-      icon: <McpIcon icon={integration.icon} name={integration.name} />,
-      label:
-        integration.homepageCard?.label ??
-        (getMcpIntegrationConnectionScope(integration) === 'deployment'
-          ? `Connect ${integration.name} so Roomote can access it`
-          : `Connect ${integration.name} so Roomote can access it`),
-      buttonLabel: integration.homepageCard?.buttonLabel ?? 'Connect',
-      onClick: () => {
-        connectMcp.mutate(
-          { mcpId: integration.id, redirectTo: '/' },
-          {
-            onSuccess: (url) => {
-              window.location.href = url;
-            },
-            onError: () => {
-              toast.error(
-                `Failed to connect ${integration.name}. Please try again.`,
-              );
-            },
-          },
-        );
-      },
-      disabled: connectMcp.isPending,
-      visible: true,
-    })),
-  );
-
-  cards.push({
-    id: 'automations',
-    icon: (
-      <Zap className="size-4 shrink-0 text-muted-foreground" strokeWidth={1} />
-    ),
-    label: 'Automations keep your repos moving in the background',
-    buttonLabel: 'Set them up',
-    onClick: () => {
-      router.push(SETTINGS_PATHS.automations);
-    },
-    visible:
-      !automationsPending &&
-      Boolean(automationOnboardingStatus) &&
-      !automationOnboardingStatus?.hasEnabledAutomations,
-  });
-
   const activeCard = cards.find((card) => card.visible && !dismissed[card.id]);
-
-  if (!activeCard) {
-    return null;
-  }
+  if (!activeCard) return null;
 
   return (
     <>
-      <div className="flex  md:w-fit md:items-center gap-2 py-1 pl-1 md:pr-5 text-sm">
-        <span className="mt-1 md:mt-0">{activeCard.icon}</span>
-        <div className="flex gap-1 flex-col items-start md:flex-row md:items-center md:gap-2 grow">
-          <span className="flex gap-1 items-start flex-nowrap w-full">
-            <span className="cursor-default font-medium text-muted-foreground grow">
-              {activeCard.label}
-            </span>
-            {activeCard.dismissible !== false && (
+      <div className="relative overflow-clip">
+        <AnimatePresence initial={false} mode="popLayout">
+          <motion.div
+            key={activeCard.id}
+            initial="initial"
+            animate="animate"
+            exit="exit"
+            variants={CARD_ANIMATION}
+            className="flex md:w-fit md:items-center gap-2 py-1 pl-1 md:pr-5 text-sm"
+          >
+            <span className="mt-0.5 md:mt-0">{activeCard.icon}</span>
+            <div className="flex gap-1 flex-col items-start md:flex-row md:items-center md:gap-2 grow">
+              <span className="flex gap-1 items-start flex-nowrap w-full">
+                <span className="cursor-default font-medium text-muted-foreground grow">
+                  {activeCard.label}
+                </span>
+                {activeCard.dismissible !== false && (
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    type="button"
+                    className="md:hidden ml-auto text-muted-foreground hover:text-foreground"
+                    onClick={() => dismiss(activeCard.id)}
+                    aria-label="Dismiss"
+                  >
+                    <X className="size-3.5" />
+                  </Button>
+                )}
+              </span>
               <Button
-                variant="ghost"
-                size="icon"
+                variant="default"
+                size="xs"
                 type="button"
-                className="md:hidden ml-auto text-muted-foreground hover:text-foreground"
-                onClick={() => dismiss(activeCard.id)}
-                aria-label="Dismiss"
+                onClick={activeCard.onClick}
+                disabled={activeCard.disabled}
               >
-                <X className="size-3.5" />
+                {activeCard.buttonLabel}
               </Button>
-            )}
-          </span>
-          <Button
-            variant="default"
-            size="xs"
-            type="button"
-            onClick={activeCard.onClick}
-            disabled={activeCard.disabled}
-          >
-            {activeCard.buttonLabel}
-          </Button>
-          {activeCard.dismissible !== false && (
-            <Button
-              variant="ghost"
-              size="icon"
-              type="button"
-              className="hidden md:inline-flex ml-auto text-muted-foreground hover:text-foreground"
-              onClick={() => dismiss(activeCard.id)}
-              aria-label="Dismiss"
-            >
-              <X className="size-3.5" />
-            </Button>
-          )}
-        </div>
+              {activeCard.dismissible !== false && (
+                <Button
+                  variant="ghost"
+                  size="icon"
+                  type="button"
+                  className="hidden md:inline-flex ml-auto text-muted-foreground hover:text-foreground"
+                  onClick={() => dismiss(activeCard.id)}
+                  aria-label="Dismiss"
+                >
+                  <X className="size-3.5" />
+                </Button>
+              )}
+            </div>
+          </motion.div>
+        </AnimatePresence>
       </div>
+      <Dialog
+        open={linkDialog === 'telegram'}
+        onOpenChange={(open) => !open && setLinkDialog(null)}
+      >
+        <DialogContent size="md">
+          <DialogHeader>
+            <DialogTitle>Link your Telegram account</DialogTitle>
+            <DialogDescription>
+              Connect your Telegram identity to Roomote.
+            </DialogDescription>
+          </DialogHeader>
+          <TelegramLinkAccountStep autoGenerate pollUntilLinked />
+        </DialogContent>
+      </Dialog>
+      <Dialog
+        open={linkDialog === 'discord'}
+        onOpenChange={(open) => !open && setLinkDialog(null)}
+      >
+        <DialogContent size="md">
+          <DialogHeader>
+            <DialogTitle>Link your Discord account</DialogTitle>
+            <DialogDescription>
+              Connect your Discord identity to Roomote.
+            </DialogDescription>
+          </DialogHeader>
+          <DiscordLinkAccountStep autoGenerate pollUntilLinked />
+        </DialogContent>
+      </Dialog>
     </>
   );
 }
diff --git a/apps/web/src/app/(onboarding)/setup/NumberedStep.tsx b/apps/web/src/app/(onboarding)/setup/NumberedStep.tsx
index 31263825e..96c903637 100644
--- a/apps/web/src/app/(onboarding)/setup/NumberedStep.tsx
+++ b/apps/web/src/app/(onboarding)/setup/NumberedStep.tsx
@@ -10,10 +10,14 @@ export function NumberedStep({
   className?: string;
 }) {
   return (
-    <div className={`flex gap-2 items-start ${className ?? ''}`}>
-      <span className="rounded-full bg-foreground text-background font-bold size-8 inline-flex items-center justify-center shrink-0">
-        {number}
-      </span>
+    <div
+      className={`${number >= 0 && 'flex gap-2 items-start'} ${className ?? ''}`}
+    >
+      {number >= 0 && (
+        <span className="rounded-full bg-foreground text-background font-bold size-8 inline-flex items-center justify-center shrink-0">
+          {number}
+        </span>
+      )}
       <div className="min-w-0 flex-1 space-y-1">{children}</div>
     </div>
   );
diff --git a/apps/web/src/app/(onboarding)/setup/ProviderSetupExperience.tsx b/apps/web/src/app/(onboarding)/setup/ProviderSetupExperience.tsx
index a53fff7ed..fe01a8c8e 100644
--- a/apps/web/src/app/(onboarding)/setup/ProviderSetupExperience.tsx
+++ b/apps/web/src/app/(onboarding)/setup/ProviderSetupExperience.tsx
@@ -53,6 +53,57 @@ const TELEGRAM_SETUP_HIDDEN_ENV_VAR_NAMES = new Set([
   'R_TELEGRAM_WEBHOOK_SECRET',
 ]);
 
+export const MICROSOFT_APP_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const MICROSOFT_APP_ID_FIELD_ENV_VAR_NAMES = new Set([
+  'R_MICROSOFT_CLIENT_ID',
+  'R_TEAMS_BOT_APP_ID',
+]);
+
+/**
+ * Inline warning shown directly under an app-id input whose value cannot be an
+ * Entra client id. The package-download note further down explains the same
+ * problem, but the feedback belongs at the field where the value was typed.
+ */
+function getMicrosoftAppIdFormatWarning(
+  providerId: string,
+  envVarName: string,
+  value: string,
+): string | null {
+  if (
+    providerId !== 'microsoft' ||
+    !MICROSOFT_APP_ID_FIELD_ENV_VAR_NAMES.has(envVarName)
+  ) {
+    return null;
+  }
+
+  const trimmed = value.trim();
+
+  if (!trimmed || MICROSOFT_APP_ID_PATTERN.test(trimmed)) {
+    return null;
+  }
+
+  return "This doesn't look like an Entra app ID — expected a GUID like 00000000-0000-0000-0000-000000000000.";
+}
+
+/**
+ * The Teams app package embeds the bot app id, so a value that is not a GUID
+ * cannot produce a usable package. Explain that instead of leaving the
+ * download button dead with no reason.
+ */
+export function getTeamsAppPackageUnavailableReason(
+  enteredAppId: string,
+): string | null {
+  const appId = enteredAppId.trim();
+
+  if (!appId || MICROSOFT_APP_ID_PATTERN.test(appId)) {
+    return null;
+  }
+
+  return 'That App (Client) ID is not a valid GUID, so Roomote cannot pre-fill the Teams app package. Copy the Application (client) ID from the Entra app registration overview — it looks like 00000000-0000-0000-0000-000000000000.';
+}
+
 export function getSetupVisibleFields(
   provider: ProviderStatus | null,
   options: { showMicrosoftAdvancedConfig?: boolean } = {},
@@ -223,6 +274,14 @@ function ProviderFields({
           explicitValue.length === 0 &&
           !clearedSavedValues[field.envVarName] &&
           !editingSavedValues[field.envVarName];
+        const formatWarning =
+          !isSecretField && !field.runtimeSatisfied
+            ? getMicrosoftAppIdFormatWarning(
+                provider.id,
+                field.envVarName,
+                value,
+              )
+            : null;
 
         return (
           <div
@@ -276,6 +335,9 @@ function ProviderFields({
                 />
                 {(field.runtimeSatisfied || field.savedSatisfied) && <Check />}
               </div>
+              {formatWarning ? (
+                <p className="mt-1 text-sm text-amber-600">{formatWarning}</p>
+              ) : null}
             </div>
           </div>
         );
@@ -292,6 +354,12 @@ type ProviderSetupExperienceProps = {
   editingSavedValues: Record<string, boolean>;
   clearedSavedValues: Record<string, boolean>;
   teamsAppPackageHref: string | null;
+  /**
+   * Why the pre-filled package cannot be built yet (e.g. the entered App
+   * (Client) ID is not a GUID). Without it the download button just goes dead
+   * with nothing to act on.
+   */
+  teamsAppPackageUnavailableReason?: string | null;
   createdSlackAppSettingsUrl?: string | null;
   createdSlackAppIconSet?: boolean | null;
   createSlackAppPending?: boolean;
@@ -687,11 +755,17 @@ function MicrosoftSetupExperience(props: ProviderSetupExperienceProps) {
               </Button>
             </div>
           ) : (
-            <div className="flex items-center gap-2">
-              <Button variant="outline" size="sm" disabled>
-                <Download />
-                Download Teams app package
-              </Button>
+            <div className="space-y-2">
+              <div className="flex items-center gap-2">
+                <Button variant="outline" size="sm" disabled>
+                  <Download />
+                  Download Teams app package
+                </Button>
+              </div>
+              <p className="text-sm text-muted-foreground">
+                {props.teamsAppPackageUnavailableReason ??
+                  'Enter the values above to build a pre-filled package.'}
+              </p>
             </div>
           )}
         </div>
diff --git a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
index d7925daa9..fde3f72cb 100644
--- a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
@@ -17,12 +17,11 @@ import {
   getSetupEffectiveFieldValue,
   getSetupSubmitValues,
   getSetupVisibleFields,
+  getTeamsAppPackageUnavailableReason,
+  MICROSOFT_APP_ID_PATTERN,
   ProviderSetupExperience,
 } from './ProviderSetupExperience';
 
-/** Microsoft app (client) IDs are GUIDs. */
-const MICROSOFT_APP_ID_PATTERN =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const BOOTSTRAP_SIGN_IN_CALLBACK_PATH = '/setup';
 
 function getOAuth2ProviderId(
@@ -270,6 +269,9 @@ export function StepAuthEnvVars({
     : !bootstrapMode && teamsBotAppIdStored
       ? '/api/teams/app-package'
       : null;
+  const teamsAppPackageUnavailableReason = isMicrosoftProvider
+    ? getTeamsAppPackageUnavailableReason(enteredTeamsBotAppId)
+    : null;
   useEffect(() => {
     setCreatedSlackAppSettingsUrl(null);
     setCreatedSlackAppIconSet(null);
@@ -336,6 +338,7 @@ export function StepAuthEnvVars({
           editingSavedValues={editingSavedValues}
           clearedSavedValues={clearedSavedValues}
           teamsAppPackageHref={teamsAppPackageHref}
+          teamsAppPackageUnavailableReason={teamsAppPackageUnavailableReason}
           createdSlackAppSettingsUrl={createdSlackAppSettingsUrl}
           createdSlackAppIconSet={createdSlackAppIconSet}
           createSlackAppPending={
diff --git a/apps/web/src/app/(onboarding)/setup/StepRepoSelection.client.test.tsx b/apps/web/src/app/(onboarding)/setup/StepRepoSelection.client.test.tsx
index 6e69d4ee1..b050d0842 100644
--- a/apps/web/src/app/(onboarding)/setup/StepRepoSelection.client.test.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepRepoSelection.client.test.tsx
@@ -112,6 +112,34 @@ vi.mock('@/hooks/source-control', () => ({
   useRepositories: mockUseRepositories,
 }));
 
+vi.mock('@/components/github/CreateGitHubRepoDialog', () => ({
+  CreateGitHubRepoDialog: ({
+    open,
+    onRepositoryDetected,
+  }: {
+    open: boolean;
+    onRepositoryDetected?: (repository: {
+      id: string;
+      fullName: string;
+      isEmpty?: boolean;
+    }) => void;
+  }) =>
+    open ? (
+      <button
+        type="button"
+        onClick={() =>
+          onRepositoryDetected?.({
+            id: 'repo-created',
+            fullName: 'acme/created',
+            isEmpty: true,
+          })
+        }
+      >
+        Detect created repository
+      </button>
+    ) : null,
+}));
+
 vi.mock('@/hooks/task-models/useLaunchTaskModels', () => ({
   useLaunchTaskModels: () => ({
     data: {
@@ -218,6 +246,7 @@ vi.mock('@/components/system', () => ({
   Input: (props: InputHTMLAttributes<HTMLInputElement>) => <input {...props} />,
   ArrowRight: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   Loader2: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+  Plus: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   RefreshCcw: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   RotateCw: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   Search: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
@@ -633,7 +662,7 @@ describe('StepRepoSelection', () => {
     expect(onReviewComputeProvider).toHaveBeenCalled();
   });
 
-  it('shows a warning and disables Continue only when all selected repositories are empty', async () => {
+  it('explains the bootstrap and keeps Continue enabled when all selected repositories are empty', async () => {
     mockRepositories.splice(
       0,
       mockRepositories.length,
@@ -661,9 +690,11 @@ describe('StepRepoSelection', () => {
       screen.getByText(/all selected repositories have no commits yet/i),
     ).toBeInTheDocument();
     expect(
-      screen.getByText(/push an initial commit before continuing/i),
+      screen.getByText(
+        /will push an initial commit and set up a basic environment/i,
+      ),
     ).toBeInTheDocument();
-    expect(screen.getByRole('button', { name: 'Continue' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: 'Continue' })).toBeEnabled();
   });
 
   it('keeps Continue enabled and hides the warning for mixed empty and non-empty selections', async () => {
@@ -692,11 +723,58 @@ describe('StepRepoSelection', () => {
     fireEvent.click(screen.getByLabelText(/acme\/empty/i));
 
     expect(
-      screen.queryByText(/push an initial commit before continuing/i),
+      screen.queryByText(
+        /will push an initial commit and set up a basic environment/i,
+      ),
     ).not.toBeInTheDocument();
     expect(screen.getByRole('button', { name: 'Continue' })).toBeEnabled();
   });
 
+  it('offers the create-repo affordance and selects the repository it detects', async () => {
+    mockRepositories.splice(0, mockRepositories.length, {
+      id: 'repo-created',
+      fullName: 'acme/created',
+      private: true,
+      defaultBranch: 'main',
+      isEmpty: true,
+    });
+
+    await renderStepRepoSelection();
+
+    fireEvent.click(
+      screen.getByRole('button', { name: 'Create a new repository' }),
+    );
+    fireEvent.click(
+      screen.getByRole('button', { name: 'Detect created repository' }),
+    );
+
+    expect(screen.getByLabelText('acme/created')).toBeChecked();
+  });
+
+  it('keeps the create-repository item visible when the list is filtered to no matches', async () => {
+    mockRepositories.push(
+      ...Array.from({ length: 4 }, (_, index) => ({
+        id: `repo-extra-${index}`,
+        fullName: `acme/extra-${index}`,
+        private: true,
+        defaultBranch: 'main',
+      })),
+    );
+
+    await renderStepRepoSelection();
+
+    fireEvent.change(screen.getByLabelText('Filter repositories'), {
+      target: { value: 'does-not-exist' },
+    });
+
+    expect(
+      screen.getByRole('button', { name: 'Create a new repository' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText('No repositories match that filter.'),
+    ).toBeInTheDocument();
+  });
+
   it('renders the empty-repository warning below the repository list', async () => {
     mockRepositories.splice(
       0,
diff --git a/apps/web/src/app/(onboarding)/setup/StepRepoSelection.tsx b/apps/web/src/app/(onboarding)/setup/StepRepoSelection.tsx
index 7a38e4571..15a7acb55 100644
--- a/apps/web/src/app/(onboarding)/setup/StepRepoSelection.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepRepoSelection.tsx
@@ -39,6 +39,10 @@ import {
   Info,
   X,
 } from '@/components/system';
+import {
+  CreateGitHubRepoDialog,
+  type DetectedRepository,
+} from '@/components/github/CreateGitHubRepoDialog';
 import { EnvironmentRepositorySelector } from '@/components/settings/environments/EnvironmentRepositorySelector';
 import { ModelSelect } from '@/components/tasks';
 import { SetupFooter } from './SetupFooter';
@@ -106,6 +110,7 @@ export function StepRepoSelection({
     initialSelectedModelId ?? undefined,
   );
   const [repositoryFilter, setRepositoryFilter] = useState('');
+  const [createRepoDialogOpen, setCreateRepoDialogOpen] = useState(false);
   const [setupGuidance, setSetupGuidance] = useState(initialSetupGuidance);
   const [isRefreshPending, setIsRefreshPending] = useState(false);
   const refreshPromiseRef = useRef<Promise<unknown> | null>(null);
@@ -205,6 +210,17 @@ export function StepRepoSelection({
     );
   }, []);
 
+  const selectDetectedRepository = useCallback(
+    (repository: DetectedRepository) => {
+      setSelectedRepositoryIds((currentSelection) =>
+        currentSelection.includes(repository.id)
+          ? currentSelection
+          : [...currentSelection, repository.id],
+      );
+    },
+    [],
+  );
+
   const handleManageGitHubAccess = useCallback(() => {
     connectGitHub.mutate(`${pathname}?step=repo-selection`);
   }, [connectGitHub, pathname]);
@@ -282,57 +298,72 @@ export function StepRepoSelection({
 
   if (sortedRepositories.length === 0) {
     return (
-      <div className="relative w-full max-w-3xl space-y-6 py-2 md:py-4">
-        <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-          <StepTitle text={REPO_SELECTION_STEP.title} />
-        </div>
-        <div className="space-y-2">
-          <p className="font-semibold">No repositories available yet.</p>
-          <p>
-            {PRODUCT_NAME} is connected to GitHub, but this deployment does not
-            currently have any accessible repositories to use for setup.
-          </p>
-          <div className="flex flex-col md:flex-row gap-2 items-center mt-6">
-            <Button
-              type="button"
-              variant="default"
-              className="w-full md:w-auto"
-              onClick={() => void refreshRepositories()}
-              disabled={isRefreshingRepositories}
-            >
-              {isRefreshingRepositories ? (
-                <Loader2 className="animate-spin" />
-              ) : (
-                <RefreshCcw />
-              )}
-              Refresh
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              className="w-full md:w-auto"
-              onClick={handleManageGitHubAccess}
-              disabled={connectGitHub.isPending}
-            >
-              {connectGitHub.isPending ? (
-                <Loader2 className="animate-spin" />
-              ) : (
-                <Github />
-              )}
-              Edit GitHub Access
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              className="w-full md:w-auto"
-              onClick={onSkip}
-            >
-              Skip
-            </Button>
+      <>
+        <div className="relative w-full max-w-3xl space-y-6 py-2 md:py-4">
+          <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+            <StepTitle text={REPO_SELECTION_STEP.title} />
+          </div>
+          <div className="space-y-2">
+            <p className="font-semibold">No repositories available yet.</p>
+            <p>
+              {PRODUCT_NAME} is connected to GitHub, but this deployment does
+              not currently have any accessible repositories to use for setup.
+            </p>
+            <EnvironmentRepositorySelector
+              repositories={[]}
+              selectedRepositoryIds={selectedRepositoryIds}
+              onToggleRepository={toggleRepository}
+              onCreateRepository={() => setCreateRepoDialogOpen(true)}
+              inputPrefix="setup-repository"
+              heightClassName="h-auto"
+            />
+            <div className="flex flex-col md:flex-row gap-2 items-center mt-6">
+              <Button
+                type="button"
+                variant="default"
+                className="w-full md:w-auto"
+                onClick={() => void refreshRepositories()}
+                disabled={isRefreshingRepositories}
+              >
+                {isRefreshingRepositories ? (
+                  <Loader2 className="animate-spin" />
+                ) : (
+                  <RefreshCcw />
+                )}
+                Refresh
+              </Button>
+              <Button
+                type="button"
+                variant="outline"
+                className="w-full md:w-auto"
+                onClick={handleManageGitHubAccess}
+                disabled={connectGitHub.isPending}
+              >
+                {connectGitHub.isPending ? (
+                  <Loader2 className="animate-spin" />
+                ) : (
+                  <Github />
+                )}
+                Edit GitHub Access
+              </Button>
+              <Button
+                type="button"
+                variant="outline"
+                className="w-full md:w-auto"
+                onClick={onSkip}
+              >
+                Skip
+              </Button>
+            </div>
+            <p className="text-sm text-muted-foreground">Not recommended</p>
           </div>
-          <p className="text-sm text-muted-foreground">Not recommended</p>
         </div>
-      </div>
+        <CreateGitHubRepoDialog
+          open={createRepoDialogOpen}
+          onOpenChange={setCreateRepoDialogOpen}
+          onRepositoryDetected={selectDetectedRepository}
+        />
+      </>
     );
   }
 
@@ -349,245 +380,257 @@ export function StepRepoSelection({
     .join(', ');
 
   return (
-    <div className="relative w-full max-w-4xl space-y-6 py-2 md:py-4">
-      <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-        <StepTitle text={REPO_SELECTION_STEP.title} />
-      </div>
-      <div className="space-y-3 text-foreground">
-        {!showForm && (
-          <div className="space-y-2 flex gap-2 items-start">
-            <Info className="size-4 shrink-0 mt-1" />
-            <p>
-              <span className="font-semibold">
-                {PRODUCT_NAME} needs environments to verify its work.
-              </span>
-              <br />
-              That lets it run your app locally, click around, make API calls,
-              take screenshots.
-            </p>
-          </div>
-        )}
-        <p className={`text-foreground ${!showForm && 'ml-6'}`}>
-          Pick the repo(s) needed for the first env to set up.
-          <br />
-          Roomote will install dependencies and figure it all out on its own.
-        </p>
-      </div>
+    <>
+      <div className="relative w-full max-w-4xl space-y-6 py-2 md:py-4">
+        <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+          <StepTitle text={REPO_SELECTION_STEP.title} />
+        </div>
+        <div className="space-y-3 text-foreground">
+          {!showForm && (
+            <div className="space-y-2 flex gap-2 items-start">
+              <Info className="size-4 shrink-0 mt-1" />
+              <p>
+                <span className="font-semibold">
+                  {PRODUCT_NAME} needs environments to verify its work.
+                </span>
+                <br />
+                That lets it run your app locally, click around, make API calls,
+                take screenshots.
+              </p>
+            </div>
+          )}
+          <p className={`text-foreground ${!showForm && 'ml-6'}`}>
+            Pick the repo(s) needed for the first env to set up.
+            <br />
+            Roomote will install dependencies and figure it all out on its own.
+          </p>
+        </div>
 
-      {retryCopy ? (
-        <Alert variant="warning">
-          <AlertTriangle className="size-4" />
-          <AlertDescription>
-            {/* Single child: AlertDescription lays out its children with
+        {retryCopy ? (
+          <Alert variant="warning">
+            <AlertTriangle className="size-4" />
+            <AlertDescription>
+              {/* Single child: AlertDescription lays out its children with
                 flex, which would split loose text and the button apart. */}
-            <p>
-              {retryCopy}
-              {retryReason === 'task-failed' && onReviewComputeProvider ? (
-                <>
-                  {' '}
-                  If the run failed before doing any work, you can also{' '}
-                  <button
-                    type="button"
-                    className="underline underline-offset-4"
-                    onClick={onReviewComputeProvider}
-                  >
-                    review your sandbox provider
-                  </button>
-                  .
-                </>
-              ) : null}
-            </p>
-          </AlertDescription>
-        </Alert>
-      ) : null}
-
-      {computeProvisioningError ? (
-        <Alert variant="destructive">
-          <AlertTriangle className="size-4" />
-          <AlertDescription>
-            <p>
-              Sandbox provider provisioning failed: {computeProvisioningError}{' '}
-              {onRetryComputeProvisioning ? (
-                <button
-                  type="button"
-                  className="font-medium underline underline-offset-4"
-                  onClick={onRetryComputeProvisioning}
-                >
-                  Retry provisioning
-                </button>
-              ) : null}
-            </p>
-          </AlertDescription>
-        </Alert>
-      ) : null}
-
-      <Card className="p-3">
-        <CardContent>
-          <div className="space-y-3">
-            {showRepositoryFilter ? (
-              <div className="relative">
-                <Search className="pointer-events-none absolute left-3 top-1/2 size-4 -translate-y-1/2 text-muted-foreground" />
-                <Input
-                  type="text"
-                  value={repositoryFilter}
-                  onChange={(event) =>
-                    setRepositoryFilter(event.currentTarget.value)
-                  }
-                  placeholder="Filter repositories"
-                  aria-label="Filter repositories"
-                  className="pr-9 pl-9"
-                />
-                {repositoryFilter ? (
+              <p>
+                {retryCopy}
+                {retryReason === 'task-failed' && onReviewComputeProvider ? (
+                  <>
+                    {' '}
+                    If the run failed before doing any work, you can also{' '}
+                    <button
+                      type="button"
+                      className="underline underline-offset-4"
+                      onClick={onReviewComputeProvider}
+                    >
+                      review your sandbox provider
+                    </button>
+                    .
+                  </>
+                ) : null}
+              </p>
+            </AlertDescription>
+          </Alert>
+        ) : null}
+
+        {computeProvisioningError ? (
+          <Alert variant="destructive">
+            <AlertTriangle className="size-4" />
+            <AlertDescription>
+              <p>
+                Sandbox provider provisioning failed: {computeProvisioningError}{' '}
+                {onRetryComputeProvisioning ? (
                   <button
                     type="button"
-                    onClick={() => setRepositoryFilter('')}
-                    className="absolute right-3 top-1/2 -translate-y-1/2 cursor-pointer text-muted-foreground hover:text-foreground"
-                    aria-label="Clear repository filter"
+                    className="font-medium underline underline-offset-4"
+                    onClick={onRetryComputeProvisioning}
                   >
-                    <X className="size-4" />
+                    Retry provisioning
                   </button>
                 ) : null}
-              </div>
-            ) : null}
+              </p>
+            </AlertDescription>
+          </Alert>
+        ) : null}
+
+        <Card className="p-3">
+          <CardContent>
+            <div className="space-y-3">
+              {showRepositoryFilter ? (
+                <div className="relative">
+                  <Search className="pointer-events-none absolute left-3 top-1/2 size-4 -translate-y-1/2 text-muted-foreground" />
+                  <Input
+                    type="text"
+                    value={repositoryFilter}
+                    onChange={(event) =>
+                      setRepositoryFilter(event.currentTarget.value)
+                    }
+                    placeholder="Filter repositories"
+                    aria-label="Filter repositories"
+                    className="pr-9 pl-9"
+                  />
+                  {repositoryFilter ? (
+                    <button
+                      type="button"
+                      onClick={() => setRepositoryFilter('')}
+                      className="absolute right-3 top-1/2 -translate-y-1/2 cursor-pointer text-muted-foreground hover:text-foreground"
+                      aria-label="Clear repository filter"
+                    >
+                      <X className="size-4" />
+                    </button>
+                  ) : null}
+                </div>
+              ) : null}
 
-            {filteredRepositories.length > 0 ? (
               <EnvironmentRepositorySelector
                 repositories={filteredRepositories}
                 selectedRepositoryIds={selectedRepositoryIds}
                 onToggleRepository={toggleRepository}
+                onCreateRepository={() => setCreateRepoDialogOpen(true)}
                 inputPrefix="setup-repository"
                 heightClassName="max-h-[calc(var(--effective-viewport-height)-40rem)] md:h-[18.75rem]"
               />
-            ) : (
-              <div className="rounded-md border border-dashed px-4 py-6 text-sm text-muted-foreground">
-                No repositories match that filter.
-              </div>
-            )}
-          </div>
-          {allSelectedRepositoriesAreEmpty ? (
-            <Alert variant="warning">
-              <AlertTriangle className="size-4" />
-              <AlertDescription className="flex-col items-start gap-1">
-                <p>
-                  {emptyRepositoryWarningCopy} Push an initial commit before
-                  continuing, or choose different repositories.
-                </p>
-                <p className="font-medium text-foreground">
-                  {selectedEmptyRepositoryNames}
-                </p>
-                <Button
-                  type="button"
-                  size="sm"
-                  variant="outline"
-                  onClick={() => void refreshRepositories()}
-                  disabled={connectGitHub.isPending || isRefreshingRepositories}
-                >
-                  {isRefreshingRepositories ? (
-                    <Loader2 className="animate-spin" />
-                  ) : (
-                    <RotateCw />
-                  )}
-                  Refresh list
-                </Button>
-              </AlertDescription>
-            </Alert>
-          ) : null}
-          {showForm ? (
-            <div className="space-y-2 flex flex-col items-start">
-              <Textarea
-                value={setupGuidance}
-                onChange={(event) => setSetupGuidance(event.target.value)}
-                placeholder={ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_PLACEHOLDER}
-                maxLength={ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_MAX_LENGTH}
-                disabled={isBusy}
-                className="h-20 min-h-20 resize-none"
-              />
-              <p
-                className={cn(
-                  'text-muted-foreground self-stretch text-right text-xs',
-                  setupGuidanceLength > SETUP_GUIDANCE_WARNING_THRESHOLD &&
-                    'text-warning-foreground',
-                )}
-              >
-                {setupGuidanceLength >
-                  ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_MAX_LENGTH * 0.8 &&
-                  charCounter}
-              </p>
-              <SetupFooter
-                onBack={onBack}
-                backDisabled={isBusy}
-                className="w-full flex-wrap"
-              >
-                <ModelSelect
-                  value={effectiveSelectedModelId}
-                  onValueChange={setSelectedModelId}
+              {filteredRepositories.length === 0 ? (
+                <div className="rounded-md border border-dashed px-4 py-6 text-sm text-muted-foreground">
+                  No repositories match that filter.
+                </div>
+              ) : null}
+            </div>
+            {allSelectedRepositoriesAreEmpty ? (
+              <Alert>
+                <Info className="size-4" />
+                <AlertDescription className="flex-col items-start gap-1">
+                  <p>
+                    {emptyRepositoryWarningCopy} {PRODUCT_NAME} will push an
+                    initial commit and set up a basic environment — then you can
+                    start building with your first task.
+                  </p>
+                  <p className="font-medium text-foreground">
+                    {selectedEmptyRepositoryNames}
+                  </p>
+                  <Button
+                    type="button"
+                    size="sm"
+                    variant="outline"
+                    onClick={() => void refreshRepositories()}
+                    disabled={
+                      connectGitHub.isPending || isRefreshingRepositories
+                    }
+                  >
+                    {isRefreshingRepositories ? (
+                      <Loader2 className="animate-spin" />
+                    ) : (
+                      <RotateCw />
+                    )}
+                    Refresh list
+                  </Button>
+                </AlertDescription>
+              </Alert>
+            ) : null}
+            {showForm ? (
+              <div className="space-y-2 flex flex-col items-start">
+                <Textarea
+                  value={setupGuidance}
+                  onChange={(event) => setSetupGuidance(event.target.value)}
+                  placeholder={
+                    ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_PLACEHOLDER
+                  }
+                  maxLength={ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_MAX_LENGTH}
                   disabled={isBusy}
+                  className="h-20 min-h-20 resize-none"
                 />
-                <Button
-                  type="button"
-                  size="sm"
-                  onClick={() => void handleContinue()}
-                  disabled={isBusy || allSelectedRepositoriesAreEmpty}
+                <p
+                  className={cn(
+                    'text-muted-foreground self-stretch text-right text-xs',
+                    setupGuidanceLength > SETUP_GUIDANCE_WARNING_THRESHOLD &&
+                      'text-warning-foreground',
+                  )}
                 >
-                  {isBusy && <Loader2 className="animate-spin" />}
-                  Continue
-                  <ArrowRight />
-                </Button>
-                <p className="text-sm text-muted-foreground ml-auto">
-                  Or, if you must,
+                  {setupGuidanceLength >
+                    ENVIRONMENT_DEFINITION_SETUP_GUIDANCE_MAX_LENGTH * 0.8 &&
+                    charCounter}
                 </p>
-                <Button
-                  type="button"
-                  variant="link"
-                  size="sm"
-                  className="p-0! -ml-1"
-                  onClick={onSkip}
+                <SetupFooter
+                  onBack={onBack}
+                  backDisabled={isBusy}
+                  className="w-full flex-wrap"
                 >
-                  do this later
-                </Button>
-              </SetupFooter>
-            </div>
-          ) : null}
-        </CardContent>
-      </Card>
-      {!showForm ? (
-        <SetupFooter onBack={onBack} className="flex-wrap">
-          <Button
-            type="button"
-            size="sm"
-            variant="outline"
-            onClick={() => void refreshRepositories()}
-            disabled={connectGitHub.isPending || isRefreshingRepositories}
-          >
-            {isRefreshingRepositories ? (
-              <Loader2 className="animate-spin" />
-            ) : (
-              <RotateCw />
-            )}
-            Refresh list
-          </Button>
-          <Button
-            type="button"
-            variant="outline"
-            size="sm"
-            onClick={handleManageGitHubAccess}
-            disabled={connectGitHub.isPending}
-          >
-            {connectGitHub.isPending ? (
-              <Loader2 className="animate-spin" />
-            ) : (
-              <Github />
-            )}
-            Edit GitHub Access
-          </Button>
-          <Button type="button" variant="outline" size="sm" onClick={onSkip}>
-            Skip
-          </Button>
-          <p className="self-center text-sm text-muted-foreground">
-            Not recommended
-          </p>
-        </SetupFooter>
-      ) : null}
-    </div>
+                  <ModelSelect
+                    value={effectiveSelectedModelId}
+                    onValueChange={setSelectedModelId}
+                    disabled={isBusy}
+                  />
+                  <Button
+                    type="button"
+                    size="sm"
+                    onClick={() => void handleContinue()}
+                    disabled={isBusy}
+                  >
+                    {isBusy && <Loader2 className="animate-spin" />}
+                    Continue
+                    <ArrowRight />
+                  </Button>
+                  <p className="text-sm text-muted-foreground ml-auto">
+                    Or, if you must,
+                  </p>
+                  <Button
+                    type="button"
+                    variant="link"
+                    size="sm"
+                    className="p-0! -ml-1"
+                    onClick={onSkip}
+                  >
+                    do this later
+                  </Button>
+                </SetupFooter>
+              </div>
+            ) : null}
+          </CardContent>
+        </Card>
+        {!showForm ? (
+          <SetupFooter onBack={onBack} className="flex-wrap">
+            <Button
+              type="button"
+              size="sm"
+              variant="outline"
+              onClick={() => void refreshRepositories()}
+              disabled={connectGitHub.isPending || isRefreshingRepositories}
+            >
+              {isRefreshingRepositories ? (
+                <Loader2 className="animate-spin" />
+              ) : (
+                <RotateCw />
+              )}
+              Refresh list
+            </Button>
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              onClick={handleManageGitHubAccess}
+              disabled={connectGitHub.isPending}
+            >
+              {connectGitHub.isPending ? (
+                <Loader2 className="animate-spin" />
+              ) : (
+                <Github />
+              )}
+              Edit GitHub Access
+            </Button>
+            <Button type="button" variant="outline" size="sm" onClick={onSkip}>
+              Skip
+            </Button>
+            <p className="self-center text-sm text-muted-foreground">
+              Not recommended
+            </p>
+          </SetupFooter>
+        ) : null}
+      </div>
+      <CreateGitHubRepoDialog
+        open={createRepoDialogOpen}
+        onOpenChange={setCreateRepoDialogOpen}
+        onRepositoryDetected={selectDetectedRepository}
+      />
+    </>
   );
 }
diff --git a/apps/web/src/app/(sandbox)/SandboxShell.tsx b/apps/web/src/app/(sandbox)/SandboxShell.tsx
index 5254ad683..d32e6d025 100644
--- a/apps/web/src/app/(sandbox)/SandboxShell.tsx
+++ b/apps/web/src/app/(sandbox)/SandboxShell.tsx
@@ -76,7 +76,7 @@ export function SandboxShell({
     <div className="h-viewport flex flex-col overflow-hidden">
       {/* Mobile-only top bar */}
       <div
-        className={`md:hidden top-0 ${zIndex('NAV_HEADER')} bg-background w-full shrink-0 outline outline-b outline-border`}
+        className={`md:hidden top-0 ${zIndex('NAV_HEADER')} w-full shrink-0 bg-card`}
       >
         {isSignedIn ? (
           <NavbarHeader />
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpTextMessage.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpTextMessage.tsx
index 6c83cbf43..5caebd639 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpTextMessage.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpTextMessage.tsx
@@ -315,12 +315,12 @@ export function AcpTextMessage({ msg }: AcpTextMessageProps) {
                     ) : null}
                     {requestUserInputResponse.questionTexts.map(
                       (questionText, index) => (
-                        <span
+                        <p
                           key={index}
-                          className="mt-1 block italic text-muted-foreground"
+                          className="mt-1 border-l-2 pl-2 text-muted-foreground"
                         >
                           {questionText}
-                        </span>
+                        </p>
                       ),
                     )}
                     <span className="mt-2 block">{baseContent}</span>
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpTextMessage.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpTextMessage.client.test.tsx
index 42aad8f6a..0983429ec 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpTextMessage.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpTextMessage.client.test.tsx
@@ -630,7 +630,13 @@ describe('AcpTextMessage', () => {
     expect(plainText).toHaveTextContent('Pick one option for the third test.');
     expect(plainText).toHaveTextContent('Gamma');
     expect(plainText).not.toHaveTextContent('Responded to requested input');
-    expect(plainText.querySelectorAll('span')).toHaveLength(2);
+    expect(plainText.querySelectorAll('p')).toHaveLength(1);
+    expect(plainText.querySelector('p')).toHaveClass(
+      'mt-1',
+      'border-l-2',
+      'pl-2',
+      'text-muted-foreground',
+    );
     expect(
       screen.getByRole('button', {
         name: /copy:/,
diff --git a/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts b/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
index 56b006a4a..abf30c14c 100644
--- a/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
+++ b/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
@@ -8,6 +8,7 @@ const {
   exchangeCodeForTokensMock,
   getClientInformationMock,
   getMcpIntegrationMock,
+  getMcpIntegrationOauthEndpointsMock,
   hydrateLinearMcpConnectionAfterOauthMock,
   isDeploymentScopedMcpIntegrationMock,
   isSelfServeMcpIntegrationMock,
@@ -24,6 +25,7 @@ const {
   exchangeCodeForTokensMock: vi.fn(),
   getClientInformationMock: vi.fn(),
   getMcpIntegrationMock: vi.fn(),
+  getMcpIntegrationOauthEndpointsMock: vi.fn(),
   hydrateLinearMcpConnectionAfterOauthMock: vi.fn(),
   isDeploymentScopedMcpIntegrationMock: vi.fn(),
   isSelfServeMcpIntegrationMock: vi.fn(),
@@ -45,6 +47,7 @@ vi.mock('@/lib/server/bootstrap-runtime-env', () => ({
 vi.mock('@/lib/server/mcp-linear', () => ({
   hydrateLinearMcpConnectionAfterOauth:
     hydrateLinearMcpConnectionAfterOauthMock,
+  LinearReplayIdentityMismatchError: class extends Error {},
 }));
 
 vi.mock('@/lib/server/logger', () => ({
@@ -83,10 +86,13 @@ vi.mock('@roomote/sdk/server', () => ({
 
 vi.mock('@roomote/types', () => ({
   getMcpIntegration: getMcpIntegrationMock,
+  getMcpIntegrationOauthEndpoints: getMcpIntegrationOauthEndpointsMock,
   isDeploymentScopedMcpIntegration: isDeploymentScopedMcpIntegrationMock,
   isSelfServeMcpIntegration: isSelfServeMcpIntegrationMock,
 }));
 
+import { LinearReplayIdentityMismatchError } from '@/lib/server/mcp-linear';
+
 import { GET } from '../route';
 
 const CONNECTION_ID = 'conn-linear-1';
@@ -127,6 +133,10 @@ describe('GET /api/mcp-oauth/callback', () => {
       name: 'Linear',
       url: 'https://mcp.linear.app/mcp',
     });
+    getMcpIntegrationOauthEndpointsMock.mockReturnValue({
+      authorizationEndpoint: 'https://linear.app/oauth/authorize',
+      tokenEndpoint: 'https://api.linear.app/oauth/token',
+    });
     isSelfServeMcpIntegrationMock.mockReturnValue(true);
     isDeploymentScopedMcpIntegrationMock.mockReturnValue(false);
     getClientInformationMock.mockResolvedValue({
@@ -152,12 +162,13 @@ describe('GET /api/mcp-oauth/callback', () => {
       'https://customer.example/settings?mcp=connected',
     );
     expect(exchangeCodeForTokensMock).toHaveBeenCalledWith(
-      'https://mcp.linear.app/token',
+      'https://api.linear.app/oauth/token',
       'auth-code',
       'verifier-1',
       { client_id: 'client-1' },
       PUBLIC_CALLBACK,
     );
+    expect(discoverOAuthEndpointsMock).not.toHaveBeenCalled();
   });
 
   it('falls back to R_APP_URL for token exchange redirect_uri when R_PUBLIC_URL is unset', async () => {
@@ -172,7 +183,7 @@ describe('GET /api/mcp-oauth/callback', () => {
       'http://localhost:13000/settings?mcp=connected',
     );
     expect(exchangeCodeForTokensMock).toHaveBeenCalledWith(
-      'https://mcp.linear.app/token',
+      'https://api.linear.app/oauth/token',
       'auth-code',
       'verifier-1',
       { client_id: 'client-1' },
@@ -223,16 +234,22 @@ describe('GET /api/mcp-oauth/callback', () => {
     expect(resumedResponse.headers.get('set-cookie')).toContain('Max-Age=0');
     expect(consumeOAuthStateMock).toHaveBeenCalledTimes(1);
     expect(exchangeCodeForTokensMock).toHaveBeenCalledWith(
-      'https://mcp.linear.app/token',
+      'https://api.linear.app/oauth/token',
       'auth-code',
       'verifier-1',
       { client_id: 'client-1' },
       PUBLIC_CALLBACK,
     );
-    expect(storeTokensMock).toHaveBeenCalledWith(CONNECTION_ID, {
-      access_token: 'access-token',
-      refresh_token: 'refresh-token',
+    expect(hydrateLinearMcpConnectionAfterOauthMock).toHaveBeenCalledWith({
+      connection: expect.objectContaining({ id: CONNECTION_ID }),
+      tokens: {
+        access_token: 'access-token',
+        refresh_token: 'refresh-token',
+      },
+      replayToken: null,
+      enabledByUserId: 'user-1',
     });
+    expect(storeTokensMock).not.toHaveBeenCalled();
   });
 
   it('redirects oauth errors to the public settings host', async () => {
@@ -285,17 +302,14 @@ describe('GET /api/mcp-oauth/callback', () => {
     );
   });
 
-  it('distinguishes Linear workspace metadata failures after token storage', async () => {
+  it('does not store Linear tokens when identity metadata validation fails', async () => {
     hydrateLinearMcpConnectionAfterOauthMock.mockRejectedValueOnce(
       new Error('viewer lookup failed'),
     );
 
     const response = await GET(buildRequest('?code=auth-code&state=state-1'));
 
-    expect(storeTokensMock).toHaveBeenCalledWith(CONNECTION_ID, {
-      access_token: 'access-token',
-      refresh_token: 'refresh-token',
-    });
+    expect(storeTokensMock).not.toHaveBeenCalled();
     expect(response.headers.get('location')).toBe(
       'https://customer.example/settings?mcp=error&reason=linear_metadata_failed',
     );
@@ -310,4 +324,18 @@ describe('GET /api/mcp-oauth/callback', () => {
       'MCP OAuth callback failed',
     );
   });
+
+  it('preserves the existing connection status on replay identity mismatch', async () => {
+    hydrateLinearMcpConnectionAfterOauthMock.mockRejectedValueOnce(
+      new LinearReplayIdentityMismatchError(),
+    );
+
+    const response = await GET(buildRequest('?code=auth-code&state=state-1'));
+
+    expect(response.headers.get('location')).toBe(
+      'https://customer.example/settings?mcp=error&reason=linear_metadata_failed',
+    );
+    expect(storeTokensMock).not.toHaveBeenCalled();
+    expect(updateAuthStatusMock).not.toHaveBeenCalled();
+  });
 });
diff --git a/apps/web/src/app/api/mcp-oauth/callback/route.ts b/apps/web/src/app/api/mcp-oauth/callback/route.ts
index 6ad071fe1..c8e42bb25 100644
--- a/apps/web/src/app/api/mcp-oauth/callback/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/callback/route.ts
@@ -9,6 +9,7 @@ import {
 } from '@roomote/db/server';
 import {
   getMcpIntegration,
+  getMcpIntegrationOauthEndpoints,
   isDeploymentScopedMcpIntegration,
   isSelfServeMcpIntegration,
 } from '@roomote/types';
@@ -24,7 +25,10 @@ import { authorize } from '@/lib/server';
 import { bootstrapWebRuntimeEnv } from '@/lib/server/bootstrap-runtime-env';
 import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
 import { logger } from '@/lib/server/logger';
-import { hydrateLinearMcpConnectionAfterOauth } from '@/lib/server/mcp-linear';
+import {
+  hydrateLinearMcpConnectionAfterOauth,
+  LinearReplayIdentityMismatchError,
+} from '@/lib/server/mcp-linear';
 import type {
   McpOAuthErrorReason,
   McpOAuthResult,
@@ -302,29 +306,31 @@ export async function GET(request: NextRequest) {
     }
 
     failureStage = 'provider_discovery';
-    const serverMetadata = await discoverOAuthEndpoints(integration.url);
+    const tokenEndpoint =
+      getMcpIntegrationOauthEndpoints(integration)?.tokenEndpoint ??
+      (await discoverOAuthEndpoints(integration.url)).token_endpoint;
     const redirectUri = new URL(CALLBACK_PATH, webUrl).toString();
 
     failureStage = 'token_exchange';
     const tokens = await exchangeCodeForTokens(
-      serverMetadata.token_endpoint,
+      tokenEndpoint,
       code,
       oauthState.codeVerifier,
       clientInfo,
       redirectUri,
     );
 
-    failureStage = 'token_storage';
-    await storeTokens(resolvedConnectionId, tokens);
-
     if (integration.id === 'linear') {
       failureStage = 'linear_metadata';
       await hydrateLinearMcpConnectionAfterOauth({
         connection,
-        accessToken: tokens.access_token,
+        tokens,
         replayToken: oauthState.replayToken,
         enabledByUserId: userId,
       });
+    } else {
+      failureStage = 'token_storage';
+      await storeTokens(resolvedConnectionId, tokens);
     }
 
     if (requiresOrgAdmin) {
@@ -362,7 +368,7 @@ export async function GET(request: NextRequest) {
       'MCP OAuth callback failed',
     );
 
-    if (connectionId) {
+    if (connectionId && !(error instanceof LinearReplayIdentityMismatchError)) {
       try {
         await updateAuthStatus(connectionId, 'error');
       } catch (statusError) {
diff --git a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
index 25f353856..ffb4d0c8d 100644
--- a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
+++ b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
@@ -9,14 +9,16 @@ const {
   getClientInformationMock,
   getMcpIntegrationAuthorizationParametersMock,
   getMcpIntegrationMock,
+  getMcpIntegrationOauthEndpointsMock,
   getMcpIntegrationOauthScopeModeMock,
+  getMcpIntegrationOauthScopeSeparatorMock,
   getMcpIntegrationOauthScopesMock,
   getPreferredTokenEndpointAuthMethodMock,
   isDeploymentScopedMcpIntegrationMock,
   isSelfServeMcpIntegrationMock,
   mcpConnectionsFindFirstMock,
   registerOAuthClientMock,
-  resolveStaticOauthClientInformationMock,
+  resolveDeploymentStaticOauthClientInformationMock,
   storeClientInformationMock,
   storeOAuthStateWithIdMock,
 } = vi.hoisted(() => ({
@@ -30,14 +32,16 @@ const {
   getClientInformationMock: vi.fn(),
   getMcpIntegrationAuthorizationParametersMock: vi.fn(),
   getMcpIntegrationMock: vi.fn(),
+  getMcpIntegrationOauthEndpointsMock: vi.fn(),
   getMcpIntegrationOauthScopeModeMock: vi.fn(),
+  getMcpIntegrationOauthScopeSeparatorMock: vi.fn(),
   getMcpIntegrationOauthScopesMock: vi.fn(),
   getPreferredTokenEndpointAuthMethodMock: vi.fn(),
   isDeploymentScopedMcpIntegrationMock: vi.fn(),
   isSelfServeMcpIntegrationMock: vi.fn(),
   mcpConnectionsFindFirstMock: vi.fn(),
   registerOAuthClientMock: vi.fn(),
-  resolveStaticOauthClientInformationMock: vi.fn(),
+  resolveDeploymentStaticOauthClientInformationMock: vi.fn(),
   storeClientInformationMock: vi.fn(),
   storeOAuthStateWithIdMock: vi.fn(),
 }));
@@ -50,8 +54,9 @@ vi.mock('@/lib/server/bootstrap-runtime-env', () => ({
   bootstrapWebRuntimeEnv: bootstrapWebRuntimeEnvMock,
 }));
 
-vi.mock('@/lib/server/mcp-static-oauth', () => ({
-  resolveStaticOauthClientInformation: resolveStaticOauthClientInformationMock,
+vi.mock('@/lib/server/deployment-static-oauth', () => ({
+  resolveDeploymentStaticOauthClientInformation:
+    resolveDeploymentStaticOauthClientInformationMock,
 }));
 
 vi.mock('@roomote/db/server', () => ({
@@ -83,7 +88,10 @@ vi.mock('@roomote/sdk/server', () => ({
 vi.mock('@roomote/types', () => ({
   getMcpIntegrationAuthorizationParameters:
     getMcpIntegrationAuthorizationParametersMock,
+  getMcpIntegrationOauthEndpoints: getMcpIntegrationOauthEndpointsMock,
   getMcpIntegrationOauthScopeMode: getMcpIntegrationOauthScopeModeMock,
+  getMcpIntegrationOauthScopeSeparator:
+    getMcpIntegrationOauthScopeSeparatorMock,
   getMcpIntegrationOauthScopes: getMcpIntegrationOauthScopesMock,
   getMcpIntegration: getMcpIntegrationMock,
   isDeploymentScopedMcpIntegration: isDeploymentScopedMcpIntegrationMock,
@@ -139,12 +147,16 @@ describe('GET /api/mcp-oauth/initiate/[connectionId]', () => {
     getPreferredTokenEndpointAuthMethodMock.mockReturnValue('none');
     getMcpIntegrationOauthScopesMock.mockReturnValue(undefined);
     getMcpIntegrationOauthScopeModeMock.mockReturnValue(undefined);
+    getMcpIntegrationOauthEndpointsMock.mockReturnValue(undefined);
+    getMcpIntegrationOauthScopeSeparatorMock.mockReturnValue(' ');
     getMcpIntegrationAuthorizationParametersMock.mockReturnValue([]);
     generateCodeVerifierMock.mockReturnValue('verifier-value');
     generateCodeChallengeMock.mockResolvedValue('challenge-value');
     generateStateMock.mockReturnValue('state-value');
     storeOAuthStateWithIdMock.mockResolvedValue(undefined);
-    resolveStaticOauthClientInformationMock.mockReturnValue(undefined);
+    resolveDeploymentStaticOauthClientInformationMock.mockResolvedValue(
+      undefined,
+    );
     registerOAuthClientMock.mockResolvedValue({
       client_id: 'fresh-client',
     });
@@ -169,6 +181,104 @@ describe('GET /api/mcp-oauth/initiate/[connectionId]', () => {
     });
   });
 
+  it('uses the Linear API OAuth flow instead of Linear MCP OAuth', async () => {
+    getMcpIntegrationOauthEndpointsMock.mockReturnValue({
+      authorizationEndpoint: 'https://linear.app/oauth/authorize',
+      tokenEndpoint: 'https://api.linear.app/oauth/token',
+    });
+    getMcpIntegrationOauthScopesMock.mockReturnValue([
+      'read',
+      'write',
+      'app:assignable',
+      'app:mentionable',
+    ]);
+    getMcpIntegrationOauthScopeSeparatorMock.mockReturnValue(',');
+    getMcpIntegrationAuthorizationParametersMock.mockReturnValue([
+      { name: 'actor', value: 'app' },
+    ]);
+    getClientInformationMock.mockResolvedValue({
+      client_id: 'linear-client',
+      client_secret: 'linear-secret',
+      token_endpoint_auth_method: 'client_secret_post',
+    });
+
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ connectionId: CONNECTION_ID }),
+    });
+
+    const authUrl = new URL(response.headers.get('location')!);
+    expect(authUrl.origin).toBe('https://linear.app');
+    expect(authUrl.pathname).toBe('/oauth/authorize');
+    expect(authUrl.searchParams.get('scope')).toBe(
+      'read,write,app:assignable,app:mentionable',
+    );
+    expect(authUrl.searchParams.get('actor')).toBe('app');
+    expect(authUrl.searchParams.get('redirect_uri')).toBe(PUBLIC_CALLBACK);
+    expect(discoverOAuthEndpointsMock).not.toHaveBeenCalled();
+    expect(discoverOAuthProtectedResourceMetadataMock).not.toHaveBeenCalled();
+    expect(registerOAuthClientMock).not.toHaveBeenCalled();
+  });
+
+  it('stores the configured Linear OAuth client for the callback', async () => {
+    getMcpIntegrationOauthEndpointsMock.mockReturnValue({
+      authorizationEndpoint: 'https://linear.app/oauth/authorize',
+      tokenEndpoint: 'https://api.linear.app/oauth/token',
+    });
+    getMcpIntegrationOauthScopesMock.mockReturnValue(['read', 'write']);
+    getMcpIntegrationOauthScopeSeparatorMock.mockReturnValue(',');
+    getClientInformationMock.mockResolvedValue(undefined);
+    resolveDeploymentStaticOauthClientInformationMock.mockResolvedValue({
+      client_id: 'linear-client',
+      client_secret: 'linear-secret',
+      token_endpoint_auth_method: 'client_secret_post',
+    });
+
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ connectionId: CONNECTION_ID }),
+    });
+
+    expect(response.status).toBe(307);
+    expect(storeClientInformationMock).toHaveBeenCalledWith(
+      CONNECTION_ID,
+      {
+        client_id: 'linear-client',
+        client_secret: 'linear-secret',
+        token_endpoint_auth_method: 'client_secret_post',
+      },
+      PUBLIC_CALLBACK,
+    );
+    expect(registerOAuthClientMock).not.toHaveBeenCalled();
+  });
+
+  it('replaces a legacy registered client with configured deployment credentials', async () => {
+    getMcpIntegrationOauthEndpointsMock.mockReturnValue({
+      authorizationEndpoint: 'https://linear.app/oauth/authorize',
+      tokenEndpoint: 'https://api.linear.app/oauth/token',
+    });
+    getClientInformationMock.mockResolvedValue({
+      client_id: 'legacy-dynamic-client',
+      client_secret: 'legacy-secret',
+    });
+    resolveDeploymentStaticOauthClientInformationMock.mockResolvedValue({
+      client_id: 'configured-client',
+      client_secret: 'configured-secret',
+      token_endpoint_auth_method: 'client_secret_post',
+    });
+
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ connectionId: CONNECTION_ID }),
+    });
+
+    expect(getClientInformationMock).not.toHaveBeenCalled();
+    expect(storeClientInformationMock).toHaveBeenCalledWith(
+      CONNECTION_ID,
+      expect.objectContaining({ client_id: 'configured-client' }),
+      PUBLIC_CALLBACK,
+    );
+    const authUrl = new URL(response.headers.get('location')!);
+    expect(authUrl.searchParams.get('client_id')).toBe('configured-client');
+  });
+
   it('re-registers when stored client was registered against a different callback', async () => {
     getClientInformationMock.mockResolvedValue(undefined);
 
diff --git a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
index 5cf522d50..126234dd9 100644
--- a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
@@ -16,11 +16,14 @@ import {
 import type {
   OAuthClientMetadata,
   OAuthClientInformation,
+  OAuthServerMetadata,
 } from '@roomote/types';
 import {
   type McpConnectionRole,
   getMcpIntegrationAuthorizationParameters,
+  getMcpIntegrationOauthEndpoints,
   getMcpIntegrationOauthScopeMode,
+  getMcpIntegrationOauthScopeSeparator,
   getMcpIntegrationOauthScopes,
   getMcpIntegration,
   type McpIntegration,
@@ -31,7 +34,7 @@ import {
 import { authorize } from '@/lib/server';
 import { bootstrapWebRuntimeEnv } from '@/lib/server/bootstrap-runtime-env';
 import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
-import { resolveStaticOauthClientInformation } from '@/lib/server/mcp-static-oauth';
+import { resolveDeploymentStaticOauthClientInformation } from '@/lib/server/deployment-static-oauth';
 
 export const runtime = 'nodejs';
 
@@ -99,7 +102,9 @@ function getRequestedScope(
     connectionRole,
   );
   if (explicitScopes?.length) {
-    return explicitScopes.join(' ');
+    return explicitScopes.join(
+      getMcpIntegrationOauthScopeSeparator(integration),
+    );
   }
 
   if (!scopeList?.length) {
@@ -115,14 +120,31 @@ function getRequestedScope(
     new Set(requestedScopes.map((scope) => scope.trim()).filter(Boolean)),
   );
 
-  return uniqueScopes.length > 0 ? uniqueScopes.join(' ') : undefined;
+  return uniqueScopes.length > 0
+    ? uniqueScopes.join(getMcpIntegrationOauthScopeSeparator(integration))
+    : undefined;
 }
 
-function getStaticClientInformation(
-  env: unknown,
+function getOAuthServerMetadataOverride(
   integration: McpIntegration,
-): OAuthClientInformation | undefined {
-  return resolveStaticOauthClientInformation(env, integration);
+): OAuthServerMetadata | undefined {
+  const endpoints = getMcpIntegrationOauthEndpoints(integration);
+  if (!endpoints) {
+    return undefined;
+  }
+
+  return {
+    issuer: new URL(endpoints.authorizationEndpoint).origin,
+    authorization_endpoint: endpoints.authorizationEndpoint,
+    token_endpoint: endpoints.tokenEndpoint,
+    scopes_supported: getMcpIntegrationOauthScopes(integration),
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    token_endpoint_auth_methods_supported: [
+      'client_secret_post',
+      'client_secret_basic',
+    ],
+  };
 }
 
 export async function GET(
@@ -185,10 +207,13 @@ export async function GET(
       );
     }
 
-    const [serverMetadata, protectedResourceMetadata] = await Promise.all([
-      discoverOAuthEndpoints(integration.url),
-      discoverOAuthProtectedResourceMetadata(integration.url),
-    ]);
+    const serverMetadataOverride = getOAuthServerMetadataOverride(integration);
+    const [serverMetadata, protectedResourceMetadata] = serverMetadataOverride
+      ? [serverMetadataOverride, undefined]
+      : await Promise.all([
+          discoverOAuthEndpoints(integration.url),
+          discoverOAuthProtectedResourceMetadata(integration.url),
+        ]);
     const redirectUri = new URL('/api/mcp-oauth/callback', webUrl).toString();
     const requestedScope = getRequestedScope(
       protectedResourceMetadata?.scopes_supported ??
@@ -197,22 +222,20 @@ export async function GET(
       connection.connectionRole,
     );
 
-    let clientInfo: OAuthClientInformation | undefined =
-      await getClientInformation(connectionId, {
+    const staticClientInfo =
+      await resolveDeploymentStaticOauthClientInformation(webEnv, integration);
+    let clientInfo: OAuthClientInformation | undefined;
+
+    if (staticClientInfo) {
+      // Configured deployment credentials are authoritative. Replacing the
+      // stored client also migrates connections created by the old dynamic
+      // registration flow before their next authorization or token refresh.
+      await storeClientInformation(connectionId, staticClientInfo, redirectUri);
+      clientInfo = staticClientInfo;
+    } else {
+      clientInfo = await getClientInformation(connectionId, {
         expectedRedirectUri: redirectUri,
       });
-
-    if (!clientInfo) {
-      const staticClientInfo = getStaticClientInformation(webEnv, integration);
-
-      if (staticClientInfo) {
-        await storeClientInformation(
-          connectionId,
-          staticClientInfo,
-          redirectUri,
-        );
-        clientInfo = staticClientInfo;
-      }
     }
 
     if (!clientInfo && serverMetadata.registration_endpoint) {
diff --git a/apps/web/src/app/api/mcp-oauth/replay/[token]/__tests__/route.test.ts b/apps/web/src/app/api/mcp-oauth/replay/[token]/__tests__/route.test.ts
new file mode 100644
index 000000000..12541c098
--- /dev/null
+++ b/apps/web/src/app/api/mcp-oauth/replay/[token]/__tests__/route.test.ts
@@ -0,0 +1,110 @@
+import { NextRequest } from 'next/server';
+
+const {
+  authorizeMock,
+  bootstrapWebRuntimeEnvMock,
+  getDefaultMcpConnectionRoleMock,
+  getMcpIntegrationConnectionScopeMock,
+  getMcpIntegrationMock,
+  getMcpOauthReplayMock,
+  insertReturningMock,
+  onConflictDoUpdateMock,
+  updateMcpOauthReplayMock,
+} = vi.hoisted(() => ({
+  authorizeMock: vi.fn(),
+  bootstrapWebRuntimeEnvMock: vi.fn(),
+  getDefaultMcpConnectionRoleMock: vi.fn(),
+  getMcpIntegrationConnectionScopeMock: vi.fn(),
+  getMcpIntegrationMock: vi.fn(),
+  getMcpOauthReplayMock: vi.fn(),
+  insertReturningMock: vi.fn(),
+  onConflictDoUpdateMock: vi.fn(),
+  updateMcpOauthReplayMock: vi.fn(),
+}));
+
+vi.mock('@/lib/server', () => ({ authorize: authorizeMock }));
+vi.mock('@/lib/server/bootstrap-runtime-env', () => ({
+  bootstrapWebRuntimeEnv: bootstrapWebRuntimeEnvMock,
+}));
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    insert: vi.fn(() => ({
+      values: vi.fn(() => ({
+        onConflictDoUpdate: onConflictDoUpdateMock.mockReturnValue({
+          returning: insertReturningMock,
+        }),
+      })),
+    })),
+  },
+  mcpConnections: {
+    connectionRole: 'connectionRole',
+    mcpId: 'mcpId',
+    userId: 'userId',
+  },
+}));
+vi.mock('@roomote/sdk/server', () => ({
+  getMcpOauthReplay: getMcpOauthReplayMock,
+  updateMcpOauthReplay: updateMcpOauthReplayMock,
+}));
+vi.mock('@roomote/types', () => ({
+  getDefaultMcpConnectionRole: getDefaultMcpConnectionRoleMock,
+  getMcpIntegration: getMcpIntegrationMock,
+  getMcpIntegrationConnectionScope: getMcpIntegrationConnectionScopeMock,
+}));
+
+import { GET } from '../route';
+
+const TOKEN = 'replay-token';
+
+function buildRequest() {
+  return new NextRequest(`http://localhost:3000/api/mcp-oauth/replay/${TOKEN}`);
+}
+
+describe('GET /api/mcp-oauth/replay/[token]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    bootstrapWebRuntimeEnvMock.mockResolvedValue({
+      R_APP_URL: 'http://localhost:3000',
+      R_PUBLIC_URL: 'https://roomote.example',
+    });
+    authorizeMock.mockResolvedValue({
+      success: true,
+      userId: 'user-1',
+    });
+    getMcpOauthReplayMock.mockResolvedValue({
+      mcpId: 'linear',
+      connectionRole: 'default',
+      redirectTo: '/settings/personal',
+    });
+    getMcpIntegrationMock.mockReturnValue({ id: 'linear' });
+    getDefaultMcpConnectionRoleMock.mockReturnValue('default');
+    getMcpIntegrationConnectionScopeMock.mockReturnValue('user');
+    insertReturningMock.mockResolvedValue([{ id: 'connection-1' }]);
+  });
+
+  it('keeps the authenticated continuation on the public app origin', async () => {
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ token: TOKEN }),
+    });
+
+    expect(response.headers.get('location')).toBe(
+      'https://roomote.example/api/mcp-oauth/initiate/connection-1?redirectTo=%2Fsettings%2Fpersonal&replayToken=replay-token',
+    );
+    expect(onConflictDoUpdateMock).toHaveBeenCalledWith({
+      target: ['userId', 'mcpId', 'connectionRole'],
+      set: { updatedAt: expect.any(Date) },
+    });
+  });
+
+  it('sends signed-out users to sign in on the public app origin', async () => {
+    authorizeMock.mockResolvedValue({ success: false });
+
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ token: TOKEN }),
+    });
+
+    expect(response.headers.get('location')).toBe(
+      'https://roomote.example/sign-in?redirect_url=%2Fapi%2Fmcp-oauth%2Freplay%2Freplay-token',
+    );
+  });
+});
diff --git a/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts b/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
index 0d4df6ea0..b47041d2c 100644
--- a/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
@@ -9,6 +9,8 @@ import {
 import { getMcpOauthReplay, updateMcpOauthReplay } from '@roomote/sdk/server';
 
 import { authorize } from '@/lib/server';
+import { bootstrapWebRuntimeEnv } from '@/lib/server/bootstrap-runtime-env';
+import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
 
 export const runtime = 'nodejs';
 
@@ -19,21 +21,23 @@ function buildReplayReturnPath(token: string) {
 }
 
 export async function GET(
-  request: NextRequest,
+  _request: NextRequest,
   { params }: { params: Promise<{ token: string }> },
 ) {
+  const webEnv = await bootstrapWebRuntimeEnv();
+  const webUrl = getPublicAppUrl(webEnv);
   const { token } = await params;
   const replay = await getMcpOauthReplay(token);
 
   if (!replay) {
     return NextResponse.redirect(
-      new URL('/error?message=Invalid or expired auth token', request.url),
+      new URL('/error?message=Invalid or expired auth token', webUrl),
     );
   }
 
   const authResult = await authorize();
   if (!authResult.success) {
-    const signInUrl = new URL('/sign-in', request.url);
+    const signInUrl = new URL('/sign-in', webUrl);
     signInUrl.searchParams.set('redirect_url', buildReplayReturnPath(token));
     return NextResponse.redirect(signInUrl);
   }
@@ -41,7 +45,7 @@ export async function GET(
   const integration = getMcpIntegration(replay.mcpId);
   if (!integration) {
     return NextResponse.redirect(
-      new URL('/error?message=Unknown MCP integration', request.url),
+      new URL('/error?message=Unknown MCP integration', webUrl),
     );
   }
 
@@ -72,10 +76,6 @@ export async function GET(
         mcpConnections.connectionRole,
       ],
       set: {
-        userId: targetUserId,
-        authConfig: null,
-        enabled: false,
-        authStatus: 'pending',
         updatedAt: new Date(),
       },
     })
@@ -83,10 +83,7 @@ export async function GET(
 
   if (!connection) {
     return NextResponse.redirect(
-      new URL(
-        '/error?message=Failed to prepare linked account flow',
-        request.url,
-      ),
+      new URL('/error?message=Failed to prepare linked account flow', webUrl),
     );
   }
 
@@ -105,7 +102,7 @@ export async function GET(
       `/api/mcp-oauth/initiate/${connection.id}?redirectTo=${encodeURIComponent(
         redirectTo,
       )}&replayToken=${encodeURIComponent(token)}`,
-      request.url,
+      webUrl,
     ),
   );
 }
diff --git a/apps/web/src/components/github/CreateGitHubRepoDialog.client.test.tsx b/apps/web/src/components/github/CreateGitHubRepoDialog.client.test.tsx
new file mode 100644
index 000000000..e70f6d2be
--- /dev/null
+++ b/apps/web/src/components/github/CreateGitHubRepoDialog.client.test.tsx
@@ -0,0 +1,318 @@
+import type {
+  ButtonHTMLAttributes,
+  InputHTMLAttributes,
+  ReactNode,
+  SVGProps,
+} from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+
+type RepositoryRow = {
+  id: string;
+  fullName: string;
+  sourceControlProvider: string;
+  isEmpty?: boolean;
+};
+
+const {
+  mockEnableGitHubApp,
+  mockSyncGitHubInstallations,
+  mockUserState,
+  mockInstallationsState,
+  mockRepositoriesState,
+  mockToast,
+} = vi.hoisted(() => ({
+  mockEnableGitHubApp: vi.fn(),
+  mockSyncGitHubInstallations: vi.fn(),
+  mockUserState: { isAdmin: true as boolean },
+  mockInstallationsState: {
+    data: [] as Array<{
+      id: string;
+      accountLogin: string;
+      accountType: string;
+      suspendedAt: string | null;
+    }>,
+  },
+  mockRepositoriesState: { data: [] as RepositoryRow[] },
+  mockToast: { error: vi.fn(), success: vi.fn() },
+}));
+
+const mockRadioGroupState = vi.hoisted(() => ({
+  onValueChange: undefined as undefined | ((value: string) => void),
+}));
+
+vi.mock('next/navigation', () => ({
+  usePathname: () => '/settings/environments/new',
+  useSearchParams: () => new URLSearchParams(''),
+}));
+
+vi.mock('sonner', () => ({ toast: mockToast }));
+
+vi.mock('@/hooks/github', () => ({
+  useEnableGitHubApp: () => ({
+    mutate: mockEnableGitHubApp,
+    isPending: false,
+  }),
+  useGitHubInstallations: () => ({ data: mockInstallationsState.data }),
+  useSyncGitHubInstallations: () => ({
+    mutate: mockSyncGitHubInstallations,
+    isPending: false,
+  }),
+}));
+
+vi.mock('@/hooks/source-control', () => ({
+  useRepositories: () => ({ data: mockRepositoriesState.data }),
+}));
+
+vi.mock('@/hooks/useRealtimePolling', () => ({
+  useRealtimePolling: () => ({
+    refetchInterval: false,
+    refetchIntervalInBackground: false,
+    retry: 3,
+    isVisible: true,
+  }),
+}));
+
+vi.mock('@/hooks/useUser', () => ({
+  useAuthorizedUser: () => ({ isAdmin: mockUserState.isAdmin }),
+}));
+
+vi.mock('@/components/system', () => {
+  const passthrough = (Tag: 'div' | 'p' | 'span' | 'label' = 'div') => {
+    const Passthrough = ({ children, ...props }: { children?: ReactNode }) => (
+      <Tag {...props}>{children}</Tag>
+    );
+    Passthrough.displayName = `Passthrough(${Tag})`;
+    return Passthrough;
+  };
+
+  return {
+    Alert: passthrough(),
+    AlertDescription: passthrough(),
+    AlertTitle: passthrough(),
+    Button: ({
+      children,
+      asChild: _asChild,
+      ...props
+    }: {
+      children: ReactNode;
+      asChild?: boolean;
+    } & ButtonHTMLAttributes<HTMLButtonElement>) =>
+      _asChild ? (
+        <>{children}</>
+      ) : (
+        <button type={props.type ?? 'button'} {...props}>
+          {children}
+        </button>
+      ),
+    CircleCheck: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+    Dialog: ({ children, open }: { children: ReactNode; open: boolean }) =>
+      open ? <div>{children}</div> : null,
+    DialogContent: passthrough(),
+    DialogDescription: passthrough('p'),
+    DialogFooter: passthrough(),
+    DialogHeader: passthrough(),
+    DialogTitle: passthrough('p'),
+    ExternalLink: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+    Input: (props: InputHTMLAttributes<HTMLInputElement>) => (
+      <input {...props} />
+    ),
+    Label: passthrough('label'),
+    Loader2: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+    Pencil: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+    Plus: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+    Select: passthrough(),
+    SelectContent: passthrough(),
+    SelectItem: passthrough(),
+    SelectTrigger: passthrough(),
+    SelectValue: passthrough('span'),
+    RadioGroup: ({
+      children,
+      onValueChange,
+      ...props
+    }: {
+      children: ReactNode;
+      onValueChange?: (value: string) => void;
+    }) => {
+      mockRadioGroupState.onValueChange = onValueChange;
+
+      return <fieldset {...props}>{children}</fieldset>;
+    },
+    RadioGroupItem: (props: InputHTMLAttributes<HTMLInputElement>) => (
+      <input
+        type="radio"
+        {...props}
+        onChange={(event) =>
+          mockRadioGroupState.onValueChange?.(event.currentTarget.value)
+        }
+      />
+    ),
+  };
+});
+
+import { CreateGitHubRepoDialog } from './CreateGitHubRepoDialog';
+
+function findLinkByText(text: RegExp): HTMLAnchorElement {
+  const link = screen
+    .getAllByRole('link')
+    .find((element) => text.test(element.textContent ?? ''));
+
+  if (!link) {
+    throw new Error(`No link matching ${text}`);
+  }
+
+  return link as HTMLAnchorElement;
+}
+
+describe('CreateGitHubRepoDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockUserState.isAdmin = true;
+    mockInstallationsState.data = [
+      {
+        id: 'install-1',
+        accountLogin: 'acme',
+        accountType: 'Organization',
+        suspendedAt: null,
+      },
+    ];
+    mockRepositoriesState.data = [
+      {
+        id: 'repo-1',
+        fullName: 'acme/existing',
+        sourceControlProvider: 'github',
+      },
+    ];
+  });
+
+  it('prefills the github.com/new link with the installation owner', () => {
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    expect(findLinkByText(/^Go$/).getAttribute('href')).toBe(
+      'https://github.com/new?owner=acme',
+    );
+  });
+
+  it('falls back to a bare github.com/new link without installations', () => {
+    mockInstallationsState.data = [];
+
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    expect(findLinkByText(/^Go$/).getAttribute('href')).toBe(
+      'https://github.com/new',
+    );
+  });
+
+  it('builds the fork link from a pasted repository URL', () => {
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    fireEvent.click(screen.getByRole('radio', { name: 'Fork existing' }));
+
+    fireEvent.change(screen.getByLabelText('Repository to fork'), {
+      target: { value: 'https://github.com/RooCodeInc/Roomote' },
+    });
+
+    expect(findLinkByText(/^Go$/).getAttribute('href')).toBe(
+      'https://github.com/RooCodeInc/Roomote/fork',
+    );
+  });
+
+  it('shows a validation hint for unparseable fork references', () => {
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    fireEvent.click(screen.getByRole('radio', { name: 'Fork existing' }));
+
+    fireEvent.change(screen.getByLabelText('Repository to fork'), {
+      target: { value: 'https://gitlab.com/acme/repo' },
+    });
+
+    expect(
+      screen.getByText('Enter a GitHub repository URL or owner/repo.'),
+    ).toBeInTheDocument();
+  });
+
+  it('surfaces repositories that appear after the dialog opened', () => {
+    const onRepositoryDetected = vi.fn();
+    const { rerender } = render(
+      <CreateGitHubRepoDialog
+        open={true}
+        onOpenChange={() => undefined}
+        onRepositoryDetected={onRepositoryDetected}
+      />,
+    );
+
+    expect(screen.queryByText(/Found /)).not.toBeInTheDocument();
+
+    mockRepositoriesState.data = [
+      ...mockRepositoriesState.data,
+      {
+        id: 'repo-2',
+        fullName: 'acme/new-repo',
+        sourceControlProvider: 'github',
+        isEmpty: true,
+      },
+    ];
+
+    rerender(
+      <CreateGitHubRepoDialog
+        open={true}
+        onOpenChange={() => undefined}
+        onRepositoryDetected={onRepositoryDetected}
+      />,
+    );
+
+    expect(screen.getByText('acme/new-repo')).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Use it' }));
+
+    expect(onRepositoryDetected).toHaveBeenCalledWith({
+      id: 'repo-2',
+      fullName: 'acme/new-repo',
+      isEmpty: true,
+    });
+  });
+
+  it('triggers a manual GitHub sync from the refresh link', () => {
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: 'Refresh now' }));
+
+    expect(mockSyncGitHubInstallations).toHaveBeenCalledTimes(1);
+  });
+
+  it('offers the Update GitHub action to admins only', () => {
+    const { unmount } = render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: /Update GitHub/i }));
+    expect(mockEnableGitHubApp).toHaveBeenCalledWith(
+      {
+        redirect: '/settings/environments/new',
+        callbackBackground: 'background',
+      },
+      expect.any(Object),
+    );
+
+    unmount();
+    mockUserState.isAdmin = false;
+
+    render(
+      <CreateGitHubRepoDialog open={true} onOpenChange={() => undefined} />,
+    );
+
+    expect(screen.getByText(/Ask an admin/i)).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: /Update GitHub/i }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/web/src/components/github/CreateGitHubRepoDialog.tsx b/apps/web/src/components/github/CreateGitHubRepoDialog.tsx
new file mode 100644
index 000000000..ee9971e64
--- /dev/null
+++ b/apps/web/src/components/github/CreateGitHubRepoDialog.tsx
@@ -0,0 +1,403 @@
+'use client';
+
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { usePathname, useSearchParams } from 'next/navigation';
+import { toast } from 'sonner';
+
+import {
+  useEnableGitHubApp,
+  useGitHubInstallations,
+  useSyncGitHubInstallations,
+} from '@/hooks/github';
+import { useRepositories } from '@/hooks/source-control';
+import { useRealtimePolling } from '@/hooks/useRealtimePolling';
+import { useAuthorizedUser } from '@/hooks/useUser';
+import { parseGitHubRepoReference } from '@/lib/github-urls';
+
+import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  ExternalLink,
+  Input,
+  Label,
+  Loader2,
+  Pencil,
+  RadioGroup,
+  RadioGroupItem,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/system';
+import { ArrowRight, BookPlus, Check, GitFork } from 'lucide-react';
+
+export type DetectedRepository = {
+  id: string;
+  fullName: string;
+  isEmpty?: boolean;
+};
+
+const REPOSITORY_POLL_INTERVAL_MS = 5000;
+
+export function CreateGitHubRepoDialog({
+  open,
+  onOpenChange,
+  onRepositoryDetected,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onRepositoryDetected?: (repository: DetectedRepository) => void;
+}) {
+  const pathname = usePathname();
+  const searchParams = useSearchParams();
+  const { isAdmin } = useAuthorizedUser();
+
+  const [selectedOwner, setSelectedOwner] = useState<string | null>(null);
+  const [repositoryAction, setRepositoryAction] = useState<'new' | 'fork'>(
+    'new',
+  );
+  const [forkReference, setForkReference] = useState('');
+
+  const installations = useGitHubInstallations();
+  const enableGitHubApp = useEnableGitHubApp();
+  const syncGitHubInstallations = useSyncGitHubInstallations({
+    onError: () => toast.error('Failed to refresh GitHub. Please try again.'),
+  });
+
+  const polling = useRealtimePolling({
+    enabled: open,
+    interval: REPOSITORY_POLL_INTERVAL_MS,
+  });
+  const repositories = useRepositories(
+    { includeEmptyState: true },
+    {
+      refetchInterval: polling.refetchInterval,
+      refetchIntervalInBackground: polling.refetchIntervalInBackground,
+    },
+  );
+
+  const githubRepositories = useMemo<DetectedRepository[]>(
+    () =>
+      (repositories.data ?? [])
+        .filter((repository) => repository.sourceControlProvider === 'github')
+        .map((repository) => ({
+          id: repository.id,
+          fullName: repository.fullName,
+          // `isEmpty` is present because the query passes includeEmptyState,
+          // but the router output type does not narrow on that flag.
+          isEmpty: (repository as { isEmpty?: boolean }).isEmpty,
+        })),
+    [repositories.data],
+  );
+
+  // Snapshot the repos that existed when the dialog opened; anything beyond
+  // that baseline was just created (or just granted) and is offered back.
+  const baselineRepositoryIdsRef = useRef<Set<string> | null>(null);
+
+  useEffect(() => {
+    if (!open) {
+      baselineRepositoryIdsRef.current = null;
+      return;
+    }
+
+    if (
+      baselineRepositoryIdsRef.current === null &&
+      repositories.data !== undefined
+    ) {
+      baselineRepositoryIdsRef.current = new Set(
+        githubRepositories.map((repository) => repository.id),
+      );
+    }
+  }, [open, repositories.data, githubRepositories]);
+
+  const detectedRepositories = useMemo(() => {
+    const baseline = baselineRepositoryIdsRef.current;
+
+    if (!open || baseline === null) {
+      return [];
+    }
+
+    // The baseline ref is intentionally read during render: it only changes
+    // together with `githubRepositories`, which is a dependency.
+    return githubRepositories.filter(
+      (repository) => !baseline.has(repository.id),
+    );
+  }, [open, githubRepositories]);
+
+  // Returning from github.com is the most likely moment the new repo exists,
+  // so trigger one authoritative GitHub sync per return to the tab instead of
+  // waiting for a webhook or the next poll.
+  const visibilitySyncPendingRef = useRef(false);
+
+  useEffect(() => {
+    if (!open) {
+      visibilitySyncPendingRef.current = false;
+      return;
+    }
+
+    const handleVisibilityChange = () => {
+      if (document.hidden) {
+        visibilitySyncPendingRef.current = true;
+        return;
+      }
+
+      if (
+        visibilitySyncPendingRef.current &&
+        !syncGitHubInstallations.isPending
+      ) {
+        visibilitySyncPendingRef.current = false;
+        syncGitHubInstallations.mutate();
+      }
+    };
+
+    document.addEventListener('visibilitychange', handleVisibilityChange);
+
+    return () => {
+      document.removeEventListener('visibilitychange', handleVisibilityChange);
+    };
+  }, [open, syncGitHubInstallations]);
+
+  const activeInstallations = useMemo(
+    () =>
+      (installations.data ?? []).filter(
+        (installation) => !installation.suspendedAt,
+      ),
+    [installations.data],
+  );
+
+  const defaultOwner =
+    activeInstallations.find(
+      (installation) => installation.accountType === 'Organization',
+    )?.accountLogin ??
+    activeInstallations[0]?.accountLogin ??
+    null;
+  const owner = selectedOwner ?? defaultOwner;
+  const newRepoUrl = owner
+    ? `https://github.com/new?owner=${encodeURIComponent(owner)}`
+    : 'https://github.com/new';
+
+  const forkTarget = parseGitHubRepoReference(forkReference);
+  const forkUrl = forkTarget
+    ? `https://github.com/${forkTarget.owner}/${forkTarget.repo}/fork`
+    : null;
+
+  const search = searchParams.toString();
+  const redirectTarget = search ? `${pathname}?${search}` : pathname;
+
+  const updateGitHubAccess = () => {
+    enableGitHubApp.mutate(
+      {
+        redirect: redirectTarget,
+        callbackBackground: 'background',
+      },
+      {
+        onSuccess: (result) => {
+          if (!result.success) {
+            toast.error(result.error);
+            return;
+          }
+
+          if (result.mode === 'redirect') {
+            window.location.href = result.url;
+            return;
+          }
+
+          toast.success('GitHub access updated.');
+        },
+        onError: () =>
+          toast.error('Failed to update GitHub. Please try again.'),
+      },
+    );
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent size="lg">
+        <DialogHeader>
+          <DialogTitle>Create environment from new repo</DialogTitle>
+          <DialogDescription>
+            Create the repo on Github first, and Roomote will pick it up here.
+          </DialogDescription>
+        </DialogHeader>
+
+        <RadioGroup
+          value={repositoryAction}
+          onValueChange={(value) =>
+            setRepositoryAction(value === 'fork' ? 'fork' : 'new')
+          }
+          className="space-y-0"
+          aria-label="Repository action"
+        >
+          <div className="flex items-center gap-2">
+            <RadioGroupItem value="new" id="create-repo-new" />
+            <Label htmlFor="create-repo-new" className="cursor-pointer">
+              <BookPlus className="size-4 text-muted-foreground" />
+              New repository
+            </Label>
+          </div>
+          {repositoryAction === 'new' && (
+            <div className="space-y-2 pl-6 mb-4">
+              <div className="flex gap-2 items-center">
+                <p className="text-sm text-muted-foreground grow">
+                  Please create it now on Github and come back here when done.
+                </p>
+                <Button asChild size="sm">
+                  <a href={newRepoUrl} target="_blank" rel="noreferrer">
+                    Go
+                    <ExternalLink />
+                  </a>
+                </Button>
+              </div>
+              {activeInstallations.length > 1 ? (
+                <div className="space-y-1.5">
+                  <Label htmlFor="create-repo-owner">Owner</Label>
+                  <Select
+                    value={owner ?? undefined}
+                    onValueChange={setSelectedOwner}
+                  >
+                    <SelectTrigger id="create-repo-owner">
+                      <SelectValue placeholder="Choose an owner" />
+                    </SelectTrigger>
+                    <SelectContent>
+                      {activeInstallations.map((installation) => (
+                        <SelectItem
+                          key={installation.id}
+                          value={installation.accountLogin}
+                        >
+                          {installation.accountLogin}
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+              ) : null}
+            </div>
+          )}
+          <div className="flex items-center gap-2">
+            <RadioGroupItem value="fork" id="create-repo-fork" />
+            <Label htmlFor="create-repo-fork" className="cursor-pointer">
+              <GitFork className="size-4 text-muted-foreground" />
+              Fork existing
+            </Label>
+          </div>
+          {repositoryAction === 'fork' && (
+            <div className="space-y-2 pl-6 mb-4">
+              <p className="text-sm text-muted-foreground">
+                Enter the repo you want to fork, then fork it and come back here
+                when done.
+              </p>
+              <div className="flex gap-2 items-center">
+                <Input
+                  value={forkReference}
+                  onChange={(event) => setForkReference(event.target.value)}
+                  placeholder="https://github.com/owner/repo"
+                  aria-label="Repository to fork"
+                />
+                <Button asChild size="sm" disabled={!forkUrl}>
+                  <a
+                    href={forkUrl ?? undefined}
+                    target="_blank"
+                    rel="noreferrer"
+                    aria-disabled={!forkUrl}
+                    onClick={(event) => {
+                      if (!forkUrl) event.preventDefault();
+                    }}
+                  >
+                    Go
+                    <ExternalLink />
+                  </a>
+                </Button>
+              </div>
+              {forkReference.trim() && !forkTarget ? (
+                <p className="text-xs text-destructive">
+                  Enter a GitHub repository URL or owner/repo.
+                </p>
+              ) : null}
+            </div>
+          )}
+        </RadioGroup>
+
+        {detectedRepositories.length > 0 ? (
+          <div className="space-y-2">
+            {detectedRepositories.map((repository) => (
+              <Alert variant="notice" key={repository.id}>
+                <Check className="size-4" />
+                <AlertTitle>
+                  Found{' '}
+                  <span className="font-mono font-medium text-[0.9em]">
+                    {repository.fullName}
+                  </span>
+                </AlertTitle>
+                <AlertDescription className="flex items-center justify-between gap-2">
+                  <Button
+                    type="button"
+                    size="xs"
+                    onClick={() => onRepositoryDetected?.(repository)}
+                  >
+                    Use it
+                    <ArrowRight />
+                  </Button>
+                </AlertDescription>
+              </Alert>
+            ))}
+          </div>
+        ) : (
+          <div className="flex items-center gap-2 text-sm text-foreground mt-4">
+            <Loader2 className="size-3.5 animate-spin" />
+            <span>Watching for new repositories…</span>
+            <Button
+              type="button"
+              size="xs"
+              variant="link"
+              className="h-auto p-0"
+              disabled={syncGitHubInstallations.isPending}
+              onClick={() => syncGitHubInstallations.mutate()}
+            >
+              Refresh now
+            </Button>
+          </div>
+        )}
+
+        <div className="space-y-2 mt-4">
+          <p className="text-xs text-muted-foreground">
+            If your GitHub integration does not have access to all repositories
+            by default, grant it access to the new one or it will not be
+            detected.
+            {isAdmin ? (
+              <Button
+                type="button"
+                size="xs"
+                variant="link"
+                className="relative top-0.5"
+                disabled={enableGitHubApp.isPending}
+                onClick={updateGitHubAccess}
+              >
+                <Pencil className="size-3" />
+                Update GitHub
+              </Button>
+            ) : (
+              <span className="text-xs text-muted-foreground">
+                Ask an admin to update the connected GitHub repositories.
+              </span>
+            )}
+          </p>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>
+            Cancel
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/apps/web/src/components/layout/UserMenu.tsx b/apps/web/src/components/layout/UserMenu.tsx
index ae912aeb6..f355b353e 100644
--- a/apps/web/src/components/layout/UserMenu.tsx
+++ b/apps/web/src/components/layout/UserMenu.tsx
@@ -1,12 +1,30 @@
 'use client';
 
-import { BookMarked, LogOut, Avatar } from '@/components/system';
+import { useState } from 'react';
+import { useQuery } from '@tanstack/react-query';
+
+import {
+  Avatar,
+  BookMarked,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  ExternalLink,
+  Info,
+  LogOut,
+} from '@/components/system';
 
 import { useUser } from '@/hooks/useUser';
 import { authClient } from '@/lib/auth-client';
 import { DOCS_BASE_URL } from '@/lib/docs';
+import { isParsableProductVersion, toReleaseTag } from '@/lib/product-version';
+import { GITHUB_RELEASES_BASE_URL } from '@/lib/release-links';
 import { PERSONAL_THEME_STORAGE_KEY } from '@/types/preferences';
 import { cn } from '@/lib/utils';
+import { useTRPC } from '@/trpc/client';
 
 import {
   DropdownMenu,
@@ -15,6 +33,7 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@/components/system';
+import Image from 'next/image';
 
 export const UserMenu = ({
   portalContainer,
@@ -56,6 +75,14 @@ function SignedInUserMenu({
   switchOrgRedirectPath?: string;
   user: NonNullable<ReturnType<typeof useUser>['user']>;
 }) {
+  const trpc = useTRPC();
+  const [isAboutOpen, setIsAboutOpen] = useState(false);
+  const statusQuery = useQuery(
+    trpc.releases.status.queryOptions(undefined, {
+      staleTime: 30 * 60 * 1000,
+      refetchOnWindowFocus: false,
+    }),
+  );
   const handleSignOut = async () => {
     window.localStorage.removeItem(PERSONAL_THEME_STORAGE_KEY);
     await authClient.signOut({
@@ -69,6 +96,11 @@ function SignedInUserMenu({
 
   const userDisplayName = user.name ?? 'You';
   const userEmail = user.resource.primaryEmailAddress?.emailAddress;
+  const displayVersion = statusQuery.data?.displayVersion ?? null;
+  const isReleaseVersion = isParsableProductVersion(displayVersion);
+  const releaseUrl = displayVersion
+    ? `${GITHUB_RELEASES_BASE_URL}/#release-${toReleaseTag(displayVersion)}`
+    : null;
 
   return (
     <>
@@ -121,6 +153,15 @@ function SignedInUserMenu({
           </div>
 
           <DropdownMenuSeparator />
+          <DropdownMenuItem onClick={() => setIsAboutOpen(true)}>
+            <Info />
+            <span className="grow">About Roomote</span>
+            {displayVersion && (
+              <span className="text-muted-foreground text-xs">
+                {displayVersion}
+              </span>
+            )}
+          </DropdownMenuItem>
           <DropdownMenuItem asChild>
             <a
               href={DOCS_BASE_URL}
@@ -140,6 +181,55 @@ function SignedInUserMenu({
           </DropdownMenuItem>
         </DropdownMenuContent>
       </DropdownMenu>
+      <Dialog open={isAboutOpen} onOpenChange={setIsAboutOpen}>
+        <DialogContent size="md">
+          <DialogHeader>
+            <DialogTitle>About Roomote</DialogTitle>
+            {displayVersion && (
+              <DialogDescription>
+                You&apos;re running Roomote version{' '}
+                <span className="font-mono text-[0.9em]">
+                  {isReleaseVersion && releaseUrl ? (
+                    <a
+                      href={releaseUrl}
+                      target="_blank"
+                      rel="noreferrer"
+                      className="underline"
+                    >
+                      {displayVersion}
+                    </a>
+                  ) : (
+                    displayVersion
+                  )}
+                </span>
+              </DialogDescription>
+            )}
+          </DialogHeader>
+
+          <p className="max-w-54 min-h-14 md:max-w-none md:min-h-auto">
+            Made with care by humans and robots.
+          </p>
+          <div>
+            <Button variant="link" size="sm" asChild>
+              <a
+                href={GITHUB_RELEASES_BASE_URL}
+                target="_blank"
+                rel="noreferrer"
+              >
+                See all Roomote releases
+                <ExternalLink />
+              </a>
+            </Button>
+          </div>
+          <Image
+            src="/elements/about.png"
+            alt=""
+            width={100}
+            height={100}
+            className="absolute bottom-0 right-4 size-30"
+          />
+        </DialogContent>
+      </Dialog>
     </>
   );
 }
diff --git a/apps/web/src/components/layout/navbar/NavbarHeader.tsx b/apps/web/src/components/layout/navbar/NavbarHeader.tsx
index a74162e20..d8cbd21f8 100644
--- a/apps/web/src/components/layout/navbar/NavbarHeader.tsx
+++ b/apps/web/src/components/layout/navbar/NavbarHeader.tsx
@@ -24,7 +24,7 @@ export const NavbarHeader = ({ className, ...props }: NavbarHeaderProps) => {
   return (
     <div
       className={cn(
-        'flex items-center justify-between gap-2 h-(--header-height) mx-auto px-1 pr-5',
+        'flex items-center justify-between gap-2 h-(--header-height) mx-auto px-1 pr-2 md:pr-5',
         className,
       )}
       {...props}
diff --git a/apps/web/src/components/settings/CommsProviderSection.test.tsx b/apps/web/src/components/settings/CommsProviderSection.test.tsx
index 1d73c1a20..13e46b8ad 100644
--- a/apps/web/src/components/settings/CommsProviderSection.test.tsx
+++ b/apps/web/src/components/settings/CommsProviderSection.test.tsx
@@ -47,6 +47,7 @@ const state = vi.hoisted(() => ({
   connectSlackUrl: 'https://slack.com/install' as string | null,
   teamsStatus: {
     botConfigured: false,
+    botCredentialCheck: { status: 'unchecked', message: null },
     botUsesTenantSpecificTokenFlow: false,
     microsoftAuthConfigured: false,
     webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -55,6 +56,10 @@ const state = vi.hoisted(() => ({
     primaryConversationType: null as string | null,
   } as null | {
     botConfigured: boolean;
+    botCredentialCheck: {
+      status: 'ok' | 'failed' | 'unchecked';
+      message: string | null;
+    };
     botUsesTenantSpecificTokenFlow: boolean;
     microsoftAuthConfigured: boolean;
     webhookUrl: string;
@@ -546,6 +551,7 @@ describe('CommsProviderSection', () => {
     state.connectSlackUrl = 'https://slack.com/install';
     state.teamsStatus = {
       botConfigured: false,
+      botCredentialCheck: { status: 'unchecked', message: null },
       botUsesTenantSpecificTokenFlow: false,
       microsoftAuthConfigured: false,
       webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -1103,6 +1109,7 @@ describe('CommsProviderSection', () => {
     it('renders bot status and Open in Teams link when configured', () => {
       state.teamsStatus = {
         botConfigured: true,
+        botCredentialCheck: { status: 'ok', message: null },
         botUsesTenantSpecificTokenFlow: true,
         microsoftAuthConfigured: true,
         webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -1156,6 +1163,7 @@ describe('CommsProviderSection', () => {
     it('shows bot status and app-package download when only R_TEAMS_BOT_* is configured (no Microsoft sign-in)', () => {
       state.teamsStatus = {
         botConfigured: true,
+        botCredentialCheck: { status: 'ok', message: null },
         botUsesTenantSpecificTokenFlow: true,
         microsoftAuthConfigured: false,
         webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -1192,6 +1200,7 @@ describe('CommsProviderSection', () => {
     it('nudges to send a first Teams message when the bot is configured but no conversation was captured', () => {
       state.teamsStatus = {
         botConfigured: true,
+        botCredentialCheck: { status: 'ok', message: null },
         botUsesTenantSpecificTokenFlow: true,
         microsoftAuthConfigured: true,
         webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -1224,6 +1233,7 @@ describe('CommsProviderSection', () => {
     it('hides the capture nudge once a primary Teams conversation exists', () => {
       state.teamsStatus = {
         botConfigured: true,
+        botCredentialCheck: { status: 'ok', message: null },
         botUsesTenantSpecificTokenFlow: true,
         microsoftAuthConfigured: true,
         webhookUrl: 'https://roomote.dev/api/webhooks/teams',
@@ -1249,5 +1259,89 @@ describe('CommsProviderSection', () => {
         screen.queryByText(/has not captured a Teams conversation yet/),
       ).not.toBeInTheDocument();
     });
+
+    it('reports rejected credentials instead of claiming the bot is configured', () => {
+      state.teamsStatus = {
+        botConfigured: true,
+        botCredentialCheck: {
+          status: 'failed',
+          message:
+            'Microsoft rejected Client Secret Value (R_MICROSOFT_CLIENT_SECRET). AADSTS7000215: Invalid client secret provided.',
+        },
+        botUsesTenantSpecificTokenFlow: true,
+        microsoftAuthConfigured: true,
+        webhookUrl: 'https://roomote.dev/api/webhooks/teams',
+        openInTeamsUrl: 'https://teams.microsoft.com/l/chat/0/0?users=28%3Abot',
+        primaryConversationReady: false,
+        primaryConversationType: null,
+      };
+
+      render(
+        <CommsProviderSection
+          provider={buildMicrosoftProvider({
+            savedSatisfied: true,
+            setupSatisfied: true,
+          })}
+          onSave={vi.fn()}
+          onClear={vi.fn()}
+          savePending={false}
+          clearPending={false}
+        />,
+      );
+
+      expect(screen.getByText(/AADSTS7000215/)).toBeInTheDocument();
+      expect(screen.queryByText(/^Bot configured\./)).not.toBeInTheDocument();
+      expect(
+        screen.queryByText(/has not captured a Teams conversation yet/),
+      ).not.toBeInTheDocument();
+    });
+
+    it('explains why the Teams app package cannot be pre-filled from a malformed app id', () => {
+      render(
+        <CommsProviderSection
+          provider={buildMicrosoftProvider()}
+          onSave={vi.fn()}
+          onClear={vi.fn()}
+          savePending={false}
+          clearPending={false}
+        />,
+      );
+
+      fireEvent.click(screen.getByRole('button', { name: 'Set it up' }));
+      fireEvent.change(screen.getByPlaceholderText('Microsoft Client ID'), {
+        target: { value: 'not-a-guid' },
+      });
+
+      // Inline, next to the field where the value was typed…
+      expect(
+        screen.getByText(/doesn't look like an Entra app ID/),
+      ).toBeInTheDocument();
+      // …and again at the download button it disables further down.
+      expect(screen.getByText(/not a valid GUID/)).toBeInTheDocument();
+      expect(
+        screen.queryByRole('link', { name: /Download Teams app package/ }),
+      ).not.toBeInTheDocument();
+    });
+
+    it('does not warn about a well-formed App (Client) ID', () => {
+      render(
+        <CommsProviderSection
+          provider={buildMicrosoftProvider()}
+          onSave={vi.fn()}
+          onClear={vi.fn()}
+          savePending={false}
+          clearPending={false}
+        />,
+      );
+
+      fireEvent.click(screen.getByRole('button', { name: 'Set it up' }));
+      fireEvent.change(screen.getByPlaceholderText('Microsoft Client ID'), {
+        target: { value: '00000000-0000-0000-0000-000000000001' },
+      });
+
+      expect(
+        screen.queryByText(/doesn't look like an Entra app ID/),
+      ).not.toBeInTheDocument();
+    });
   });
 });
diff --git a/apps/web/src/components/settings/CommsProviderSection.tsx b/apps/web/src/components/settings/CommsProviderSection.tsx
index cadd481a7..d47fb924f 100644
--- a/apps/web/src/components/settings/CommsProviderSection.tsx
+++ b/apps/web/src/components/settings/CommsProviderSection.tsx
@@ -18,6 +18,8 @@ import {
   getSetupEffectiveFieldValue,
   getSetupSubmitValues,
   getSetupVisibleFields,
+  getTeamsAppPackageUnavailableReason,
+  MICROSOFT_APP_ID_PATTERN,
   ProviderSetupExperience,
 } from '@/app/(onboarding)/setup/ProviderSetupExperience';
 
@@ -85,9 +87,6 @@ import { Section } from './Section';
 import { TelegramLinkAccountStep } from './TelegramLinkAccountStep';
 import { DiscordSetupStatus } from './DiscordSetupStatus';
 
-const MICROSOFT_APP_ID_PATTERN =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 function getProviderIconId(providerId: CommsProviderId): string {
   return providerId === 'microsoft' ? 'teams' : providerId;
 }
@@ -178,8 +177,13 @@ function TeamsBotStatus() {
   const teamsPrimaryConversationReady = Boolean(
     teamsStatus?.primaryConversationReady,
   );
+  const teamsCredentialCheck = teamsStatus?.botCredentialCheck ?? null;
+  const teamsCredentialsRejected = teamsCredentialCheck?.status === 'failed';
 
-  const statusCopy = teamsBotConfigured ? (
+  const statusCopy = teamsCredentialsRejected ? (
+    (teamsCredentialCheck?.message ??
+    'Microsoft rejected the saved Teams bot credentials.')
+  ) : teamsBotConfigured ? (
     teamsStatus?.microsoftAuthConfigured ? (
       <>
         Bot configured. Team members can link Microsoft Teams accounts from{' '}
@@ -208,14 +212,25 @@ function TeamsBotStatus() {
   return (
     <div className="space-y-2 mt-4">
       <div className="flex items-start gap-2">
-        {!teamsBotConfigured ? (
+        {!teamsBotConfigured || teamsCredentialsRejected ? (
           <TriangleAlert className="size-4 mt-0.5 shrink-0 text-amber-600" />
         ) : (
           <Info className="size-4 mt-0.5 shrink-0" />
         )}
         <p className="text-sm text-muted-foreground">{statusCopy}</p>
       </div>
-      {teamsBotConfigured && !teamsPrimaryConversationReady ? (
+      {teamsCredentialCheck?.status === 'unchecked' &&
+      teamsCredentialCheck.message ? (
+        <div className="flex items-start gap-2">
+          <Info className="size-4 mt-0.5 shrink-0" />
+          <p className="text-sm text-muted-foreground">
+            {teamsCredentialCheck.message}
+          </p>
+        </div>
+      ) : null}
+      {teamsBotConfigured &&
+      !teamsCredentialsRejected &&
+      !teamsPrimaryConversationReady ? (
         <div className="flex items-start gap-2">
           <TriangleAlert className="size-4 mt-0.5 shrink-0 text-amber-600" />
           <p className="text-sm text-muted-foreground">
@@ -497,6 +512,9 @@ export function CommsProviderSection({
     : teamsBotAppIdStored || teamsBotConfigured
       ? '/api/teams/app-package'
       : null;
+  const teamsAppPackageUnavailableReason = isMicrosoftProvider
+    ? getTeamsAppPackageUnavailableReason(enteredTeamsBotAppId)
+    : null;
 
   const handleSave = () => {
     onSave(provider.id, getSetupSubmitValues({ provider, values }));
@@ -544,6 +562,9 @@ export function CommsProviderSection({
               editingSavedValues={editingSavedValues}
               clearedSavedValues={clearedSavedValues}
               teamsAppPackageHref={teamsAppPackageHref}
+              teamsAppPackageUnavailableReason={
+                teamsAppPackageUnavailableReason
+              }
               createdSlackAppSettingsUrl={createdSlackAppSettingsUrl}
               createdSlackAppIconSet={createdSlackAppIconSet}
               createSlackAppPending={createSlackApp.isPending}
diff --git a/apps/web/src/components/settings/Integrations.test.tsx b/apps/web/src/components/settings/Integrations.test.tsx
index 8d229bc9f..0e370686f 100644
--- a/apps/web/src/components/settings/Integrations.test.tsx
+++ b/apps/web/src/components/settings/Integrations.test.tsx
@@ -14,6 +14,10 @@ import { MCP_TOOL_CATALOG_REQUIRES_PERSONAL_CONNECTION } from '@/lib/mcp-tool-er
 
 const state = vi.hoisted(() => ({
   deploymentEnablements: [] as Array<{ mcpId: string; enabled: boolean }>,
+  oauthReadiness: [{ mcpId: 'linear', status: 'ready' as const }] as Array<{
+    mcpId: string;
+    status: 'ready' | 'missing' | 'partial';
+  }>,
   userConnections: [] as Array<{
     id?: string;
     mcpId: string;
@@ -53,6 +57,28 @@ const state = vi.hoisted(() => ({
   linearInstallation: {
     linearOrganizationName: 'Roomote',
   } as null | { linearOrganizationName?: string },
+  linearOauthSetup: {
+    callbackUrl: 'https://roomote.example/api/mcp-oauth/callback',
+    webhookUrl: 'https://roomote.example/api/webhooks/linear',
+    manifestUrl: 'https://linear.app/settings/api/applications/new?manifest=x',
+    fields: {
+      clientId: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+      clientSecret: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+      webhookSecret: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+    },
+  },
   linearRedirectPath: '',
   searchParams: '',
 }));
@@ -69,6 +95,8 @@ const { mutations, selectMock } = vi.hoisted(() => ({
     saveGrafanaConnection: vi.fn(),
     saveSnowflakeConnection: vi.fn(),
     saveVercelConnection: vi.fn(),
+    saveLinearOauthSetup: vi.fn(),
+    removeLinearOauthSetup: vi.fn(),
   },
   selectMock: {
     latestOnValueChange: null as null | ((value: string) => void),
@@ -152,12 +180,28 @@ vi.mock('@/hooks/linear', () => ({
     isPending: false,
     mutate: mutations.disconnectLinear,
   }),
+  useLinearOauthSetup: () => ({
+    data: state.linearOauthSetup,
+    isPending: false,
+  }),
+  useSaveLinearOauthSetup: () => ({
+    isPending: false,
+    mutate: mutations.saveLinearOauthSetup,
+  }),
+  useRemoveLinearOauthSetup: () => ({
+    isPending: false,
+    mutate: mutations.removeLinearOauthSetup,
+  }),
 }));
 
 vi.mock('@/hooks/mcp-connections', () => ({
   useDeploymentMcpEnablements: () => ({
     data: state.deploymentEnablements,
   }),
+  useMcpOauthReadiness: () => ({
+    data: state.oauthReadiness,
+    isPending: false,
+  }),
   useUserMcpConnections: () => ({
     data: state.userConnections,
     isPending: false,
@@ -246,11 +290,18 @@ vi.mock('@/components/system', () => ({
   BrandIcon: ({ name }: { name: string }) => (
     <svg aria-label={name} role="img" />
   ),
-  Button: ({ children, ...props }: ButtonHTMLAttributes<HTMLButtonElement>) => (
-    <button type="button" {...props}>
-      {children}
-    </button>
-  ),
+  Button: ({
+    children,
+    asChild,
+    ...props
+  }: ButtonHTMLAttributes<HTMLButtonElement> & { asChild?: boolean }) =>
+    asChild ? (
+      children
+    ) : (
+      <button type="button" {...props}>
+        {children}
+      </button>
+    ),
   Card: ({
     children,
     ...props
@@ -262,6 +313,7 @@ vi.mock('@/components/system', () => ({
   CardHeader: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   CardTitle: ({ children }: { children: ReactNode }) => <h3>{children}</h3>,
   Check: () => <svg aria-hidden="true" />,
+  Copy: () => <svg aria-hidden="true" />,
   Dialog: ({ open, children }: { open: boolean; children: ReactNode }) =>
     open ? <div>{children}</div> : null,
   DialogContent: ({ children }: { children: ReactNode }) => (
@@ -280,17 +332,21 @@ vi.mock('@/components/system', () => ({
   Eye: () => <svg aria-hidden="true" />,
   EyeOff: () => <svg aria-hidden="true" />,
   EthernetPort: () => <svg aria-hidden="true" />,
+  ExternalLink: () => <svg aria-hidden="true" />,
   Info: () => <svg aria-hidden="true" />,
   InfoTooltip: ({ content }: { content: string }) => <span>{content}</span>,
-  Input: ({ ...props }: InputHTMLAttributes<HTMLInputElement>) => (
-    <input {...props} />
-  ),
+  Input: ({
+    secret: _secret,
+    ...props
+  }: InputHTMLAttributes<HTMLInputElement> & {
+    secret?: boolean;
+  }) => <input {...props} />,
   Label: ({ children, ...props }: LabelHTMLAttributes<HTMLLabelElement>) => (
     <label {...props}>{children}</label>
   ),
   LinearLogo: () => <svg aria-hidden="true" />,
   Pencil: () => <svg aria-hidden="true" />,
-  Plus: () => <svg aria-hidden="true" />,
+  Plus: () => <svg aria-hidden="true" data-icon="plus" />,
   PlugIcon: () => <svg aria-hidden="true" />,
   RefreshCw: ({ className }: { className?: string }) => (
     <svg aria-hidden="true" className={className} data-icon="refresh-cw" />
@@ -333,12 +389,13 @@ vi.mock('@/components/system', () => ({
       {children}
     </button>
   ),
-  Settings2: () => <svg aria-hidden="true" />,
+  Settings2: () => <svg aria-hidden="true" data-icon="settings-2" />,
   Skeleton: ({ className }: { className?: string }) => (
     <div className={className}>loading</div>
   ),
   Spinner: () => <span>loading</span>,
   Star: () => <svg aria-hidden="true" />,
+  Trash: () => <svg aria-hidden="true" />,
   Switch: ({
     checked,
     onCheckedChange,
@@ -375,6 +432,7 @@ describe('Integrations settings', () => {
     vi.clearAllMocks();
     window.history.replaceState(null, '', '/settings/integrations');
     state.deploymentEnablements = [];
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'ready' }];
     state.userConnections = [];
     state.mcpTools = null;
     state.mcpToolsError = null;
@@ -389,6 +447,23 @@ describe('Integrations settings', () => {
     state.featureFlags = {};
     state.snowflakeConnection = null;
     state.searchParams = '';
+    state.linearOauthSetup.fields = {
+      clientId: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+      clientSecret: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+      webhookSecret: {
+        configured: false,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+    };
   });
 
   it('returns Linear OAuth to a service-specific integrations URL', () => {
@@ -399,23 +474,286 @@ describe('Integrations settings', () => {
     );
   });
 
-  it('sorts integrations alphabetically and splits installed vs available', () => {
+  it('uses the settings action for missing Linear OAuth setup', () => {
+    state.linearInstallation = null;
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'missing' }];
+
+    render(<Integrations />);
+
+    const linearCard = screen
+      .getByRole('heading', { name: 'Linear' })
+      .closest('[id="integration-linear"]');
+
+    expect(linearCard).not.toBeNull();
+    expect(
+      screen.getByRole('button', { name: 'Set up Linear' }),
+    ).toBeInTheDocument();
+    expect(
+      screen
+        .getByRole('button', { name: 'Set up Linear' })
+        .querySelector('[data-icon="settings-2"]'),
+    ).toBeInTheDocument();
+  });
+
+  it('distinguishes incomplete Linear OAuth setup for admins', () => {
+    state.linearInstallation = null;
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'partial' }];
+
+    render(<Integrations />);
+
+    const linearCard = screen
+      .getByRole('heading', { name: 'Linear' })
+      .closest('[id="integration-linear"]');
+
+    expect(linearCard).toHaveTextContent('Configuration incomplete.');
+  });
+
+  it('asks non-admins to contact an administrator when OAuth is unavailable', () => {
+    state.isAdmin = false;
+    state.linearInstallation = null;
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'missing' }];
+
+    render(<Integrations />);
+
+    expect(
+      screen.getByText('Not configured. Ask an administrator to set it up.'),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Set up Linear' }),
+    ).not.toBeInTheDocument();
+  });
+
+  it('opens the guided Linear OAuth setup for admins', () => {
+    state.linearInstallation = null;
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'missing' }];
+
+    render(<Integrations />);
+    fireEvent.click(screen.getByRole('button', { name: 'Set up Linear' }));
+
+    expect(
+      screen.getByRole('heading', { name: 'Set up Linear' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Create the app' }),
+    ).toBeInTheDocument();
+    expect(screen.getByText('1', { exact: true })).toBeInTheDocument();
+    expect(screen.getByText('2', { exact: true })).toBeInTheDocument();
+    expect(
+      screen.getByRole('heading', {
+        name: 'Create a Linear app.',
+      }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('heading', {
+        name: 'Copy the app credentials.',
+      }),
+    ).toBeInTheDocument();
+    expect(screen.queryByText('Callback URL')).not.toBeInTheDocument();
+    expect(screen.queryByText('Webhook URL')).not.toBeInTheDocument();
+    expect(screen.getByLabelText('Client ID')).toBeInTheDocument();
+    expect(screen.getByLabelText('Client secret')).toBeInTheDocument();
+    expect(screen.getByLabelText('Webhook signing secret')).toBeInTheDocument();
+  });
+
+  it('offers administrators configuration access after Linear is configured', () => {
+    state.linearInstallation = null;
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'ready' }];
+
+    render(<Integrations />);
+
+    expect(
+      screen.queryByRole('button', { name: 'Set up Linear' }),
+    ).not.toBeInTheDocument();
+    const configureButton = screen.getByRole('button', {
+      name: 'Configure Linear',
+    });
+    expect(configureButton).toBeInTheDocument();
+    expect(configureButton).not.toHaveTextContent('Configure');
+    expect(
+      screen.getByRole('button', { name: 'Connect Linear' }),
+    ).toBeInTheDocument();
+    expect(
+      screen
+        .getByRole('button', { name: 'Connect Linear' })
+        .querySelector('[data-icon="plus"]'),
+    ).toBeInTheDocument();
+  });
+
+  it('does not offer Linear credential configuration to non-admins', () => {
+    state.isAdmin = false;
+
+    render(<Integrations />);
+
+    expect(
+      screen.queryByRole('button', { name: 'Configure Linear' }),
+    ).not.toBeInTheDocument();
+  });
+
+  it('removes saved Linear credentials after confirmation', () => {
+    state.linearInstallation = null;
+    state.linearOauthSetup.fields = {
+      clientId: {
+        configured: true,
+        managedByEnvironment: false,
+        savedInRoomote: true,
+      },
+      clientSecret: {
+        configured: true,
+        managedByEnvironment: false,
+        savedInRoomote: true,
+      },
+      webhookSecret: {
+        configured: true,
+        managedByEnvironment: false,
+        savedInRoomote: true,
+      },
+    };
+    mutations.removeLinearOauthSetup.mockImplementation((_variables, options) =>
+      options?.onSuccess?.({ success: true }),
+    );
+
+    render(<Integrations />);
+    fireEvent.click(screen.getByRole('button', { name: 'Configure Linear' }));
+
+    expect(
+      screen.getByRole('heading', { name: 'Configure Linear' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('heading', { name: 'Update the app credentials.' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Open Linear app creation' }),
+    ).not.toBeInTheDocument();
+    fireEvent.click(
+      screen.getByRole('button', { name: 'Remove saved credentials' }),
+    );
+    expect(
+      screen.getByRole('heading', {
+        name: 'Remove saved Linear credentials?',
+      }),
+    ).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Remove credentials' }));
+
+    expect(mutations.removeLinearOauthSetup).toHaveBeenCalled();
+    expect(toast.success).toHaveBeenCalledWith(
+      'Saved Linear OAuth credentials removed.',
+    );
+  });
+
+  it('does not offer to remove environment-managed Linear credentials', () => {
+    state.linearInstallation = null;
+    state.linearOauthSetup.fields = {
+      clientId: {
+        configured: true,
+        managedByEnvironment: true,
+        savedInRoomote: false,
+      },
+      clientSecret: {
+        configured: true,
+        managedByEnvironment: true,
+        savedInRoomote: false,
+      },
+      webhookSecret: {
+        configured: true,
+        managedByEnvironment: true,
+        savedInRoomote: false,
+      },
+    };
+
+    render(<Integrations />);
+    fireEvent.click(screen.getByRole('button', { name: 'Configure Linear' }));
+
+    expect(
+      screen.queryByRole('button', { name: 'Remove saved credentials' }),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.getAllByText('Managed by the deployment environment.'),
+    ).toHaveLength(3);
+  });
+
+  it('offers setup for a legacy workspace when deployment credentials are missing', () => {
+    state.linearInstallation = { linearOrganizationName: 'Legacy workspace' };
+    state.oauthReadiness = [{ mcpId: 'linear', status: 'missing' }];
+
+    render(<Integrations />);
+
+    expect(
+      screen.getByRole('button', { name: 'Set up Linear' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Disable Linear' }),
+    ).not.toBeInTheDocument();
+  });
+
+  it('lets administrators reconnect a configured Linear workspace', () => {
+    render(<Integrations />);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Reconnect Linear' }));
+
+    expect(mutations.connectLinear).toHaveBeenCalledWith(
+      undefined,
+      expect.objectContaining({
+        onSuccess: expect.any(Function),
+        onError: expect.any(Function),
+      }),
+    );
+  });
+
+  it('surfaces the server error when starting Linear fails', () => {
+    state.linearInstallation = null;
+    mutations.connectLinear.mockImplementation((_variables, options) => {
+      options?.onError?.(new Error('Linear OAuth setup changed. Try again.'));
+    });
+
+    render(<Integrations />);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Connect Linear' }));
+
+    expect(toast.error).toHaveBeenCalledWith(
+      'Linear OAuth setup changed. Try again.',
+    );
+  });
+
+  it('sorts integrations alphabetically and splits enabled, configured, and available', () => {
     const sorted = sortIntegrationItems([
       { id: 'sentry', name: 'Sentry', enabled: false },
       { id: 'linear', name: 'Linear', enabled: true },
-      { id: 'notion', name: 'Notion', enabled: false },
+      { id: 'notion', name: 'Notion', enabled: false, configured: true },
       { id: 'asana', name: 'Asana', enabled: false },
     ]);
     const grouped = splitIntegrationItems(sorted);
 
     expect(grouped.installed.map((item) => item.name)).toEqual(['Linear']);
+    expect(grouped.configured.map((item) => item.name)).toEqual(['Notion']);
     expect(grouped.available.map((item) => item.name)).toEqual([
       'Asana',
-      'Notion',
       'Sentry',
     ]);
   });
 
+  it('shows configured integrations separately and an empty connected state', () => {
+    state.linearInstallation = null;
+
+    render(<Integrations />);
+
+    const connectedSection = screen
+      .getByRole('heading', { name: 'Connected' })
+      .closest('section');
+    const configuredSection = screen
+      .getByRole('heading', { name: 'Configured' })
+      .closest('section');
+
+    expect(connectedSection).toHaveTextContent(
+      "You haven't connected any integrations yet.",
+    );
+    expect(
+      within(configuredSection as HTMLElement).getByRole('heading', {
+        name: 'Linear',
+      }),
+    ).toBeInTheDocument();
+  });
+
   it('highlights a selected integration above alphabetical order', () => {
     const sorted = sortIntegrationItems(
       [
@@ -433,21 +771,23 @@ describe('Integrations settings', () => {
     ]);
   });
 
-  it('renders enabled and available sections with compact action buttons', () => {
+  it('renders connected and available sections with compact action buttons', () => {
     render(<Integrations />);
 
-    const enabledSection = screen
-      .getByRole('heading', { name: 'Enabled' })
+    const connectedSection = screen
+      .getByRole('heading', { name: 'Connected' })
       .closest('section');
     const availableSection = screen
       .getByRole('heading', { name: 'Available' })
       .closest('section');
-
-    expect(enabledSection).not.toBeNull();
+    expect(connectedSection).not.toBeNull();
     expect(availableSection).not.toBeNull();
+    expect(
+      screen.queryByRole('heading', { name: 'Configured' }),
+    ).not.toBeInTheDocument();
 
     expect(
-      within(enabledSection as HTMLElement)
+      within(connectedSection as HTMLElement)
         .getAllByRole('heading', { level: 3 })
         .map((heading) => heading.textContent),
     ).toEqual(['Linear']);
diff --git a/apps/web/src/components/settings/Integrations.tsx b/apps/web/src/components/settings/Integrations.tsx
index 79924a5d0..ab6e5bd5e 100644
--- a/apps/web/src/components/settings/Integrations.tsx
+++ b/apps/web/src/components/settings/Integrations.tsx
@@ -2,7 +2,6 @@
 
 import type { FormEvent, ReactNode } from 'react';
 import { useEffect, useMemo, useState } from 'react';
-import Link from 'next/link';
 import { usePathname, useSearchParams } from 'next/navigation';
 import { toast } from 'sonner';
 
@@ -17,6 +16,7 @@ import {
   useConnectLinear,
   useDisconnectLinear,
   useLinearInstallation,
+  useLinearOauthSetup,
 } from '@/hooks/linear';
 import {
   useAsanaConnection,
@@ -24,6 +24,7 @@ import {
   useDisconnectMcp,
   useGrafanaConnection,
   useDeploymentMcpEnablements,
+  useMcpOauthReadiness,
   useSaveAsanaConnection,
   useSaveGrafanaConnection,
   useSaveSnowflakeConnection,
@@ -34,7 +35,6 @@ import {
   useVercelConnection,
 } from '@/hooks/mcp-connections';
 import { useAuthorizedUser } from '@/hooks/useUser';
-import { SETTINGS_PATHS } from '@/lib/settings';
 import {
   saveAsanaConnectionSchema,
   saveGrafanaConnectionSchema,
@@ -43,8 +43,6 @@ import {
 } from '@/types';
 
 import {
-  Alert,
-  AlertDescription,
   BasicTooltip,
   Button,
   Card,
@@ -75,6 +73,7 @@ import {
 } from '@/components/system';
 import { McpToolManagementDialog } from './McpToolManagementDialog';
 import { McpIcon } from './McpIcon';
+import { LinearOauthSetupDialog } from './LinearOauthSetupDialog';
 
 const DEEP_LINK_ENABLE_DESCRIPTIONS: Record<string, string> = {
   asana:
@@ -114,6 +113,8 @@ type IntegrationItem = {
   description: string;
   icon: ReactNode;
   enabled: boolean;
+  configured?: boolean;
+  needsConfiguration?: boolean;
   isMcpBased: boolean;
   onAction?: () => void;
   isPending: boolean;
@@ -144,8 +145,21 @@ type IntegrationItem = {
   highlighted?: boolean;
 };
 
+type OauthReadinessStatus = 'ready' | 'missing' | 'partial';
+
 type McpIntegrationDefinition = (typeof MCP_INTEGRATIONS)[number];
 
+function getLinearOauthSetupStatus(
+  status: Exclude<OauthReadinessStatus, 'ready'>,
+  isAdmin: boolean,
+): ReactNode {
+  if (!isAdmin) {
+    return 'Not configured. Ask an administrator to set it up.';
+  }
+
+  return status === 'partial' ? 'Configuration incomplete.' : null;
+}
+
 type AdminConfiguredIntegrationItemOptions = {
   integration: McpIntegrationDefinition;
   connection?: { authStatus?: string | null };
@@ -355,12 +369,13 @@ export function sortIntegrationItems<T extends { id: string; name: string }>(
   });
 }
 
-export function splitIntegrationItems<T extends { enabled: boolean }>(
-  items: T[],
-) {
+export function splitIntegrationItems<
+  T extends { enabled: boolean; configured?: boolean },
+>(items: T[]) {
   return {
     installed: items.filter((item) => item.enabled),
-    available: items.filter((item) => !item.enabled),
+    configured: items.filter((item) => !item.enabled && item.configured),
+    available: items.filter((item) => !item.enabled && !item.configured),
   };
 }
 
@@ -508,6 +523,8 @@ function IntegrationCard({ item }: { item: IntegrationItem }) {
                   >
                     {item.isPending ? (
                       <Spinner size="sm" />
+                    ) : item.needsConfiguration ? (
+                      <Settings2 />
                     ) : item.enabled ? (
                       <X />
                     ) : (
@@ -522,7 +539,7 @@ function IntegrationCard({ item }: { item: IntegrationItem }) {
       </CardHeader>
 
       {item.status || footerActions.length > 0 ? (
-        <CardContent className="p-">
+        <CardContent>
           <div className="flex gap-3 p-0">
             <div
               className={`mt-0.5 ${iconColumnWidthClass} shrink-0`}
@@ -540,7 +557,7 @@ function IntegrationCard({ item }: { item: IntegrationItem }) {
                 </div>
               )}
               {footerActions.length > 0 ? (
-                <div className="flex gap-2">
+                <div className="-ml-4 flex gap-2">
                   {footerActions.map((action) => (
                     <Button
                       key={action.ariaLabel}
@@ -569,10 +586,12 @@ function IntegrationSection({
   id,
   title,
   items,
+  emptyState,
 }: {
   id: string;
   title: string;
   items: IntegrationItem[];
+  emptyState?: ReactNode;
 }) {
   return (
     <section aria-labelledby={id} className="space-y-3">
@@ -580,11 +599,15 @@ function IntegrationSection({
         {title}
       </h2>
 
-      <div className="grid gap-4 md:grid-cols-2">
-        {items.map((item) => (
-          <IntegrationCard key={item.id} item={item} />
-        ))}
-      </div>
+      {items.length > 0 ? (
+        <div className="grid gap-4 md:grid-cols-2">
+          {items.map((item) => (
+            <IntegrationCard key={item.id} item={item} />
+          ))}
+        </div>
+      ) : (
+        emptyState
+      )}
     </section>
   );
 }
@@ -1116,12 +1139,22 @@ export function Integrations() {
     mcpId: string;
     integrationName: string;
   } | null>(null);
+  const [isLinearOauthSetupOpen, setIsLinearOauthSetupOpen] = useState(false);
 
   const linearInstallation = useLinearInstallation();
   const connectLinear = useConnectLinear(`${pathname}?service=linear`);
   const disconnectLinear = useDisconnectLinear();
 
   const deploymentEnablements = useDeploymentMcpEnablements();
+  const oauthReadiness = useMcpOauthReadiness();
+  const linearOauthStatus = oauthReadiness.data?.find(
+    (entry) => entry.mcpId === 'linear',
+  )?.status;
+  const linearOauthUnavailable =
+    linearOauthStatus === 'missing' || linearOauthStatus === 'partial';
+  const linearOauthSetup = useLinearOauthSetup(
+    isAdmin && (linearOauthUnavailable || isLinearOauthSetupOpen),
+  );
   const setDeploymentEnabled = useSetDeploymentMcpEnabled();
   const userMcpConnections = useUserMcpConnections();
   const connectMcp = useConnectMcp();
@@ -1263,6 +1296,23 @@ export function Integrations() {
     const userConnectionMap = new Map(
       (userMcpConnections.data ?? []).map((entry) => [entry.mcpId, entry]),
     );
+    const canSetUpLinearOauth = isAdmin && linearOauthUnavailable;
+    const canConfigureLinearOauth = isAdmin && !linearOauthUnavailable;
+    const canReconnectLinear =
+      isAdmin && Boolean(linearInstallation.data) && !linearOauthUnavailable;
+    const startLinearConnection = () => {
+      connectLinear.mutate(undefined, {
+        onSuccess: (url) => {
+          window.location.href = url;
+        },
+        onError: (error) =>
+          toast.error(
+            error instanceof Error
+              ? error.message
+              : 'Failed to enable Linear. Please try again.',
+          ),
+      });
+    };
     const openMcpToolDialog = (integration: McpIntegrationDefinition) =>
       setToolDialogState({
         mcpId: integration.id,
@@ -1296,32 +1346,67 @@ export function Integrations() {
         description:
           'Enable Linear so this deployment can route issue context and task entry through it.',
         icon: <LinearLogo className="size-5" />,
-        enabled: Boolean(linearInstallation.data),
+        enabled: Boolean(linearInstallation.data) && !linearOauthUnavailable,
+        configured: linearOauthStatus === 'ready',
+        needsConfiguration: linearOauthUnavailable,
         highlighted: highlightedIntegrationId === 'linear',
         isMcpBased: false,
         isPending:
           linearInstallation.isPending ||
+          (!linearInstallation.data && oauthReadiness.isPending) ||
           connectLinear.isPending ||
           disconnectLinear.isPending,
-        onAction: () => {
-          if (linearInstallation.data) {
-            disconnectLinear.mutate(undefined, {
-              onSuccess: () =>
-                toast.success('Linear disabled for this deployment.'),
-              onError: () =>
-                toast.error('Failed to disable Linear. Please try again.'),
-            });
-            return;
-          }
+        status: linearOauthUnavailable
+          ? getLinearOauthSetupStatus(linearOauthStatus, isAdmin)
+          : undefined,
+        statusIcon: linearOauthUnavailable ? (
+          <TriangleAlert className="size-4" />
+        ) : undefined,
+        actionLabel:
+          linearOauthUnavailable && canSetUpLinearOauth
+            ? 'Set up Linear'
+            : !linearInstallation.data && linearOauthStatus === 'ready'
+              ? 'Connect Linear'
+              : undefined,
+        headerAction: canReconnectLinear
+          ? {
+              label: 'Reconnect',
+              ariaLabel: 'Reconnect Linear',
+              onAction: startLinearConnection,
+              isPending: connectLinear.isPending,
+              icon: <RefreshCw />,
+            }
+          : undefined,
+        utilityAction: canConfigureLinearOauth
+          ? {
+              label: 'Configure credentials',
+              ariaLabel: 'Configure Linear',
+              onAction: () => setIsLinearOauthSetupOpen(true),
+              isPending: isLinearOauthSetupOpen && linearOauthSetup.isPending,
+              icon: <Settings2 />,
+            }
+          : undefined,
+        onAction: linearOauthUnavailable
+          ? canSetUpLinearOauth
+            ? () => setIsLinearOauthSetupOpen(true)
+            : undefined
+          : () => {
+              if (linearInstallation.data) {
+                disconnectLinear.mutate(undefined, {
+                  onSuccess: () =>
+                    toast.success('Linear disabled for this deployment.'),
+                  onError: (error) =>
+                    toast.error(
+                      error instanceof Error
+                        ? error.message
+                        : 'Failed to disable Linear. Please try again.',
+                    ),
+                });
+                return;
+              }
 
-          connectLinear.mutate(undefined, {
-            onSuccess: (url) => {
-              window.location.href = url;
+              startLinearConnection();
             },
-            onError: () =>
-              toast.error('Failed to enable Linear. Please try again.'),
-          });
-        },
       },
       ...visibleMcpIntegrations
         .filter((integration) => {
@@ -1558,8 +1643,13 @@ export function Integrations() {
     grafanaConnection.isPending,
     linearInstallation.data,
     linearInstallation.isPending,
+    linearOauthSetup.isPending,
+    linearOauthStatus,
+    linearOauthUnavailable,
+    oauthReadiness.isPending,
     isAdmin,
     isGrafanaDialogOpen,
+    isLinearOauthSetupOpen,
     saveAsanaConnection.isPending,
     saveGrafanaConnection.isPending,
     saveVercelConnection.isPending,
@@ -1577,13 +1667,7 @@ export function Integrations() {
     userMcpConnections.data,
   ]);
 
-  const { installed, available } = splitIntegrationItems(items);
-  const visibleMcpIntegrationIds = new Set(
-    MCP_INTEGRATIONS.map((integration) => integration.id),
-  );
-  const hasEnabledMcpIntegration = (deploymentEnablements.data ?? []).some(
-    (entry) => entry.enabled && visibleMcpIntegrationIds.has(entry.mcpId),
-  );
+  const { installed, configured, available } = splitIntegrationItems(items);
   const highlightedItem =
     items.find((item) => item.id === highlightedIntegrationId) ?? null;
   const deepLinkDialogItem =
@@ -1914,6 +1998,11 @@ export function Integrations() {
           }
         }}
       />
+      <LinearOauthSetupDialog
+        open={isLinearOauthSetupOpen}
+        onOpenChange={setIsLinearOauthSetupOpen}
+        setup={linearOauthSetup.data}
+      />
       <AdminConfiguredIntegrationDialog
         integrationName="Asana"
         open={isAsanaDialogOpen}
@@ -2022,28 +2111,23 @@ export function Integrations() {
           deepLinkDialogItem.onAction?.();
         }}
       />
-      {hasEnabledMcpIntegration ? (
-        <Alert variant="light">
-          <Info />
-          <AlertDescription>
-            <p>
-              User-linked MCP integrations appear in{' '}
-              <Link
-                href={SETTINGS_PATHS.personal}
-                className="inline text-primary underline hover:no-underline"
-              >
-                personal settings.
-              </Link>{' '}
-              Workspace-scoped integrations connect and turn on from this page.
-            </p>
-          </AlertDescription>
-        </Alert>
-      ) : null}
       <IntegrationSection
         id="installed-integrations"
-        title="Enabled"
+        title="Connected"
         items={installed}
+        emptyState={
+          <p className="text-sm text-muted-foreground">
+            You haven&apos;t connected any integrations yet.
+          </p>
+        }
       />
+      {configured.length > 0 && (
+        <IntegrationSection
+          id="configured-integrations"
+          title="Configured"
+          items={configured}
+        />
+      )}
       <IntegrationSection
         id="available-integrations"
         title="Available"
diff --git a/apps/web/src/components/settings/LinearOauthSetupDialog.tsx b/apps/web/src/components/settings/LinearOauthSetupDialog.tsx
new file mode 100644
index 000000000..015504b98
--- /dev/null
+++ b/apps/web/src/components/settings/LinearOauthSetupDialog.tsx
@@ -0,0 +1,373 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import Link from 'next/link';
+import { toast } from 'sonner';
+
+import { DOCS_LINEAR_INTEGRATION_URL } from '@/lib/docs';
+import {
+  useRemoveLinearOauthSetup,
+  useSaveLinearOauthSetup,
+} from '@/hooks/linear';
+import {
+  Alert,
+  AlertDescription,
+  Button,
+  Check,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  ExternalLink,
+  Input,
+  Label,
+  Skeleton,
+  Spinner,
+  Trash,
+  TriangleAlert,
+} from '@/components/system';
+import { NumberedStep } from '@/app/(onboarding)/setup/NumberedStep';
+
+type SetupFieldStatus = {
+  configured: boolean;
+  managedByEnvironment: boolean;
+  savedInRoomote: boolean;
+};
+
+type LinearOauthSetupDetails = {
+  callbackUrl: string;
+  webhookUrl: string;
+  manifestUrl: string;
+  fields: {
+    clientId: SetupFieldStatus;
+    clientSecret: SetupFieldStatus;
+    webhookSecret: SetupFieldStatus;
+  };
+};
+
+type LinearOauthForm = {
+  clientId: string;
+  clientSecret: string;
+  webhookSecret: string;
+};
+
+const EMPTY_FORM: LinearOauthForm = {
+  clientId: '',
+  clientSecret: '',
+  webhookSecret: '',
+};
+
+function CredentialField({
+  id,
+  label,
+  value,
+  status,
+  secret = false,
+  onChange,
+}: {
+  id: string;
+  label: string;
+  value: string;
+  status: SetupFieldStatus;
+  secret?: boolean;
+  onChange: (value: string) => void;
+}) {
+  const helperText = status.managedByEnvironment
+    ? status.savedInRoomote
+      ? 'Managed by the deployment environment. A saved fallback is also stored in Roomote.'
+      : 'Managed by the deployment environment.'
+    : null;
+
+  return (
+    <div className="space-y-1.5">
+      <div className="grid gap-2 md:grid-cols-[170px_minmax(0,1fr)] md:items-center max-w-xl">
+        <Label className="text-sm font-medium" htmlFor={id}>
+          {label}
+        </Label>
+        <Input
+          id={id}
+          secret={secret && !status.managedByEnvironment ? true : undefined}
+          className="font-mono"
+          value={status.managedByEnvironment ? '' : value}
+          placeholder={
+            status.managedByEnvironment
+              ? 'Managed by environment'
+              : status.configured
+                ? 'Saved'
+                : undefined
+          }
+          disabled={status.managedByEnvironment}
+          onChange={(event) => onChange(event.target.value)}
+          autoCapitalize="off"
+          autoCorrect="off"
+          spellCheck={false}
+        />
+      </div>
+      <p className="text-xs text-muted-foreground">{helperText}</p>
+    </div>
+  );
+}
+
+export function LinearOauthSetupDialog({
+  open,
+  onOpenChange,
+  setup,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  setup: LinearOauthSetupDetails | undefined;
+}) {
+  const [form, setForm] = useState<LinearOauthForm>(EMPTY_FORM);
+  const [formError, setFormError] = useState<string | null>(null);
+  const [removeConfirmationOpen, setRemoveConfirmationOpen] = useState(false);
+  const saveSetup = useSaveLinearOauthSetup();
+  const removeSetup = useRemoveLinearOauthSetup();
+
+  useEffect(() => {
+    if (open) {
+      setForm(EMPTY_FORM);
+      setFormError(null);
+      setRemoveConfirmationOpen(false);
+    }
+  }, [open]);
+
+  const updateField = (field: keyof LinearOauthForm, value: string) => {
+    setForm((current) => ({ ...current, [field]: value }));
+    setFormError(null);
+  };
+
+  const save = () => {
+    saveSetup.mutate(form, {
+      onSuccess: (result) => {
+        toast.success(
+          result.requiresReconnect
+            ? 'Linear OAuth credentials saved. Enable Linear to reconnect the workspace.'
+            : 'Linear OAuth credentials saved.',
+        );
+        onOpenChange(false);
+      },
+      onError: (error) => {
+        setFormError(
+          error instanceof Error
+            ? error.message
+            : 'Failed to save Linear OAuth credentials.',
+        );
+      },
+    });
+  };
+
+  const publicUrlUsesHttps = setup?.webhookUrl.startsWith('https://') ?? true;
+  const fieldStatuses = setup ? Object.values(setup.fields) : [];
+  const hasConfiguredCredentials = fieldStatuses.some(
+    (field) => field.configured,
+  );
+  const hasSavedCredentials = fieldStatuses.some(
+    (field) => field.savedInRoomote,
+  );
+
+  const remove = () => {
+    removeSetup.mutate(undefined, {
+      onSuccess: () => {
+        toast.success('Saved Linear OAuth credentials removed.');
+        setRemoveConfirmationOpen(false);
+        onOpenChange(false);
+      },
+      onError: (error) => {
+        toast.error(
+          error instanceof Error
+            ? error.message
+            : 'Failed to remove saved Linear OAuth credentials.',
+        );
+      },
+    });
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent size={removeConfirmationOpen ? 'sm' : '2xl'}>
+        {removeConfirmationOpen ? (
+          <>
+            <DialogHeader>
+              <DialogTitle>Remove saved Linear credentials?</DialogTitle>
+              <DialogDescription>
+                This disables Linear and removes credentials stored by Roomote.
+                It does not delete the app in Linear or change credentials
+                managed by the deployment environment.
+              </DialogDescription>
+            </DialogHeader>
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => setRemoveConfirmationOpen(false)}
+              >
+                Cancel
+              </Button>
+              <Button
+                type="button"
+                variant="destructive"
+                disabled={removeSetup.isPending}
+                onClick={remove}
+              >
+                {removeSetup.isPending ? <Spinner size="sm" /> : null}
+                Remove credentials
+              </Button>
+            </DialogFooter>
+          </>
+        ) : (
+          <>
+            <DialogHeader>
+              <DialogTitle>
+                {hasConfiguredCredentials
+                  ? 'Configure Linear'
+                  : 'Set up Linear'}
+              </DialogTitle>
+              <DialogDescription>
+                {hasConfiguredCredentials
+                  ? 'Update the Linear app credentials saved for this deployment.'
+                  : "Roomote is self-hosted, so we need you to create a Linear app for this deployment. It's easy."}
+              </DialogDescription>
+            </DialogHeader>
+
+            {!setup ? (
+              <div className="space-y-4 py-2">
+                <Skeleton className="h-20 w-full" />
+                <Skeleton className="h-32 w-full" />
+              </div>
+            ) : (
+              <div className="space-y-6 py-2">
+                {!hasConfiguredCredentials && !publicUrlUsesHttps ? (
+                  <Alert variant="destructive">
+                    <TriangleAlert className="size-4" />
+                    <AlertDescription>
+                      Linear requires a public HTTPS webhook URL. Configure
+                      R_PUBLIC_URL with your deployment&apos;s HTTPS address
+                      before creating the app.
+                    </AlertDescription>
+                  </Alert>
+                ) : null}
+
+                {!hasConfiguredCredentials ? (
+                  <NumberedStep number={1}>
+                    <div>
+                      <h3 className="font-medium">Create a Linear app.</h3>
+                      <p className="text-sm text-muted-foreground mb-2">
+                        Roomote uses a dedicated Linear app for this deployment.
+                        Log into Linear, use the pre-filled manifest, review the
+                        settings in Linear, then create the app.
+                      </p>
+                    </div>
+                    <Button
+                      type="button"
+                      variant="outline"
+                      size="sm"
+                      disabled={!publicUrlUsesHttps}
+                      onClick={() =>
+                        window.open(
+                          setup.manifestUrl,
+                          '_blank',
+                          'noopener,noreferrer',
+                        )
+                      }
+                    >
+                      Create the app
+                      <ExternalLink />
+                    </Button>
+                  </NumberedStep>
+                ) : null}
+
+                <NumberedStep number={hasConfiguredCredentials ? -1 : 2}>
+                  <div>
+                    <h3 className="font-medium">
+                      {hasConfiguredCredentials
+                        ? 'Update the app credentials.'
+                        : 'Copy the app credentials.'}
+                    </h3>
+                    <p className="text-sm text-muted-foreground">
+                      {hasConfiguredCredentials
+                        ? 'Paste updated values from your Linear app. Leave a saved value blank to keep it.'
+                        : "After saving, from the new app's settings, copy the values below."}
+                    </p>
+                  </div>
+                  <div className="grid gap-2">
+                    <CredentialField
+                      id="linear-client-id"
+                      label="Client ID"
+                      value={form.clientId}
+                      status={setup.fields.clientId}
+                      onChange={(value) => updateField('clientId', value)}
+                    />
+                    <CredentialField
+                      id="linear-client-secret"
+                      label="Client secret"
+                      value={form.clientSecret}
+                      status={setup.fields.clientSecret}
+                      secret
+                      onChange={(value) => updateField('clientSecret', value)}
+                    />
+                    <CredentialField
+                      id="linear-webhook-secret"
+                      label="Webhook signing secret"
+                      value={form.webhookSecret}
+                      status={setup.fields.webhookSecret}
+                      secret
+                      onChange={(value) => updateField('webhookSecret', value)}
+                    />
+                  </div>
+                  {formError ? (
+                    <p className="text-sm text-destructive">{formError}</p>
+                  ) : null}
+                </NumberedStep>
+              </div>
+            )}
+
+            <DialogFooter className="gap-2 justify-between">
+              <div className="flex flex-wrap gap-2 just">
+                {hasSavedCredentials ? (
+                  <Button
+                    type="button"
+                    variant="destructive"
+                    onClick={() => setRemoveConfirmationOpen(true)}
+                  >
+                    <Trash />
+                    Remove saved credentials
+                  </Button>
+                ) : (
+                  <Button variant="ghost" size="sm" asChild>
+                    <Link
+                      href={DOCS_LINEAR_INTEGRATION_URL}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                    >
+                      Setup guide
+                      <ExternalLink />
+                    </Link>
+                  </Button>
+                )}
+              </div>
+              <div className="flex justify-end gap-2 ml-auto">
+                <Button
+                  type="button"
+                  variant="outline"
+                  onClick={() => onOpenChange(false)}
+                >
+                  Cancel
+                </Button>
+                <Button
+                  type="button"
+                  disabled={!setup || saveSetup.isPending}
+                  onClick={save}
+                >
+                  {saveSetup.isPending ? <Spinner size="sm" /> : <Check />}
+                  Finish
+                </Button>
+              </div>
+            </DialogFooter>
+          </>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/apps/web/src/components/settings/UsersSettings.client.test.tsx b/apps/web/src/components/settings/UsersSettings.client.test.tsx
index 54bae7b51..63819abd7 100644
--- a/apps/web/src/components/settings/UsersSettings.client.test.tsx
+++ b/apps/web/src/components/settings/UsersSettings.client.test.tsx
@@ -67,6 +67,7 @@ function createDeferred<T>() {
 }
 
 const {
+  mockAuthorizedUser,
   mockSettingsState,
   mockCreateInvite,
   mockRevokeInvite,
@@ -76,6 +77,9 @@ const {
   mockSetLicenseKey,
   mockClipboardWriteText,
 } = vi.hoisted(() => ({
+  mockAuthorizedUser: {
+    current: { userId: 'user-1', cloudEnabled: false },
+  },
   mockSettingsState: {
     current: {
       slackTeamId: null as string | null,
@@ -162,7 +166,7 @@ vi.mock('sonner', () => ({
 }));
 
 vi.mock('@/hooks/useUser', () => ({
-  useAuthorizedUser: () => ({ userId: 'user-1' }),
+  useAuthorizedUser: () => mockAuthorizedUser.current,
 }));
 
 vi.mock('@/trpc/client', () => ({
@@ -241,6 +245,7 @@ describe('UsersSettings', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockClipboardWriteText.mockResolvedValue(undefined);
+    mockAuthorizedUser.current = { userId: 'user-1', cloudEnabled: false };
     mockSettingsState.current = {
       slackTeamId: null,
       hasSlackSignIn: false,
@@ -641,6 +646,17 @@ describe('UsersSettings', () => {
     expect(toast.success).toHaveBeenCalledWith('License key saved.');
   });
 
+  it('hides the license section for cloud-enabled deployments', async () => {
+    mockAuthorizedUser.current = { userId: 'user-1', cloudEnabled: true };
+
+    renderUsersSettings();
+
+    expect(await screen.findByText('Invites')).toBeInTheDocument();
+    expect(screen.getByText('Users')).toBeInTheDocument();
+    expect(screen.queryByText('License')).not.toBeInTheDocument();
+    expect(screen.queryByLabelText('License key')).not.toBeInTheDocument();
+  });
+
   it('shows licensed state, at-limit warning, and removes the key', async () => {
     mockSettingsState.current = {
       ...mockSettingsState.current,
diff --git a/apps/web/src/components/settings/UsersSettings.tsx b/apps/web/src/components/settings/UsersSettings.tsx
index 3e4860b1d..3aa58240b 100644
--- a/apps/web/src/components/settings/UsersSettings.tsx
+++ b/apps/web/src/components/settings/UsersSettings.tsx
@@ -71,7 +71,7 @@ function formatRelative(value: Date | string | null): string {
 export function UsersSettings() {
   const trpc = useTRPC();
   const queryClient = useQueryClient();
-  const { userId: currentUserId } = useAuthorizedUser();
+  const { userId: currentUserId, cloudEnabled } = useAuthorizedUser();
   const settingsQueryKey = trpc.accessPolicy.get.queryKey();
   const settingsQuery = useQuery(trpc.accessPolicy.get.queryOptions());
   const [label, setLabel] = useState('');
@@ -289,88 +289,90 @@ export function UsersSettings() {
 
   return (
     <div className="space-y-6">
-      <Section icon={ScrollText} title="License">
-        <div className="space-y-4">
-          <div className="flex items-center gap-2 text-sm">
-            {licenseBadge}
-            <p>
-              {license.seatsUsed} of {license.seatLimit} seats used
-              {license.licensee ? (
-                <span className="text-muted-foreground">
-                  {' '}
-                  · Licensed to {license.licensee}
-                  {license.expiresAt
-                    ? ` · Expires ${formatJoinedDate(license.expiresAt)}`
-                    : ''}
-                </span>
-              ) : null}
-            </p>
-          </div>
-
-          {seatsRemaining <= 0 ? (
-            <div className="flex items-start gap-2 rounded-lg border border-destructive/30 bg-destructive/5 p-3 text-sm text-destructive">
-              <AlertCircle className="mt-0.5 size-4 shrink-0" />
+      {cloudEnabled ? null : (
+        <Section icon={ScrollText} title="License">
+          <div className="space-y-4">
+            <div className="flex items-center gap-2 text-sm">
+              {licenseBadge}
               <p>
-                All seats are in use. New users cannot sign in until a seat is
-                freed or a license key with more seats is added.
+                {license.seatsUsed} of {license.seatLimit} seats used
+                {license.licensee ? (
+                  <span className="text-muted-foreground">
+                    {' '}
+                    · Licensed to {license.licensee}
+                    {license.expiresAt
+                      ? ` · Expires ${formatJoinedDate(license.expiresAt)}`
+                      : ''}
+                  </span>
+                ) : null}
               </p>
             </div>
-          ) : seatsRemaining === 1 ? (
-            <p className="text-sm text-muted-foreground">
-              One seat remaining. Add a license key to raise the limit before
-              inviting more users.
-            </p>
-          ) : null}
 
-          {license.fromEnv ? (
-            <p className="text-sm text-muted-foreground">
-              License key is provided by the{' '}
-              <span className="font-mono">R_LICENSE_KEY</span> environment
-              variable. Update or remove that env var and restart the deployment
-              to change it.
-            </p>
-          ) : (
-            <form
-              className="flex flex-col gap-3 md:flex-row md:items-end items-start max-w-2xl"
-              onSubmit={handleSaveLicenseKey}
-            >
-              <div className="flex-1 space-y-2">
-                <Label htmlFor="license-key">License key</Label>
-                <Input
-                  id="license-key"
-                  value={licenseKeyInput}
-                  placeholder="RMLK1.…"
-                  onChange={(event) => setLicenseKeyInput(event.target.value)}
-                  disabled={setLicenseKey.isPending}
-                />
+            {seatsRemaining <= 0 ? (
+              <div className="flex items-start gap-2 rounded-lg border border-destructive/30 bg-destructive/5 p-3 text-sm text-destructive">
+                <AlertCircle className="mt-0.5 size-4 shrink-0" />
+                <p>
+                  All seats are in use. New users cannot sign in until a seat is
+                  freed or a license key with more seats is added.
+                </p>
               </div>
-              <Button
-                type="submit"
-                disabled={setLicenseKey.isPending || !licenseKeyInput.trim()}
+            ) : seatsRemaining === 1 ? (
+              <p className="text-sm text-muted-foreground">
+                One seat remaining. Add a license key to raise the limit before
+                inviting more users.
+              </p>
+            ) : null}
+
+            {license.fromEnv ? (
+              <p className="text-sm text-muted-foreground">
+                License key is provided by the{' '}
+                <span className="font-mono">R_LICENSE_KEY</span> environment
+                variable. Update or remove that env var and restart the
+                deployment to change it.
+              </p>
+            ) : (
+              <form
+                className="flex flex-col gap-3 md:flex-row md:items-end items-start max-w-2xl"
+                onSubmit={handleSaveLicenseKey}
               >
-                {setLicenseKey.isPending ? <Spinner /> : null}
-                Save key
-              </Button>
-              {license.status !== 'unlicensed' ? (
+                <div className="flex-1 space-y-2">
+                  <Label htmlFor="license-key">License key</Label>
+                  <Input
+                    id="license-key"
+                    value={licenseKeyInput}
+                    placeholder="RMLK1.…"
+                    onChange={(event) => setLicenseKeyInput(event.target.value)}
+                    disabled={setLicenseKey.isPending}
+                  />
+                </div>
                 <Button
-                  type="button"
-                  variant="outline"
-                  onClick={() => setLicenseKey.mutate({ licenseKey: null })}
-                  disabled={setLicenseKey.isPending}
+                  type="submit"
+                  disabled={setLicenseKey.isPending || !licenseKeyInput.trim()}
                 >
-                  Remove key
+                  {setLicenseKey.isPending ? <Spinner /> : null}
+                  Save key
                 </Button>
-              ) : null}
-            </form>
-          )}
-          <p className="text-sm text-muted-foreground">
-            Deployments are free for up to {license.freeSeatLimit} users. A
-            license key from the Roomote maintainers unlocks more seats. You can
-            also set <span className="font-mono">R_LICENSE_KEY</span> in the
-            deployment environment.
-          </p>
-        </div>
-      </Section>
+                {license.status !== 'unlicensed' ? (
+                  <Button
+                    type="button"
+                    variant="outline"
+                    onClick={() => setLicenseKey.mutate({ licenseKey: null })}
+                    disabled={setLicenseKey.isPending}
+                  >
+                    Remove key
+                  </Button>
+                ) : null}
+              </form>
+            )}
+            <p className="text-sm text-muted-foreground">
+              Deployments are free for up to {license.freeSeatLimit} users. A
+              license key from the Roomote maintainers unlocks more seats. You
+              can also set <span className="font-mono">R_LICENSE_KEY</span> in
+              the deployment environment.
+            </p>
+          </div>
+        </Section>
+      )}
 
       <Section icon={Mails} title="Invites">
         <div className="space-y-2">
diff --git a/apps/web/src/components/settings/environments/CreateEnvironmentPage.client.test.tsx b/apps/web/src/components/settings/environments/CreateEnvironmentPage.client.test.tsx
index dff32441c..a21e975bb 100644
--- a/apps/web/src/components/settings/environments/CreateEnvironmentPage.client.test.tsx
+++ b/apps/web/src/components/settings/environments/CreateEnvironmentPage.client.test.tsx
@@ -48,11 +48,23 @@ const {
   };
 });
 
+const { mockNavigationState, mockRepositoriesState, mockCreateRepoDialog } =
+  vi.hoisted(() => ({
+    mockNavigationState: { search: '' as string },
+    mockRepositoriesState: {
+      data: [
+        { id: 'repo-1', fullName: 'acme/api' },
+        { id: 'repo-2', fullName: 'acme/web' },
+      ] as Array<{ id: string; fullName: string; isEmpty?: boolean }>,
+    },
+    mockCreateRepoDialog: vi.fn(),
+  }));
+
 vi.mock('next/navigation', () => ({
   useRouter: () => ({
     push: mockRouterPush,
   }),
-  useSearchParams: () => new URLSearchParams(''),
+  useSearchParams: () => new URLSearchParams(mockNavigationState.search),
 }));
 
 vi.mock('sonner', () => ({
@@ -74,16 +86,7 @@ vi.mock('@/hooks/environments', () => ({
 
 vi.mock('@/hooks/source-control', () => ({
   useRepositories: () => ({
-    data: [
-      {
-        id: 'repo-1',
-        fullName: 'acme/api',
-      },
-      {
-        id: 'repo-2',
-        fullName: 'acme/web',
-      },
-    ],
+    data: mockRepositoriesState.data,
     isPending: false,
   }),
 }));
@@ -115,6 +118,21 @@ vi.mock('@/components/tasks', () => ({
   ),
 }));
 
+vi.mock('@/components/github/CreateGitHubRepoDialog', () => ({
+  CreateGitHubRepoDialog: (props: {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    onRepositoryDetected?: (repository: {
+      id: string;
+      fullName: string;
+      isEmpty?: boolean;
+    }) => void;
+  }) => {
+    mockCreateRepoDialog(props);
+    return props.open ? <div data-testid="create-repo-dialog" /> : null;
+  },
+}));
+
 vi.mock('@/trpc/client', () => ({
   useTRPC: () => ({
     environments: {
@@ -170,8 +188,8 @@ vi.mock('@/components/system', () => ({
   AlertDescription: ({
     children,
     ...props
-  }: { children: ReactNode } & HTMLAttributes<HTMLParagraphElement>) => (
-    <p {...props}>{children}</p>
+  }: { children: ReactNode } & HTMLAttributes<HTMLDivElement>) => (
+    <div {...props}>{children}</div>
   ),
   ArrowLeft: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   ArrowRight: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
@@ -244,7 +262,9 @@ vi.mock('@/components/system', () => ({
     <h2 {...props}>{children}</h2>
   ),
   HandMetal: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+  Info: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   Loader2: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
+  Plus: (props: SVGProps<SVGSVGElement>) => <svg {...props} />,
   ScrollArea: ({
     children,
     ...props
@@ -262,6 +282,78 @@ describe('CreateEnvironmentPage', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockYamlEditorState.reset();
+    mockNavigationState.search = '';
+    mockRepositoriesState.data = [
+      { id: 'repo-1', fullName: 'acme/api' },
+      { id: 'repo-2', fullName: 'acme/web' },
+    ];
+  });
+
+  it('renders the create-repo affordance and opens the dialog', () => {
+    const queryClient = new QueryClient();
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <CreateEnvironmentPage />
+      </QueryClientProvider>,
+    );
+
+    expect(screen.queryByTestId('create-repo-dialog')).not.toBeInTheDocument();
+
+    fireEvent.click(
+      screen.getByRole('button', { name: /Create a new repository/i }),
+    );
+
+    expect(screen.getByTestId('create-repo-dialog')).toBeInTheDocument();
+  });
+
+  it('opens the create-repo dialog from the create-repo search param', () => {
+    mockNavigationState.search = 'create-repo=1';
+    const queryClient = new QueryClient();
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <CreateEnvironmentPage />
+      </QueryClientProvider>,
+    );
+
+    expect(screen.getByTestId('create-repo-dialog')).toBeInTheDocument();
+  });
+
+  it('selects a detected repository and explains the empty-repo bootstrap', async () => {
+    mockRepositoriesState.data = [
+      { id: 'repo-1', fullName: 'acme/api' },
+      { id: 'repo-new', fullName: 'acme/new-repo', isEmpty: true },
+    ];
+    const queryClient = new QueryClient();
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <CreateEnvironmentPage />
+      </QueryClientProvider>,
+    );
+
+    const dialogProps = mockCreateRepoDialog.mock.calls.at(-1)?.[0] as {
+      onRepositoryDetected?: (repository: {
+        id: string;
+        fullName: string;
+        isEmpty?: boolean;
+      }) => void;
+    };
+
+    dialogProps.onRepositoryDetected?.({
+      id: 'repo-new',
+      fullName: 'acme/new-repo',
+      isEmpty: true,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByLabelText(/acme\/new-repo/i)).toBeChecked();
+    });
+    expect(
+      screen.getByText(/will push an initial commit and set up a basic/i),
+    ).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Start Agent' })).toBeEnabled();
   });
 
   it('starts an environment definition task and opens it in the task view', async () => {
@@ -277,10 +369,6 @@ describe('CreateEnvironmentPage', () => {
     fireEvent.change(screen.getByPlaceholderText(/Optional agent guidance/i), {
       target: { value: 'Use the API service from the first repo set.' },
     });
-    fireEvent.change(
-      screen.getByRole('combobox', { name: /environment setup model/i }),
-      { target: { value: 'openrouter/z-ai/glm-5.2' } },
-    );
 
     fireEvent.click(screen.getByRole('button', { name: 'Start Agent' }));
 
@@ -290,7 +378,7 @@ describe('CreateEnvironmentPage', () => {
     expect(mockStartDefinitionTask.mock.calls[0]?.[0]).toEqual({
       repositoryIds: ['repo-1'],
       changeRequest: 'Use the API service from the first repo set.',
-      selectedModelId: 'openrouter/z-ai/glm-5.2',
+      selectedModelId: 'openrouter/openai/gpt-5.4',
     });
     expect(mockRouterPush).toHaveBeenCalledWith('/task/task-1');
   });
diff --git a/apps/web/src/components/settings/environments/CreateEnvironmentPage.tsx b/apps/web/src/components/settings/environments/CreateEnvironmentPage.tsx
index 8f1bac21b..f344da4c1 100644
--- a/apps/web/src/components/settings/environments/CreateEnvironmentPage.tsx
+++ b/apps/web/src/components/settings/environments/CreateEnvironmentPage.tsx
@@ -16,6 +16,10 @@ import {
 } from '@/hooks/environments';
 import { useRepositories } from '@/hooks/source-control';
 import { useLaunchTaskModels } from '@/hooks/task-models/useLaunchTaskModels';
+import {
+  areAllRepositoriesEmpty,
+  getEmptyRepositories,
+} from '@/lib/repositories';
 import { useTRPC } from '@/trpc/client';
 import { ModelSelect } from '@/components/tasks';
 
@@ -28,10 +32,15 @@ import {
   Card,
   CardContent,
   HandMetal,
+  Info,
   Loader2,
   Textarea,
 } from '@/components/system';
 
+import {
+  CreateGitHubRepoDialog,
+  type DetectedRepository,
+} from '@/components/github/CreateGitHubRepoDialog';
 import { EnvironmentRepositorySelector } from './EnvironmentRepositorySelector';
 import { UpdateGitHubReposHint } from './UpdateGitHubReposHint';
 import {
@@ -61,10 +70,13 @@ export function CreateEnvironmentPage({
   const trpc = useTRPC();
   const editorRef = useRef<YamlEnvironmentEditorHandle>(null);
 
-  const repositories = useRepositories();
+  const repositories = useRepositories({ includeEmptyState: true });
   const createEnvironment = useCreateEnvironment();
   const validateConfig = useValidateEnvironmentConfig();
   const launchTaskModels = useLaunchTaskModels();
+  const [createRepoDialogOpen, setCreateRepoDialogOpen] = useState(
+    searchParams.get('create-repo') === '1',
+  );
 
   const [activeView, setActiveView] = useState<MasterView>(
     suggestedMcpId ? 'yaml' : 'agent',
@@ -186,8 +198,15 @@ export function CreateEnvironmentPage({
             ) : null}
             {activeView === 'agent' ? (
               <AgentMasterView
-                repositories={repositories.data ?? []}
+                repositories={(repositories.data ?? []).map((repository) => ({
+                  id: repository.id,
+                  fullName: repository.fullName,
+                  // includeEmptyState is set on the query, but the router
+                  // output type does not narrow on that flag.
+                  isEmpty: (repository as { isEmpty?: boolean }).isEmpty,
+                }))}
                 repositoriesLoading={repositories.isPending}
+                onOpenCreateRepo={() => setCreateRepoDialogOpen(true)}
                 selectedRepositoryIds={selectedRepositoryIds}
                 onToggleRepository={(repositoryId) => {
                   setSelectedRepositoryIds((currentSelection) =>
@@ -224,10 +243,28 @@ export function CreateEnvironmentPage({
           </div>
         </div>
       </div>
+      <CreateGitHubRepoDialog
+        open={createRepoDialogOpen}
+        onOpenChange={setCreateRepoDialogOpen}
+        onRepositoryDetected={(repository: DetectedRepository) => {
+          setCreateRepoDialogOpen(false);
+          setSelectedRepositoryIds((currentSelection) =>
+            currentSelection.includes(repository.id)
+              ? currentSelection
+              : [...currentSelection, repository.id],
+          );
+        }}
+      />
     </>
   );
 }
 
+type AgentViewRepository = {
+  id: string;
+  fullName: string;
+  isEmpty?: boolean | null;
+};
+
 function AgentMasterView({
   repositories,
   repositoriesLoading,
@@ -239,10 +276,11 @@ function AgentMasterView({
   selectedModelId,
   onSelectedModelIdChange,
   onSwitchToYaml,
+  onOpenCreateRepo,
   isStartAgentPending,
   isBusy,
 }: {
-  repositories: Array<{ id: string; fullName: string }>;
+  repositories: AgentViewRepository[];
   repositoriesLoading: boolean;
   selectedRepositoryIds: string[];
   onToggleRepository: (repositoryId: string) => void;
@@ -252,6 +290,7 @@ function AgentMasterView({
   selectedModelId?: string;
   onSelectedModelIdChange: (value: string) => void;
   onSwitchToYaml: () => void;
+  onOpenCreateRepo: () => void;
   isStartAgentPending: boolean;
   isBusy: boolean;
 }) {
@@ -267,6 +306,7 @@ function AgentMasterView({
       selectedModelId={selectedModelId}
       onSelectedModelIdChange={onSelectedModelIdChange}
       onSwitchToYaml={onSwitchToYaml}
+      onOpenCreateRepo={onOpenCreateRepo}
       isStartAgentPending={isStartAgentPending}
       isBusy={isBusy}
     />
@@ -284,10 +324,11 @@ function AgentRepositorySelectionSubview({
   selectedModelId,
   onSelectedModelIdChange,
   onSwitchToYaml,
+  onOpenCreateRepo,
   isStartAgentPending,
   isBusy,
 }: {
-  repositories: Array<{ id: string; fullName: string }>;
+  repositories: AgentViewRepository[];
   repositoriesLoading: boolean;
   selectedRepositoryIds: string[];
   onToggleRepository: (repositoryId: string) => void;
@@ -297,13 +338,27 @@ function AgentRepositorySelectionSubview({
   selectedModelId?: string;
   onSelectedModelIdChange: (value: string) => void;
   onSwitchToYaml: () => void;
+  onOpenCreateRepo: () => void;
   isStartAgentPending: boolean;
   isBusy: boolean;
 }) {
+  const selectedEmptyRepositories = getEmptyRepositories(
+    repositories.filter((repository) =>
+      selectedRepositoryIds.includes(repository.id),
+    ),
+  );
+  const allSelectedRepositoriesAreEmpty =
+    selectedRepositoryIds.length > 0 &&
+    areAllRepositoriesEmpty(
+      repositories.filter((repository) =>
+        selectedRepositoryIds.includes(repository.id),
+      ),
+    );
+
   return (
     <>
       <p className="text-sm text-muted-foreground">
-        Pick the repos needed for the first environment you want to set up.
+        Pick the repo(s) needed for the environment you want to set up.
       </p>
 
       <Card>
@@ -321,6 +376,14 @@ function AgentRepositorySelectionSubview({
                 </AlertDescription>
               </Alert>
               <UpdateGitHubReposHint />
+              <EnvironmentRepositorySelector
+                repositories={repositories}
+                selectedRepositoryIds={selectedRepositoryIds}
+                onToggleRepository={onToggleRepository}
+                onCreateRepository={onOpenCreateRepo}
+                inputPrefix="create-environment-repository"
+                heightClassName="max-h-[calc(var(--effective-viewport-height)-17rem)] overflow-auto"
+              />
             </div>
           ) : (
             <div className="space-y-4">
@@ -328,11 +391,35 @@ function AgentRepositorySelectionSubview({
                 repositories={repositories}
                 selectedRepositoryIds={selectedRepositoryIds}
                 onToggleRepository={onToggleRepository}
+                onCreateRepository={onOpenCreateRepo}
                 inputPrefix="create-environment-repository"
                 heightClassName="max-h-[calc(var(--effective-viewport-height)-17rem)] overflow-auto"
               />
 
-              <UpdateGitHubReposHint />
+              <div className="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
+                <UpdateGitHubReposHint />
+              </div>
+
+              {allSelectedRepositoriesAreEmpty ? (
+                <Alert>
+                  <Info className="size-4" />
+                  <AlertDescription className="flex-col items-start gap-1">
+                    <p>
+                      {selectedEmptyRepositories.length === 1
+                        ? 'The selected repository has no commits yet.'
+                        : 'All selected repositories have no commits yet.'}{' '}
+                      Roomote will push an initial commit and set up a basic
+                      environment — then you can start building with your first
+                      task.
+                    </p>
+                    <p className="font-medium text-foreground">
+                      {selectedEmptyRepositories
+                        .map((repository) => repository.fullName)
+                        .join(', ')}
+                    </p>
+                  </AlertDescription>
+                </Alert>
+              ) : null}
 
               <div>
                 <Textarea
diff --git a/apps/web/src/components/settings/environments/EditEnvironmentPage.client.test.tsx b/apps/web/src/components/settings/environments/EditEnvironmentPage.client.test.tsx
index 494389bb1..247ba2f2a 100644
--- a/apps/web/src/components/settings/environments/EditEnvironmentPage.client.test.tsx
+++ b/apps/web/src/components/settings/environments/EditEnvironmentPage.client.test.tsx
@@ -168,6 +168,33 @@ vi.mock('@/hooks/source-control', () => ({
   }),
 }));
 
+vi.mock('@/hooks/task-models/useLaunchTaskModels', () => ({
+  useLaunchTaskModels: () => ({
+    data: { defaultModelId: 'openrouter/openai/gpt-5.4' },
+  }),
+}));
+
+vi.mock('@/components/tasks', () => ({
+  ModelSelect: ({
+    value,
+    onValueChange,
+    ariaLabel,
+  }: {
+    value?: string;
+    onValueChange: (value: string) => void;
+    ariaLabel?: string;
+  }) => (
+    <select
+      aria-label={ariaLabel}
+      value={value ?? ''}
+      onChange={(event) => onValueChange(event.currentTarget.value)}
+    >
+      <option value="">Model</option>
+      <option value="openrouter/z-ai/glm-5.2">GLM 5.2</option>
+    </select>
+  ),
+}));
+
 vi.mock('@/trpc/client', () => ({
   useTRPC: () => ({
     environments: {
@@ -580,6 +607,10 @@ describe('EditEnvironmentPage', () => {
     fireEvent.click(
       await screen.findByRole('button', { name: /Use the Onboarding Agent/i }),
     );
+    fireEvent.change(
+      screen.getByRole('combobox', { name: /environment edit model/i }),
+      { target: { value: 'openrouter/z-ai/glm-5.2' } },
+    );
     fireEvent.click(screen.getByRole('button', { name: /Start Agent/i }));
 
     await waitFor(() => {
@@ -589,6 +620,7 @@ describe('EditEnvironmentPage', () => {
       repositoryIds: ['repo-1'],
       environmentId: 'env-1',
       changeRequest: undefined,
+      selectedModelId: 'openrouter/z-ai/glm-5.2',
     });
     expect(mockRouterPush).toHaveBeenCalledWith('/task/task-1');
   });
diff --git a/apps/web/src/components/settings/environments/EditEnvironmentPage.tsx b/apps/web/src/components/settings/environments/EditEnvironmentPage.tsx
index 023d74e57..c843b9e57 100644
--- a/apps/web/src/components/settings/environments/EditEnvironmentPage.tsx
+++ b/apps/web/src/components/settings/environments/EditEnvironmentPage.tsx
@@ -16,8 +16,10 @@ import {
   useValidateEnvironmentConfig,
 } from '@/hooks/environments';
 import { useRepositories } from '@/hooks/source-control';
+import { useLaunchTaskModels } from '@/hooks/task-models/useLaunchTaskModels';
 import { SETTINGS_PATHS } from '@/lib/settings';
 import { useTRPC } from '@/trpc/client';
+import { ModelSelect } from '@/components/tasks';
 
 import {
   Alert,
@@ -75,6 +77,7 @@ export function EditEnvironmentPage({
   );
   const updateEnvironment = useUpdateEnvironment();
   const validateConfig = useValidateEnvironmentConfig();
+  const launchTaskModels = useLaunchTaskModels();
   const [activeView, setActiveView] = useState<MasterView>('yaml');
   const [warnings, setWarnings] = useState<string[]>([]);
   const [pendingConfig, setPendingConfig] = useState<EnvironmentConfig | null>(
@@ -91,7 +94,10 @@ export function EditEnvironmentPage({
     [],
   );
   const [agentChangeRequest, setAgentChangeRequest] = useState('');
+  const [selectedModelId, setSelectedModelId] = useState<string>();
   const [isLoadingVersion, setIsLoadingVersion] = useState(false);
+  const effectiveSelectedModelId =
+    selectedModelId ?? launchTaskModels.data?.defaultModelId;
 
   const startDefinitionTask = useMutation(
     trpc.environments.startDefinitionTask.mutationOptions({
@@ -113,6 +119,7 @@ export function EditEnvironmentPage({
     setSelectedVersionValue(CURRENT_VERSION_VALUE);
     setSelectedRepositoryIds([]);
     setAgentChangeRequest('');
+    setSelectedModelId(undefined);
     setIsLoadingVersion(false);
   }, [environmentId]);
 
@@ -140,6 +147,7 @@ export function EditEnvironmentPage({
     setSelectedVersionValue(CURRENT_VERSION_VALUE);
     setSelectedRepositoryIds([]);
     setAgentChangeRequest('');
+    setSelectedModelId(undefined);
     setActiveView('yaml');
   };
 
@@ -291,6 +299,9 @@ export function EditEnvironmentPage({
       repositoryIds: selectedRepositoryIds,
       environmentId: environment.id,
       changeRequest: agentChangeRequest.trim() || undefined,
+      ...(effectiveSelectedModelId
+        ? { selectedModelId: effectiveSelectedModelId }
+        : {}),
     });
   };
 
@@ -415,6 +426,8 @@ export function EditEnvironmentPage({
                 onSwitchToYaml={handleSwitchToYaml}
                 changeRequest={agentChangeRequest}
                 onChangeRequest={setAgentChangeRequest}
+                selectedModelId={effectiveSelectedModelId}
+                onSelectedModelIdChange={setSelectedModelId}
                 isStartAgentPending={startDefinitionTask.isPending}
                 isBusy={isBusy}
               />
@@ -554,6 +567,8 @@ function AgentMasterView({
   onSwitchToYaml,
   changeRequest,
   onChangeRequest,
+  selectedModelId,
+  onSelectedModelIdChange,
   isStartAgentPending,
   isBusy,
 }: {
@@ -566,6 +581,8 @@ function AgentMasterView({
   onSwitchToYaml: () => void;
   changeRequest: string;
   onChangeRequest: (value: string) => void;
+  selectedModelId?: string;
+  onSelectedModelIdChange: (value: string) => void;
   isStartAgentPending: boolean;
   isBusy: boolean;
 }) {
@@ -580,6 +597,8 @@ function AgentMasterView({
       onSwitchToYaml={onSwitchToYaml}
       changeRequest={changeRequest}
       onChangeRequest={onChangeRequest}
+      selectedModelId={selectedModelId}
+      onSelectedModelIdChange={onSelectedModelIdChange}
       isStartAgentPending={isStartAgentPending}
       isBusy={isBusy}
     />
@@ -596,6 +615,8 @@ function AgentRepositorySelectionSubview({
   onSwitchToYaml,
   changeRequest,
   onChangeRequest,
+  selectedModelId,
+  onSelectedModelIdChange,
   isStartAgentPending,
   isBusy,
 }: {
@@ -608,6 +629,8 @@ function AgentRepositorySelectionSubview({
   onSwitchToYaml: () => void;
   changeRequest: string;
   onChangeRequest: (value: string) => void;
+  selectedModelId?: string;
+  onSelectedModelIdChange: (value: string) => void;
   isStartAgentPending: boolean;
   isBusy: boolean;
 }) {
@@ -715,6 +738,12 @@ function AgentRepositorySelectionSubview({
           Start Agent
           <ArrowRight />
         </Button>
+        <ModelSelect
+          value={selectedModelId}
+          onValueChange={onSelectedModelIdChange}
+          disabled={isBusy}
+          ariaLabel="Environment edit model"
+        />
       </div>
     </>
   );
diff --git a/apps/web/src/components/settings/environments/EnvironmentRepositorySelector.tsx b/apps/web/src/components/settings/environments/EnvironmentRepositorySelector.tsx
index 73b92300c..8fbb7165c 100644
--- a/apps/web/src/components/settings/environments/EnvironmentRepositorySelector.tsx
+++ b/apps/web/src/components/settings/environments/EnvironmentRepositorySelector.tsx
@@ -3,6 +3,7 @@
 import { useMemo } from 'react';
 
 import { Checkbox, ScrollArea } from '@/components/system';
+import { PackagePlus } from 'lucide-react';
 
 type RepositorySummary = {
   id: string;
@@ -13,12 +14,14 @@ export function EnvironmentRepositorySelector({
   repositories,
   selectedRepositoryIds,
   onToggleRepository,
+  onCreateRepository,
   inputPrefix = 'environment-repository',
   heightClassName = 'max-h-[11.5rem] md:h-[18.75rem]',
 }: {
   repositories: RepositorySummary[];
   selectedRepositoryIds: string[];
   onToggleRepository: (repositoryId: string) => void;
+  onCreateRepository?: () => void;
   inputPrefix?: string;
   heightClassName?: string;
 }) {
@@ -33,6 +36,18 @@ export function EnvironmentRepositorySelector({
   return (
     <ScrollArea className={`overflow-auto ${heightClassName}`}>
       <div className="space-y-1">
+        {onCreateRepository ? (
+          <p className="border-b border-dotted pb-1">
+            <button
+              type="button"
+              className="flex w-full items-center gap-2 py-1 text-left hover:text-accent-foreground"
+              onClick={onCreateRepository}
+            >
+              <PackagePlus className="size-4 mx-0.5" />
+              Create a new repository
+            </button>
+          </p>
+        ) : null}
         {sortedRepositories.map((repository) => (
           <label
             key={repository.id}
diff --git a/apps/web/src/components/settings/environments/UpdateGitHubReposHint.tsx b/apps/web/src/components/settings/environments/UpdateGitHubReposHint.tsx
index 1cbe30328..22837d03a 100644
--- a/apps/web/src/components/settings/environments/UpdateGitHubReposHint.tsx
+++ b/apps/web/src/components/settings/environments/UpdateGitHubReposHint.tsx
@@ -34,7 +34,7 @@ export function UpdateGitHubReposHint() {
       <Button
         type="button"
         size="xs"
-        variant="outline"
+        variant="link"
         disabled={enableGitHubApp.isPending}
         onClick={() => {
           enableGitHubApp.mutate(
diff --git a/apps/web/src/components/tasks/SelectEnvironmentOrRepository.test.tsx b/apps/web/src/components/tasks/SelectEnvironmentOrRepository.test.tsx
index 076dd5340..f29d82234 100644
--- a/apps/web/src/components/tasks/SelectEnvironmentOrRepository.test.tsx
+++ b/apps/web/src/components/tasks/SelectEnvironmentOrRepository.test.tsx
@@ -114,12 +114,14 @@ const SelectEnvironmentOrRepositoryHarness = ({
   repositoryFilter,
   defaultValues,
   onValuesChange,
+  onCreateRepository,
 }: {
   allowAuto?: boolean;
   /** Omit for no filter (homepage Auto). Pass a repo full name to filter. */
   repositoryFilter?: string;
   defaultValues: Partial<CreateTaskFormValues>;
   onValuesChange: (values: WorkspaceSelectionValues) => void;
+  onCreateRepository?: () => void;
 }) => {
   const form = useForm<CreateTaskFormValues>({
     defaultValues: {
@@ -135,6 +137,7 @@ const SelectEnvironmentOrRepositoryHarness = ({
         repositoryFilter={repositoryFilter}
         allowAuto={allowAuto}
         onCreate={vi.fn()}
+        onCreateRepository={onCreateRepository}
         onEdit={vi.fn()}
         onDelete={vi.fn()}
       />
@@ -513,4 +516,53 @@ describe('SelectEnvironmentOrRepository', () => {
       'Auto',
     ]);
   });
+
+  it('offers the New GitHub repository item to admins when wired up', async () => {
+    render(
+      <SelectEnvironmentOrRepositoryHarness
+        defaultValues={{}}
+        onValuesChange={vi.fn()}
+        onCreateRepository={vi.fn()}
+      />,
+    );
+
+    const menuItems = Array.from(
+      document.querySelectorAll('[data-slot="dropdown-menu-item"]'),
+    ).map((node) => node.textContent?.trim());
+
+    expect(menuItems).toContain('Create environment');
+    expect(menuItems).toContain('New GitHub repository');
+  });
+
+  it('hides the New GitHub repository item without a handler or admin rights', async () => {
+    const { unmount } = render(
+      <SelectEnvironmentOrRepositoryHarness
+        defaultValues={{}}
+        onValuesChange={vi.fn()}
+      />,
+    );
+
+    const menuItemsWithoutHandler = Array.from(
+      document.querySelectorAll('[data-slot="dropdown-menu-item"]'),
+    ).map((node) => node.textContent?.trim());
+    expect(menuItemsWithoutHandler).not.toContain('New GitHub repository');
+    unmount();
+
+    mockedUseAuthorizedUser.mockReturnValue({
+      isAdmin: false,
+    } as ReturnType<typeof useAuthorizedUser>);
+
+    render(
+      <SelectEnvironmentOrRepositoryHarness
+        defaultValues={{}}
+        onValuesChange={vi.fn()}
+        onCreateRepository={vi.fn()}
+      />,
+    );
+
+    const menuItemsAsMember = Array.from(
+      document.querySelectorAll('[data-slot="dropdown-menu-item"]'),
+    ).map((node) => node.textContent?.trim());
+    expect(menuItemsAsMember).not.toContain('New GitHub repository');
+  });
 });
diff --git a/apps/web/src/components/tasks/SelectEnvironmentOrRepository.tsx b/apps/web/src/components/tasks/SelectEnvironmentOrRepository.tsx
index caaca54e5..62781bb06 100644
--- a/apps/web/src/components/tasks/SelectEnvironmentOrRepository.tsx
+++ b/apps/web/src/components/tasks/SelectEnvironmentOrRepository.tsx
@@ -52,6 +52,7 @@ interface SelectEnvironmentOrRepositoryProps {
   lockedBranch?: string;
   allowAuto?: boolean;
   onCreate: () => void;
+  onCreateRepository?: () => void;
   onEdit: (e: React.MouseEvent, envId: string) => void;
   onDelete: (e: React.MouseEvent, env: EnvironmentWithMeta) => void;
 }
@@ -61,6 +62,7 @@ export const SelectEnvironmentOrRepository = ({
   lockedBranch,
   allowAuto = false,
   onCreate,
+  onCreateRepository,
   onEdit,
   onDelete,
 }: SelectEnvironmentOrRepositoryProps) => {
@@ -455,6 +457,19 @@ export const SelectEnvironmentOrRepository = ({
                     Create environment
                   </span>
                 </DropdownMenuItem>
+                {onCreateRepository ? (
+                  <DropdownMenuItem
+                    onSelect={(event) => {
+                      event.preventDefault();
+                      onCreateRepository();
+                    }}
+                  >
+                    <span className="flex items-center gap-2">
+                      <Plus className="size-3.5" />
+                      New GitHub repository
+                    </span>
+                  </DropdownMenuItem>
+                ) : null}
               </>
             )}
 
diff --git a/apps/web/src/components/tasks/SelectWorkspace.tsx b/apps/web/src/components/tasks/SelectWorkspace.tsx
index a587583a3..50380a08f 100644
--- a/apps/web/src/components/tasks/SelectWorkspace.tsx
+++ b/apps/web/src/components/tasks/SelectWorkspace.tsx
@@ -60,6 +60,10 @@ export const SelectWorkspace = ({
     router.push(SETTINGS_PATHS.newEnvironment);
   }, [router]);
 
+  const handleCreateRepository = useCallback(() => {
+    router.push(`${SETTINGS_PATHS.newEnvironment}?create-repo=1`);
+  }, [router]);
+
   const handleUpdateEnvironment = useCallback(
     (e: React.MouseEvent, envId: string) => {
       e.preventDefault();
@@ -106,6 +110,7 @@ export const SelectWorkspace = ({
           lockedBranch={lockedBranch}
           allowAuto={allowAuto}
           onCreate={handleCreateEnvironment}
+          onCreateRepository={handleCreateRepository}
           onEdit={handleUpdateEnvironment}
           onDelete={handleDeleteEnvironment}
         />
diff --git a/apps/web/src/hooks/linear/index.ts b/apps/web/src/hooks/linear/index.ts
index c977697a6..977ca8ddc 100644
--- a/apps/web/src/hooks/linear/index.ts
+++ b/apps/web/src/hooks/linear/index.ts
@@ -1,4 +1,7 @@
 export { useLinearInstallation } from './useLinearInstallation';
 export { useConnectLinear } from './useConnectLinear';
 export { useDisconnectLinear } from './useDisconnectLinear';
+export { useLinearOauthSetup } from './useLinearOauthSetup';
+export { useSaveLinearOauthSetup } from './useSaveLinearOauthSetup';
+export { useRemoveLinearOauthSetup } from './useRemoveLinearOauthSetup';
 export { useAuthenticateLinearAccount } from './useAuthenticateLinearAccount';
diff --git a/apps/web/src/hooks/linear/useInvalidateLinearOauthSetup.ts b/apps/web/src/hooks/linear/useInvalidateLinearOauthSetup.ts
new file mode 100644
index 000000000..81d6413de
--- /dev/null
+++ b/apps/web/src/hooks/linear/useInvalidateLinearOauthSetup.ts
@@ -0,0 +1,27 @@
+'use client';
+
+import { useQueryClient } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+export function useInvalidateLinearOauthSetup() {
+  const trpc = useTRPC();
+  const queryClient = useQueryClient();
+
+  return async () => {
+    await Promise.all([
+      queryClient.invalidateQueries({
+        queryKey: trpc.linear.oauthSetup.queryKey(),
+      }),
+      queryClient.invalidateQueries({
+        queryKey: trpc.mcpConnections.oauthReadiness.queryKey(),
+      }),
+      queryClient.invalidateQueries({
+        queryKey: trpc.linear.installation.queryKey(),
+      }),
+      queryClient.invalidateQueries({
+        queryKey: trpc.mcpConnections.deploymentEnablements.queryKey(),
+      }),
+    ]);
+  };
+}
diff --git a/apps/web/src/hooks/linear/useLinearOauthSetup.ts b/apps/web/src/hooks/linear/useLinearOauthSetup.ts
new file mode 100644
index 000000000..1eea0d8cd
--- /dev/null
+++ b/apps/web/src/hooks/linear/useLinearOauthSetup.ts
@@ -0,0 +1,14 @@
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+export function useLinearOauthSetup(enabled = true) {
+  const trpc = useTRPC();
+
+  return useQuery({
+    ...trpc.linear.oauthSetup.queryOptions(),
+    enabled,
+  });
+}
diff --git a/apps/web/src/hooks/linear/useRemoveLinearOauthSetup.ts b/apps/web/src/hooks/linear/useRemoveLinearOauthSetup.ts
new file mode 100644
index 000000000..19ad4387f
--- /dev/null
+++ b/apps/web/src/hooks/linear/useRemoveLinearOauthSetup.ts
@@ -0,0 +1,18 @@
+'use client';
+
+import { useMutation } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+import { useInvalidateLinearOauthSetup } from './useInvalidateLinearOauthSetup';
+
+export function useRemoveLinearOauthSetup() {
+  const trpc = useTRPC();
+  const invalidateLinearOauthSetup = useInvalidateLinearOauthSetup();
+
+  return useMutation(
+    trpc.linear.removeOauthSetup.mutationOptions({
+      onSuccess: invalidateLinearOauthSetup,
+    }),
+  );
+}
diff --git a/apps/web/src/hooks/linear/useSaveLinearOauthSetup.ts b/apps/web/src/hooks/linear/useSaveLinearOauthSetup.ts
new file mode 100644
index 000000000..4adb30993
--- /dev/null
+++ b/apps/web/src/hooks/linear/useSaveLinearOauthSetup.ts
@@ -0,0 +1,18 @@
+'use client';
+
+import { useMutation } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+import { useInvalidateLinearOauthSetup } from './useInvalidateLinearOauthSetup';
+
+export function useSaveLinearOauthSetup() {
+  const trpc = useTRPC();
+  const invalidateLinearOauthSetup = useInvalidateLinearOauthSetup();
+
+  return useMutation(
+    trpc.linear.saveOauthSetup.mutationOptions({
+      onSuccess: invalidateLinearOauthSetup,
+    }),
+  );
+}
diff --git a/apps/web/src/hooks/mcp-connections/index.ts b/apps/web/src/hooks/mcp-connections/index.ts
index bcf44ff77..d7133e7d4 100644
--- a/apps/web/src/hooks/mcp-connections/index.ts
+++ b/apps/web/src/hooks/mcp-connections/index.ts
@@ -2,6 +2,7 @@
 export { useDeploymentMcpEnablements } from './useDeploymentMcpEnablements';
 export { useUserMcpConnections } from './useUserMcpConnections';
 export { useMcpConnectionTools } from './useMcpConnectionTools';
+export { useMcpOauthReadiness } from './useMcpOauthReadiness';
 
 // Mutations
 export { useSetDeploymentMcpEnabled } from './useSetDeploymentMcpEnabled';
diff --git a/apps/web/src/hooks/mcp-connections/useMcpOauthReadiness.ts b/apps/web/src/hooks/mcp-connections/useMcpOauthReadiness.ts
new file mode 100644
index 000000000..e4567e213
--- /dev/null
+++ b/apps/web/src/hooks/mcp-connections/useMcpOauthReadiness.ts
@@ -0,0 +1,11 @@
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+export function useMcpOauthReadiness() {
+  const trpc = useTRPC();
+
+  return useQuery(trpc.mcpConnections.oauthReadiness.queryOptions());
+}
diff --git a/apps/web/src/hooks/source-control/useRepositories.ts b/apps/web/src/hooks/source-control/useRepositories.ts
index 59a6910c7..aa3bbcae7 100644
--- a/apps/web/src/hooks/source-control/useRepositories.ts
+++ b/apps/web/src/hooks/source-control/useRepositories.ts
@@ -8,8 +8,19 @@ type UseRepositoriesInput = {
   sourceControlProvider?: SourceControlProvider;
 };
 
-export const useRepositories = (input?: UseRepositoriesInput) => {
+type UseRepositoriesOptions = {
+  refetchInterval?: number | false;
+  refetchIntervalInBackground?: false;
+};
+
+export const useRepositories = (
+  input?: UseRepositoriesInput,
+  options?: UseRepositoriesOptions,
+) => {
   const trpc = useTRPC();
 
-  return useQuery(trpc.sourceControl.repositories.queryOptions(input));
+  return useQuery({
+    ...trpc.sourceControl.repositories.queryOptions(input),
+    ...options,
+  });
 };
diff --git a/apps/web/src/lib/__tests__/product-version.test.ts b/apps/web/src/lib/__tests__/product-version.test.ts
index 80192fe34..702202756 100644
--- a/apps/web/src/lib/__tests__/product-version.test.ts
+++ b/apps/web/src/lib/__tests__/product-version.test.ts
@@ -20,6 +20,7 @@ describe('product-version', () => {
     expect(isParsableProductVersion('v0.16.0')).toBe(true);
     expect(isParsableProductVersion('0.16.0-rc.1')).toBe(true);
     expect(isParsableProductVersion('main-037146ca')).toBe(false);
+    expect(isParsableProductVersion('037146ca')).toBe(false);
     expect(isParsableProductVersion('develop-abc12345')).toBe(false);
     expect(isParsableProductVersion('self-host-production')).toBe(false);
     expect(isParsableProductVersion(null)).toBe(false);
diff --git a/apps/web/src/lib/docs.ts b/apps/web/src/lib/docs.ts
index 7f9a9dcc7..50b2ba5aa 100644
--- a/apps/web/src/lib/docs.ts
+++ b/apps/web/src/lib/docs.ts
@@ -13,3 +13,8 @@ export const DOCS_ENVIRONMENT_DEFINITION_URL = `${DOCS_BASE_URL}/environments/de
  * Public docs page for self-hosting, upgrades, and day-2 operations.
  */
 export const DOCS_SELF_HOSTING_URL = `${DOCS_BASE_URL}/self-hosting`;
+
+/**
+ * Public setup guide for the Linear integration.
+ */
+export const DOCS_LINEAR_INTEGRATION_URL = `${DOCS_BASE_URL}/integrations/linear`;
diff --git a/apps/web/src/lib/environment-definition.test.ts b/apps/web/src/lib/environment-definition.test.ts
index 2562f4080..80ec0c59b 100644
--- a/apps/web/src/lib/environment-definition.test.ts
+++ b/apps/web/src/lib/environment-definition.test.ts
@@ -58,6 +58,36 @@ describe('environment definition helpers', () => {
     );
   });
 
+  it('flags empty repositories in the create prompt with bootstrap instructions', () => {
+    const prompt = buildCreateEnvironmentDefinitionPrompt(
+      ['acme/web', 'acme/new-repo'],
+      { emptyRepositoryFullNames: ['acme/new-repo'] },
+    );
+
+    expect(prompt).toContain(
+      'These repositories are brand new and have no commits yet:\n- acme/new-repo',
+    );
+    expect(prompt).toContain(
+      "follow the skill's empty-repository bootstrap: push exactly one initial commit containing only a README.md and a minimal .gitignore",
+    );
+    expect(prompt).toContain('Do not scaffold application code');
+  });
+
+  it('ignores empty-repository flags outside the selected repository set', () => {
+    const basePrompt = buildCreateEnvironmentDefinitionPrompt(['acme/web']);
+
+    expect(
+      buildCreateEnvironmentDefinitionPrompt(['acme/web'], {
+        emptyRepositoryFullNames: ['acme/other'],
+      }),
+    ).toBe(basePrompt);
+    expect(
+      buildCreateEnvironmentDefinitionPrompt(['acme/web'], {
+        emptyRepositoryFullNames: [],
+      }),
+    ).toBe(basePrompt);
+  });
+
   it('appends setup guidance only when the user provided it', () => {
     const basePrompt = buildCreateEnvironmentDefinitionPrompt(['acme/web']);
 
diff --git a/apps/web/src/lib/github-urls.test.ts b/apps/web/src/lib/github-urls.test.ts
new file mode 100644
index 000000000..c6ea4c367
--- /dev/null
+++ b/apps/web/src/lib/github-urls.test.ts
@@ -0,0 +1,60 @@
+import { parseGitHubRepoReference } from './github-urls';
+
+describe('parseGitHubRepoReference', () => {
+  it('parses bare owner/repo shorthand', () => {
+    expect(parseGitHubRepoReference('RooCodeInc/Roomote')).toEqual({
+      owner: 'RooCodeInc',
+      repo: 'Roomote',
+    });
+  });
+
+  it('parses full GitHub URLs', () => {
+    expect(
+      parseGitHubRepoReference('https://github.com/RooCodeInc/Roomote'),
+    ).toEqual({ owner: 'RooCodeInc', repo: 'Roomote' });
+    expect(parseGitHubRepoReference('github.com/acme/repo')).toEqual({
+      owner: 'acme',
+      repo: 'repo',
+    });
+    expect(parseGitHubRepoReference('http://www.github.com/acme/repo')).toEqual(
+      { owner: 'acme', repo: 'repo' },
+    );
+  });
+
+  it('strips .git suffixes, extra path segments, queries, and fragments', () => {
+    expect(
+      parseGitHubRepoReference('https://github.com/acme/repo.git'),
+    ).toEqual({ owner: 'acme', repo: 'repo' });
+    expect(
+      parseGitHubRepoReference('https://github.com/acme/repo/tree/main/src'),
+    ).toEqual({ owner: 'acme', repo: 'repo' });
+    expect(
+      parseGitHubRepoReference('https://github.com/acme/repo?tab=readme'),
+    ).toEqual({ owner: 'acme', repo: 'repo' });
+    expect(
+      parseGitHubRepoReference('https://github.com/acme/repo#readme'),
+    ).toEqual({ owner: 'acme', repo: 'repo' });
+    expect(parseGitHubRepoReference('  acme/repo  ')).toEqual({
+      owner: 'acme',
+      repo: 'repo',
+    });
+  });
+
+  it('rejects values that do not identify a GitHub repository', () => {
+    expect(parseGitHubRepoReference('')).toBeNull();
+    expect(parseGitHubRepoReference('   ')).toBeNull();
+    expect(parseGitHubRepoReference('just-an-owner')).toBeNull();
+    expect(
+      parseGitHubRepoReference('https://github.com/only-owner'),
+    ).toBeNull();
+    expect(parseGitHubRepoReference('https://gitlab.com/acme/repo')).toBeNull();
+    expect(
+      parseGitHubRepoReference('https://example.com/acme/repo'),
+    ).toBeNull();
+    expect(parseGitHubRepoReference('acme//repo///')).toEqual({
+      owner: 'acme',
+      repo: 'repo',
+    });
+    expect(parseGitHubRepoReference('bad owner/repo')).toBeNull();
+  });
+});
diff --git a/apps/web/src/lib/github-urls.ts b/apps/web/src/lib/github-urls.ts
new file mode 100644
index 000000000..0d847f58a
--- /dev/null
+++ b/apps/web/src/lib/github-urls.ts
@@ -0,0 +1,53 @@
+type GitHubRepoReference = {
+  owner: string;
+  repo: string;
+};
+
+const OWNER_PATTERN = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,38})$/;
+const REPO_PATTERN = /^[a-zA-Z0-9._-]{1,100}$/;
+
+/**
+ * Parse a user-supplied reference to a GitHub repository. Accepts full URLs
+ * (`https://github.com/owner/repo`, with or without protocol, trailing
+ * `.git`, extra path segments, or a query string) and bare `owner/repo`
+ * shorthand. Returns null for anything that does not identify a repository.
+ */
+export function parseGitHubRepoReference(
+  value: string,
+): GitHubRepoReference | null {
+  const trimmed = value.trim();
+
+  if (!trimmed) {
+    return null;
+  }
+
+  let path = trimmed;
+
+  const urlMatch = trimmed.match(
+    /^(?:https?:\/\/)?(?:www\.)?github\.com\/(.+)$/i,
+  );
+
+  if (urlMatch?.[1]) {
+    path = urlMatch[1];
+  } else if (/^(?:https?:\/\/|www\.)/i.test(trimmed)) {
+    // A URL that is not github.com never identifies a GitHub repository.
+    return null;
+  }
+
+  const withoutFragment = path.split('#')[0] ?? '';
+  const withoutQuery = withoutFragment.split('?')[0] ?? '';
+  const segments = withoutQuery.split('/').filter(Boolean);
+
+  const owner = segments[0];
+  const repo = segments[1]?.replace(/\.git$/i, '');
+
+  if (!owner || !repo) {
+    return null;
+  }
+
+  if (!OWNER_PATTERN.test(owner) || !REPO_PATTERN.test(repo)) {
+    return null;
+  }
+
+  return { owner, repo };
+}
diff --git a/apps/web/src/lib/product-version.ts b/apps/web/src/lib/product-version.ts
index c670d9706..fa5e547a8 100644
--- a/apps/web/src/lib/product-version.ts
+++ b/apps/web/src/lib/product-version.ts
@@ -142,7 +142,7 @@ export function isParsableProductVersion(
   if (!normalized) {
     return false;
   }
-  return parseProductVersion(normalized).segments !== null;
+  return /^\d+\.\d+\.\d+(?:-[\w.]+)?$/.test(normalized);
 }
 
 export function isProductVersionNewer(
diff --git a/apps/web/src/lib/server/deployment-app-name.test.ts b/apps/web/src/lib/server/deployment-app-name.test.ts
new file mode 100644
index 000000000..ea5ee28e7
--- /dev/null
+++ b/apps/web/src/lib/server/deployment-app-name.test.ts
@@ -0,0 +1,21 @@
+import { buildDeploymentAppName } from './deployment-app-name';
+
+describe('buildDeploymentAppName', () => {
+  it('uses the same hostname-derived default across provider manifests', () => {
+    expect(buildDeploymentAppName('https://customer.example.com')).toBe(
+      'roomote-customer-example-com',
+    );
+    expect(buildDeploymentAppName('https://roomote.example.com')).toBe(
+      'roomote-example-com',
+    );
+  });
+
+  it('keeps the shared name within GitHub app naming limits', () => {
+    const name = buildDeploymentAppName(
+      'https://a-very-long-customer-deployment-name.example.com',
+    );
+
+    expect(name.length).toBeLessThanOrEqual(34);
+    expect(name.endsWith('-')).toBe(false);
+  });
+});
diff --git a/apps/web/src/lib/server/deployment-app-name.ts b/apps/web/src/lib/server/deployment-app-name.ts
new file mode 100644
index 000000000..434eaf577
--- /dev/null
+++ b/apps/web/src/lib/server/deployment-app-name.ts
@@ -0,0 +1,25 @@
+const DEPLOYMENT_APP_NAME_MAX_LENGTH = 34;
+const DEPLOYMENT_APP_NAME_PREFIX = 'roomote-';
+
+export const DEPLOYMENT_APP_DESCRIPTION = 'Cloud coding agents for all';
+
+/**
+ * Build the shared default name used for deployment-owned provider apps.
+ * GitHub's 34-character limit is the strictest supported limit, so keeping
+ * the shared name within it produces the same name across providers.
+ */
+export function buildDeploymentAppName(publicOrigin: string): string {
+  const host = new URL(publicOrigin).hostname
+    .replace(/[^a-zA-Z0-9-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+
+  if (!host) {
+    return 'roomote';
+  }
+
+  const candidate = host.startsWith('roomote')
+    ? host
+    : `${DEPLOYMENT_APP_NAME_PREFIX}${host}`;
+
+  return candidate.slice(0, DEPLOYMENT_APP_NAME_MAX_LENGTH).replace(/-+$/g, '');
+}
diff --git a/apps/web/src/lib/server/deployment-static-oauth.test.ts b/apps/web/src/lib/server/deployment-static-oauth.test.ts
new file mode 100644
index 000000000..1323fa489
--- /dev/null
+++ b/apps/web/src/lib/server/deployment-static-oauth.test.ts
@@ -0,0 +1,52 @@
+const { resolveDeploymentEnvVarMock } = vi.hoisted(() => ({
+  resolveDeploymentEnvVarMock: vi.fn(),
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: { query: { environmentVariables: { findMany: vi.fn() } } },
+  resolveDeploymentEnvVar: resolveDeploymentEnvVarMock,
+}));
+
+import {
+  getDeploymentStaticOauthReadiness,
+  resolveDeploymentStaticOauthClientInformation,
+} from './deployment-static-oauth';
+
+const LINEAR_INTEGRATION = {
+  id: 'linear',
+  oauthClientEnv: {
+    clientIdEnv: 'R_LINEAR_CLIENT_ID',
+    clientSecretEnv: 'R_LINEAR_CLIENT_SECRET',
+    tokenEndpointAuthMethod: 'client_secret_post' as const,
+  },
+};
+
+describe('deployment static OAuth', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('resolves a client stored in the encrypted deployment environment', async () => {
+    resolveDeploymentEnvVarMock.mockImplementation(async (name: string) =>
+      name === 'R_LINEAR_CLIENT_ID' ? 'saved-client' : 'saved-secret',
+    );
+
+    await expect(
+      resolveDeploymentStaticOauthClientInformation({}, LINEAR_INTEGRATION),
+    ).resolves.toEqual({
+      client_id: 'saved-client',
+      client_secret: 'saved-secret',
+      token_endpoint_auth_method: 'client_secret_post',
+    });
+  });
+
+  it('reports a partially configured deployment', async () => {
+    resolveDeploymentEnvVarMock.mockImplementation(async (name: string) =>
+      name === 'R_LINEAR_CLIENT_ID' ? 'saved-client' : null,
+    );
+
+    await expect(
+      getDeploymentStaticOauthReadiness({}, LINEAR_INTEGRATION),
+    ).resolves.toBe('partial');
+  });
+});
diff --git a/apps/web/src/lib/server/deployment-static-oauth.ts b/apps/web/src/lib/server/deployment-static-oauth.ts
new file mode 100644
index 000000000..35d6afd34
--- /dev/null
+++ b/apps/web/src/lib/server/deployment-static-oauth.ts
@@ -0,0 +1,60 @@
+import {
+  db,
+  resolveDeploymentEnvVar,
+  type DatabaseOrTransaction,
+} from '@roomote/db/server';
+import type { McpIntegration } from '@roomote/types';
+
+import {
+  getStaticOauthEnvKeys,
+  getStaticOauthReadiness,
+  resolveStaticOauthClientInformation,
+} from './mcp-static-oauth';
+
+async function resolveDeploymentStaticOauthEnv(
+  runtimeEnv: unknown,
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+  executor: DatabaseOrTransaction = db,
+): Promise<Record<string, string>> {
+  const keys = getStaticOauthEnvKeys(integration);
+  const runtimeRecord =
+    typeof runtimeEnv === 'object' && runtimeEnv !== null
+      ? (runtimeEnv as Partial<Record<string, string | undefined>>)
+      : {};
+  const entries = await Promise.all(
+    keys.map(async (key) => {
+      const value = await resolveDeploymentEnvVar(key, executor, runtimeRecord);
+      return value ? ([key, value] as const) : null;
+    }),
+  );
+
+  return Object.fromEntries(entries.filter((entry) => entry !== null));
+}
+
+export async function getDeploymentStaticOauthReadiness(
+  runtimeEnv: unknown,
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+  executor: DatabaseOrTransaction = db,
+) {
+  const resolvedEnv = await resolveDeploymentStaticOauthEnv(
+    runtimeEnv,
+    integration,
+    executor,
+  );
+
+  return getStaticOauthReadiness(resolvedEnv, integration);
+}
+
+export async function resolveDeploymentStaticOauthClientInformation(
+  runtimeEnv: unknown,
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+  executor: DatabaseOrTransaction = db,
+) {
+  const resolvedEnv = await resolveDeploymentStaticOauthEnv(
+    runtimeEnv,
+    integration,
+    executor,
+  );
+
+  return resolveStaticOauthClientInformation(resolvedEnv, integration);
+}
diff --git a/apps/web/src/lib/server/mcp-linear.test.ts b/apps/web/src/lib/server/mcp-linear.test.ts
new file mode 100644
index 000000000..fe331efc5
--- /dev/null
+++ b/apps/web/src/lib/server/mcp-linear.test.ts
@@ -0,0 +1,277 @@
+const {
+  consumeMcpOauthReplayMock,
+  createLinearAgentRunMock,
+  dbUpdateSetMock,
+  dbUpdateMock,
+  emitThoughtMock,
+  getMcpOauthReplayMock,
+  linearViewerMock,
+  payload,
+  resolveLinearTaskDestinationMock,
+  updateSessionExternalUrlsMock,
+} = vi.hoisted(() => ({
+  consumeMcpOauthReplayMock: vi.fn(),
+  createLinearAgentRunMock: vi.fn(),
+  dbUpdateSetMock: vi.fn(),
+  dbUpdateMock: vi.fn(),
+  emitThoughtMock: vi.fn(),
+  getMcpOauthReplayMock: vi.fn(),
+  linearViewerMock: vi.fn(),
+  payload: {
+    type: 'AgentSessionEvent',
+    action: 'created',
+    organizationId: 'linear-org-1',
+    appUserId: 'linear-app-user-1',
+    webhookTimestamp: Date.now(),
+    webhookId: 'webhook-1',
+    agentSession: {
+      id: 'session-1',
+      issue: {
+        id: 'issue-1',
+        identifier: 'ENG-123',
+        title: 'Fix API retries',
+        description: 'Retry failed API requests',
+        url: 'https://linear.example/ENG-123',
+      },
+      createdAt: '2026-07-29T00:00:00.000Z',
+      updatedAt: '2026-07-29T00:00:00.000Z',
+    },
+  },
+  resolveLinearTaskDestinationMock: vi.fn(),
+  updateSessionExternalUrlsMock: vi.fn(),
+}));
+
+vi.mock('@linear/sdk', () => ({
+  LinearClient: class {
+    get viewer() {
+      return linearViewerMock();
+    }
+  },
+}));
+
+vi.mock('@roomote/communication/chat-messages', () => ({
+  buildTaskStartingText: vi.fn(
+    ({ workspaceDisplayName }: { workspaceDisplayName: string }) =>
+      `Getting started on your task in ${workspaceDisplayName}`,
+  ),
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    query: { mcpConnections: { findFirst: vi.fn() } },
+    update: dbUpdateMock,
+  },
+  deploymentMcpEnablements: {},
+  eq: vi.fn(),
+  mcpConnections: { id: 'id' },
+}));
+
+vi.mock('@roomote/sdk/server', () => ({
+  consumeMcpOauthReplay: consumeMcpOauthReplayMock,
+  findLinearDeploymentMcpConnection: vi.fn().mockResolvedValue({
+    id: 'deployment-connection-1',
+    authConfig: { linearOrganizationId: 'linear-org-1' },
+  }),
+  getLinearDeploymentMetadata: vi.fn().mockReturnValue({
+    linearOrganizationId: 'linear-org-1',
+  }),
+  getMcpOauthReplay: getMcpOauthReplayMock,
+  getValidAccessToken: vi.fn().mockResolvedValue('deployment-token'),
+  LINEAR_ORG_CONNECTION_ROLE: 'deployment',
+  LINEAR_USER_CONNECTION_ROLE: 'user',
+}));
+
+vi.mock('@roomote/linear', () => ({
+  createLinearAgentRun: createLinearAgentRunMock,
+  createLinearClient: vi.fn().mockReturnValue({
+    emitError: vi.fn(),
+    emitResponse: vi.fn(),
+    emitThought: emitThoughtMock,
+    updateSessionExternalUrls: updateSessionExternalUrlsMock,
+  }),
+  enrichSessionComments: vi.fn(
+    (_client: unknown, agentSession: unknown) => agentSession,
+  ),
+  parseAgentSessionEventPayload: vi.fn().mockReturnValue({
+    success: true,
+    data: payload,
+  }),
+  resolveLinearTaskDestination: resolveLinearTaskDestinationMock,
+}));
+
+vi.mock('@/lib/server/env', () => ({
+  Env: {
+    TRPC_URL: 'https://api.roomote.example',
+    R_APP_URL: 'https://app.roomote.example',
+    R_PUBLIC_URL: 'https://public.roomote.example',
+  },
+}));
+
+vi.mock('@/lib/server/get-public-app-url', () => ({
+  getPublicAppUrl: vi.fn().mockReturnValue('https://public.roomote.example'),
+}));
+
+import { hydrateLinearMcpConnectionAfterOauth } from './mcp-linear';
+
+describe('hydrateLinearMcpConnectionAfterOauth', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    linearViewerMock.mockResolvedValue({
+      id: 'linear-user-1',
+      organization: Promise.resolve({ id: 'linear-org-1' }),
+    });
+    dbUpdateMock.mockReturnValue({
+      set: dbUpdateSetMock.mockReturnValue({ where: vi.fn() }),
+    });
+  });
+
+  it.each([
+    {
+      name: 'user',
+      metadata: {
+        linearUserId: 'linear-user-2',
+        linearOrganizationId: 'linear-org-1',
+      },
+    },
+    {
+      name: 'organization',
+      metadata: {
+        linearUserId: 'linear-user-1',
+        linearOrganizationId: 'linear-org-2',
+      },
+    },
+  ])(
+    'rejects a replay authorized by a different Linear $name',
+    async ({ metadata }) => {
+      getMcpOauthReplayMock.mockResolvedValue({
+        mcpId: 'linear',
+        metadata,
+      });
+
+      await expect(
+        hydrateLinearMcpConnectionAfterOauth({
+          connection: {
+            id: 'connection-1',
+            connectionRole: 'user',
+            userId: 'roomote-user-1',
+          } as never,
+          tokens: { access_token: 'access-token' },
+          replayToken: 'replay-token',
+        }),
+      ).rejects.toThrow(
+        'The authorized Linear account does not match the requested session',
+      );
+
+      expect(dbUpdateMock).not.toHaveBeenCalled();
+      expect(consumeMcpOauthReplayMock).not.toHaveBeenCalled();
+    },
+  );
+
+  it('stores Linear identity metadata and OAuth tokens in one update', async () => {
+    await hydrateLinearMcpConnectionAfterOauth({
+      connection: {
+        id: 'connection-1',
+        connectionRole: 'user',
+        userId: 'roomote-user-1',
+        authConfig: { type: 'oauth_client', client_id: 'client-1' },
+      } as never,
+      tokens: {
+        access_token: 'access-token',
+        refresh_token: 'refresh-token',
+        expires_in: 3600,
+        scope: 'read write',
+      },
+    });
+
+    expect(dbUpdateMock).toHaveBeenCalledTimes(1);
+    expect(dbUpdateSetMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accessToken: 'access-token',
+        refreshToken: 'refresh-token',
+        tokenExpiresAt: expect.any(Date),
+        scopes: ['read', 'write'],
+        authStatus: 'authenticated',
+        enabled: true,
+        authConfig: expect.objectContaining({
+          client_id: 'client-1',
+          linearOrganizationId: 'linear-org-1',
+          linearUserId: 'linear-user-1',
+        }),
+      }),
+    );
+  });
+
+  it('routes the first replayed session before starting its task', async () => {
+    const replay = {
+      mcpId: 'linear',
+      sessionId: 'session-1',
+      payload,
+      metadata: {
+        linearOrganizationId: 'linear-org-1',
+        linearUserId: 'linear-user-1',
+      },
+    };
+    getMcpOauthReplayMock.mockResolvedValue(replay);
+    consumeMcpOauthReplayMock.mockResolvedValue(replay);
+    resolveLinearTaskDestinationMock.mockResolvedValue({
+      status: 'routed',
+      destination: {
+        workspaceSelection: { environmentId: 'env-api' },
+        workspaceDisplayName: 'API',
+        workspaceType: 'environment',
+        kickoffMessage: 'I will inspect the retry path.',
+      },
+    });
+    createLinearAgentRunMock.mockResolvedValue({
+      status: 'ok',
+      runId: 42,
+      taskId: 'task-42',
+    });
+    emitThoughtMock.mockResolvedValue({ success: true });
+    updateSessionExternalUrlsMock.mockResolvedValue({ success: true });
+
+    await hydrateLinearMcpConnectionAfterOauth({
+      connection: {
+        id: 'user-connection-1',
+        connectionRole: 'user',
+        userId: 'roomote-user-1',
+        authConfig: null,
+      } as never,
+      tokens: { access_token: 'user-token' },
+      replayToken: 'replay-token',
+    });
+
+    expect(resolveLinearTaskDestinationMock).toHaveBeenCalledWith({
+      payload,
+      agentSession: payload.agentSession,
+      userId: 'roomote-user-1',
+      linearClient: expect.any(Object),
+      apiBaseUrl: 'https://api.roomote.example',
+    });
+    expect(createLinearAgentRunMock).toHaveBeenCalledWith({
+      agentSession: payload.agentSession,
+      payload,
+      userId: 'roomote-user-1',
+      repo: undefined,
+      environmentId: 'env-api',
+    });
+    expect(emitThoughtMock).toHaveBeenNthCalledWith(
+      1,
+      'session-1',
+      'Getting started...',
+      true,
+    );
+    expect(emitThoughtMock).toHaveBeenNthCalledWith(
+      2,
+      'session-1',
+      'Getting started on your task in API',
+      true,
+    );
+    expect(updateSessionExternalUrlsMock).toHaveBeenCalledWith('session-1', [
+      {
+        label: 'Open task',
+        url: 'https://public.roomote.example/task/task-42',
+      },
+    ]);
+  });
+});
diff --git a/apps/web/src/lib/server/mcp-linear.ts b/apps/web/src/lib/server/mcp-linear.ts
index 3f86fc06e..208c1b0e9 100644
--- a/apps/web/src/lib/server/mcp-linear.ts
+++ b/apps/web/src/lib/server/mcp-linear.ts
@@ -1,5 +1,6 @@
 import { LinearClient } from '@linear/sdk';
 
+import { buildTaskStartingText } from '@roomote/communication/chat-messages';
 import {
   db,
   mcpConnections,
@@ -9,6 +10,8 @@ import {
 import {
   consumeMcpOauthReplay,
   findLinearDeploymentMcpConnection,
+  getMcpOauthReplay,
+  getValidAccessToken,
   getLinearDeploymentMetadata,
   LINEAR_ORG_CONNECTION_ROLE,
   LINEAR_USER_CONNECTION_ROLE,
@@ -18,20 +21,55 @@ import {
   createLinearClient,
   enrichSessionComments,
   parseAgentSessionEventPayload,
+  resolveLinearTaskDestination,
 } from '@roomote/linear';
+import type { OAuthTokens } from '@roomote/types';
+
+import { Env } from '@/lib/server/env';
+import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
 
 type McpConnectionRecord = Awaited<
   ReturnType<typeof db.query.mcpConnections.findFirst>
 >;
 
-async function updateLinearConnectionMetadata(input: {
+export class LinearReplayIdentityMismatchError extends Error {
+  constructor() {
+    super('The authorized Linear account does not match the requested session');
+    this.name = 'LinearReplayIdentityMismatchError';
+  }
+}
+
+function replayMatchesLinearIdentity(
+  replay: { mcpId: string; metadata: unknown },
+  identity: { linearOrganizationId: string; linearUserId: string },
+) {
+  if (
+    replay.mcpId !== 'linear' ||
+    !replay.metadata ||
+    typeof replay.metadata !== 'object'
+  ) {
+    return false;
+  }
+
+  const metadata = replay.metadata as Record<string, unknown>;
+  return (
+    metadata.linearOrganizationId === identity.linearOrganizationId &&
+    metadata.linearUserId === identity.linearUserId
+  );
+}
+
+async function storeLinearConnection(input: {
   connection: NonNullable<McpConnectionRecord>;
+  tokens: OAuthTokens;
   linearOrganizationId: string;
   linearOrganizationName?: string | null;
   linearOrganizationUrlKey?: string | null;
   appUserId?: string;
   linearUserId?: string;
 }) {
+  const tokenExpiresAt = input.tokens.expires_in
+    ? new Date(Date.now() + input.tokens.expires_in * 1000)
+    : null;
   const authConfig =
     input.connection.authConfig &&
     typeof input.connection.authConfig === 'object'
@@ -49,6 +87,14 @@ async function updateLinearConnectionMetadata(input: {
         ...(input.appUserId ? { appUserId: input.appUserId } : {}),
         ...(input.linearUserId ? { linearUserId: input.linearUserId } : {}),
       } as NonNullable<McpConnectionRecord>['authConfig'],
+      accessToken: input.tokens.access_token,
+      refreshToken: input.tokens.refresh_token || null,
+      tokenExpiresAt,
+      scopes: input.tokens.scope
+        ? input.tokens.scope.split(/[\s,]+/).filter(Boolean)
+        : [],
+      authStatus: 'authenticated',
+      enabled: true,
       updatedAt: new Date(),
     })
     .where(eq(mcpConnections.id, input.connection.id));
@@ -56,16 +102,16 @@ async function updateLinearConnectionMetadata(input: {
 
 async function resumeLinearReplay(input: {
   replayToken: string;
-  connection: NonNullable<McpConnectionRecord>;
   userId: string;
-  accessToken: string;
+  linearOrganizationId: string;
+  linearUserId: string;
 }) {
   const replay = await consumeMcpOauthReplay(input.replayToken);
   if (!replay) {
     return;
   }
 
-  if (replay.mcpId !== 'linear') {
+  if (!replayMatchesLinearIdentity(replay, input)) {
     return;
   }
 
@@ -86,7 +132,15 @@ async function resumeLinearReplay(input: {
     return;
   }
 
-  const linearClient = createLinearClient(input.accessToken);
+  const deploymentAccessToken = await getValidAccessToken(
+    deploymentConnection.id,
+    'https://mcp.linear.app/mcp',
+  );
+  if (!deploymentAccessToken) {
+    throw new Error('Failed to resolve the Linear app access token');
+  }
+
+  const linearClient = createLinearClient(deploymentAccessToken);
   const payload = parseResult.data;
   const sessionId = payload.agentSession.id;
 
@@ -96,11 +150,48 @@ async function resumeLinearReplay(input: {
     linearClient,
     payload.agentSession,
   );
+  const destinationResult = await resolveLinearTaskDestination({
+    payload,
+    agentSession: enrichedSession,
+    userId: input.userId,
+    linearClient,
+    apiBaseUrl: Env.TRPC_URL ?? Env.R_APP_URL,
+  });
+
+  if (destinationResult.status === 'platform_answer') {
+    await linearClient.emitResponse(sessionId, destinationResult.answer);
+    return;
+  }
+
+  if (destinationResult.status === 'awaiting_selection') {
+    return;
+  }
+
+  if (destinationResult.status === 'error') {
+    await linearClient.emitError(
+      sessionId,
+      `Failed to start workspace selection: ${destinationResult.message}`,
+    );
+    return;
+  }
+
+  const { destination } = destinationResult;
+
+  await linearClient.emitThought(
+    sessionId,
+    buildTaskStartingText({
+      workspaceDisplayName: destination.workspaceDisplayName,
+      kickoffMessage: destination.kickoffMessage,
+    }),
+    true,
+  );
 
   const runResult = await createLinearAgentRun({
     agentSession: enrichedSession,
     payload,
     userId: input.userId,
+    repo: destination.workspaceSelection.repo,
+    environmentId: destination.workspaceSelection.environmentId,
   });
 
   if (runResult.status === 'error') {
@@ -112,22 +203,22 @@ async function resumeLinearReplay(input: {
   }
 
   if ('taskId' in runResult) {
-    const baseUrl = process.env.R_APP_URL;
-    if (baseUrl) {
-      await linearClient.updateSessionExternalUrls(sessionId, [
-        { label: 'Open task', url: `${baseUrl}/task/${runResult.taskId}` },
-      ]);
-    }
+    const baseUrl = getPublicAppUrl(Env);
+    await linearClient.updateSessionExternalUrls(sessionId, [
+      { label: 'Open task', url: `${baseUrl}/task/${runResult.taskId}` },
+    ]);
   }
 }
 
 export async function hydrateLinearMcpConnectionAfterOauth(input: {
   connection: NonNullable<McpConnectionRecord>;
-  accessToken: string;
+  tokens: OAuthTokens;
   replayToken?: string | null;
   enabledByUserId?: string;
 }) {
-  const viewerClient = new LinearClient({ accessToken: input.accessToken });
+  const viewerClient = new LinearClient({
+    accessToken: input.tokens.access_token,
+  });
   const viewer = await viewerClient.viewer;
   const organization = await viewer.organization;
 
@@ -136,8 +227,9 @@ export async function hydrateLinearMcpConnectionAfterOauth(input: {
   }
 
   if (input.connection.connectionRole === LINEAR_ORG_CONNECTION_ROLE) {
-    await updateLinearConnectionMetadata({
+    await storeLinearConnection({
       connection: input.connection,
+      tokens: input.tokens,
       linearOrganizationId: organization.id,
       linearOrganizationName: organization.name,
       linearOrganizationUrlKey: organization.urlKey ?? null,
@@ -166,8 +258,22 @@ export async function hydrateLinearMcpConnectionAfterOauth(input: {
   }
 
   if (input.connection.connectionRole === LINEAR_USER_CONNECTION_ROLE) {
-    await updateLinearConnectionMetadata({
+    if (input.replayToken) {
+      const replay = await getMcpOauthReplay(input.replayToken);
+      if (
+        !replay ||
+        !replayMatchesLinearIdentity(replay, {
+          linearOrganizationId: organization.id,
+          linearUserId: viewer.id,
+        })
+      ) {
+        throw new LinearReplayIdentityMismatchError();
+      }
+    }
+
+    await storeLinearConnection({
       connection: input.connection,
+      tokens: input.tokens,
       linearOrganizationId: organization.id,
       linearUserId: viewer.id,
     });
@@ -175,9 +281,9 @@ export async function hydrateLinearMcpConnectionAfterOauth(input: {
     if (input.replayToken && input.connection.userId) {
       await resumeLinearReplay({
         replayToken: input.replayToken,
-        connection: input.connection,
         userId: input.connection.userId,
-        accessToken: input.accessToken,
+        linearOrganizationId: organization.id,
+        linearUserId: viewer.id,
       });
     }
   }
diff --git a/apps/web/src/lib/server/mcp-static-oauth.test.ts b/apps/web/src/lib/server/mcp-static-oauth.test.ts
new file mode 100644
index 000000000..1eab9d7de
--- /dev/null
+++ b/apps/web/src/lib/server/mcp-static-oauth.test.ts
@@ -0,0 +1,62 @@
+import { getMcpIntegration } from '@roomote/types';
+
+import {
+  getStaticOauthReadiness,
+  getStaticOauthEnvPartnerKey,
+  resolveStaticOauthClientInformation,
+} from './mcp-static-oauth';
+
+describe('Linear static OAuth configuration', () => {
+  const linear = getMcpIntegration('linear');
+
+  it('pairs and resolves the configured client credentials', () => {
+    expect(getStaticOauthEnvPartnerKey('R_LINEAR_CLIENT_ID')).toBe(
+      'R_LINEAR_CLIENT_SECRET',
+    );
+    expect(
+      resolveStaticOauthClientInformation(
+        {
+          R_LINEAR_CLIENT_ID: 'linear-client',
+          R_LINEAR_CLIENT_SECRET: 'linear-secret',
+        },
+        linear!,
+      ),
+    ).toEqual({
+      client_id: 'linear-client',
+      client_secret: 'linear-secret',
+      token_endpoint_auth_method: 'client_secret_post',
+    });
+  });
+
+  it('rejects partial credential configuration', () => {
+    expect(
+      resolveStaticOauthClientInformation(
+        { R_LINEAR_CLIENT_ID: 'linear-client' },
+        linear!,
+      ),
+    ).toBeUndefined();
+  });
+
+  it.each([
+    {
+      env: {
+        R_LINEAR_CLIENT_ID: 'linear-client',
+        R_LINEAR_CLIENT_SECRET: 'linear-secret',
+      },
+      expected: 'ready',
+    },
+    { env: {}, expected: 'missing' },
+    {
+      env: { R_LINEAR_CLIENT_ID: 'linear-client' },
+      expected: 'partial',
+    },
+  ] as const)('reports $expected OAuth readiness', ({ env, expected }) => {
+    expect(getStaticOauthReadiness(env, linear!)).toBe(expected);
+  });
+
+  it('reports that integrations without static credentials need no setup', () => {
+    expect(getStaticOauthReadiness({}, getMcpIntegration('notion')!)).toBe(
+      'not_required',
+    );
+  });
+});
diff --git a/apps/web/src/lib/server/mcp-static-oauth.ts b/apps/web/src/lib/server/mcp-static-oauth.ts
index 80711cfc1..9ef3be6ab 100644
--- a/apps/web/src/lib/server/mcp-static-oauth.ts
+++ b/apps/web/src/lib/server/mcp-static-oauth.ts
@@ -1,4 +1,4 @@
-import type { McpIntegration } from '@roomote/types';
+import { MCP_INTEGRATIONS, type McpIntegration } from '@roomote/types';
 
 type StaticOauthClientEnv = NonNullable<McpIntegration['oauthClientEnv']>;
 type StaticOauthPairResolution =
@@ -10,12 +10,37 @@ type StaticOauthPairResolution =
       status: 'missing' | 'partial';
     };
 
+export type StaticOauthReadiness =
+  | 'not_required'
+  | 'ready'
+  | 'missing'
+  | 'partial';
+
 const STATIC_OAUTH_FALLBACKS: Partial<Record<string, StaticOauthClientEnv[]>> =
   {};
 
-const STATIC_OAUTH_ENV_KEYS = new Set<string>();
-
-const STATIC_OAUTH_ENV_PARTNERS: Record<string, string> = {};
+const STATIC_OAUTH_ENV_PAIRS = MCP_INTEGRATIONS.flatMap((integration) => {
+  const clientIdEnv = integration.oauthClientEnv?.clientIdEnv;
+  const clientSecretEnv = integration.oauthClientEnv?.clientSecretEnv;
+
+  return clientIdEnv && clientSecretEnv
+    ? [[clientIdEnv, clientSecretEnv] as const]
+    : [];
+});
+
+const STATIC_OAUTH_ENV_KEYS = new Set(
+  STATIC_OAUTH_ENV_PAIRS.flatMap(([clientIdEnv, clientSecretEnv]) => [
+    clientIdEnv,
+    clientSecretEnv,
+  ]),
+);
+
+const STATIC_OAUTH_ENV_PARTNERS = Object.fromEntries(
+  STATIC_OAUTH_ENV_PAIRS.flatMap(([clientIdEnv, clientSecretEnv]) => [
+    [clientIdEnv, clientSecretEnv],
+    [clientSecretEnv, clientIdEnv],
+  ]),
+);
 
 export function getStaticOauthEnvPartnerKey(key: string): string | undefined {
   return STATIC_OAUTH_ENV_PARTNERS[key];
@@ -117,7 +142,7 @@ function resolveStaticOauthCandidateInformation(
   };
 }
 
-export function getStaticOauthEnvCandidates(
+function getStaticOauthEnvCandidates(
   integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
 ): StaticOauthClientEnv[] {
   if (!integration.oauthClientEnv) {
@@ -130,7 +155,20 @@ export function getStaticOauthEnvCandidates(
   ];
 }
 
-export function resolveStaticOauthClientInformation(
+export function getStaticOauthEnvKeys(
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+): string[] {
+  return Array.from(
+    new Set(
+      getStaticOauthEnvCandidates(integration).flatMap((candidate) => [
+        candidate.clientIdEnv,
+        ...(candidate.clientSecretEnv ? [candidate.clientSecretEnv] : []),
+      ]),
+    ),
+  );
+}
+
+function resolveStaticOauthIntegration(
   env: unknown,
   integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
 ) {
@@ -141,18 +179,45 @@ export function resolveStaticOauthClientInformation(
     );
 
     if (candidateInformation.status === 'configured') {
-      return {
-        client_id: candidateInformation.client_id,
-        client_secret: candidateInformation.client_secret,
-        token_endpoint_auth_method:
-          candidateInformation.token_endpoint_auth_method,
-      };
+      return candidateInformation;
     }
 
     if (candidateInformation.status === 'partial') {
-      return undefined;
+      return candidateInformation;
     }
   }
 
-  return undefined;
+  return { status: 'missing' as const };
+}
+
+export function resolveStaticOauthClientInformation(
+  env: unknown,
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+) {
+  const resolution = resolveStaticOauthIntegration(env, integration);
+
+  if (resolution.status !== 'configured') {
+    return undefined;
+  }
+
+  return {
+    client_id: resolution.client_id,
+    client_secret: resolution.client_secret,
+    token_endpoint_auth_method: resolution.token_endpoint_auth_method,
+  };
+}
+
+export function getStaticOauthReadiness(
+  env: unknown,
+  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
+): StaticOauthReadiness {
+  const candidates = getStaticOauthEnvCandidates(integration);
+
+  if (candidates.length === 0) {
+    return 'not_required';
+  }
+
+  const resolution = resolveStaticOauthIntegration(env, integration);
+
+  return resolution.status === 'configured' ? 'ready' : resolution.status;
 }
diff --git a/apps/web/src/lib/server/out-of-band-context.test.ts b/apps/web/src/lib/server/out-of-band-context.test.ts
new file mode 100644
index 000000000..4eba0c8ea
--- /dev/null
+++ b/apps/web/src/lib/server/out-of-band-context.test.ts
@@ -0,0 +1,26 @@
+vi.mock('@roomote/db/server', () => ({
+  claimPendingOutOfBandTaskMessages: vi.fn(),
+  releaseClaimedOutOfBandTaskMessages: vi.fn(),
+}));
+
+import { withOutOfBandContext } from './out-of-band-context';
+
+describe('withOutOfBandContext', () => {
+  it('preserves marker-like user text after the injected context', () => {
+    const prompt =
+      '<out_of_band_context> user-supplied text </out_of_band_context>';
+
+    expect(
+      withOutOfBandContext(
+        {
+          contextBlock:
+            '<out_of_band_context>\ntrusted context\n</out_of_band_context>',
+          messageIds: ['message-1'],
+        },
+        prompt,
+      ),
+    ).toBe(
+      '<out_of_band_context>\ntrusted context\n</out_of_band_context>\n\n<out_of_band_context> user-supplied text </out_of_band_context>',
+    );
+  });
+});
diff --git a/apps/web/src/trpc/commands/comms/index.test.ts b/apps/web/src/trpc/commands/comms/index.test.ts
index 12f7d6373..081229e1a 100644
--- a/apps/web/src/trpc/commands/comms/index.test.ts
+++ b/apps/web/src/trpc/commands/comms/index.test.ts
@@ -17,6 +17,7 @@ const {
   mockTelegramRegisterWebhook,
   mockResolveDiscordRuntimeCredentials,
   mockValidateDiscordBotToken,
+  mockValidateTeamsBotCredentials,
   mockDiscordRegisterCommands,
   mockDiscordListGuilds,
   mockDiscordListGuildChannels,
@@ -55,6 +56,7 @@ const {
     identityErrorCode: null,
   })),
   mockValidateDiscordBotToken: vi.fn(),
+  mockValidateTeamsBotCredentials: vi.fn(async () => undefined),
   mockDiscordRegisterCommands: vi.fn(),
   mockDiscordListGuilds: vi.fn(
     async () =>
@@ -175,6 +177,21 @@ vi.mock('@roomote/communication/discord-provider', () => ({
     'Discord requires a tag for new posts in this forum, but no tag is available for Roomote to select.',
 }));
 
+vi.mock('@roomote/communication/teams-credential-validation', () => ({
+  validateTeamsBotCredentials: mockValidateTeamsBotCredentials,
+  TeamsBotCredentialValidationError: class TeamsBotCredentialValidationError extends Error {
+    constructor(
+      readonly code: string,
+      message: string,
+      readonly field: string | null = null,
+      readonly detail: string | null = null,
+    ) {
+      super(message);
+      this.name = 'TeamsBotCredentialValidationError';
+    }
+  },
+}));
+
 vi.mock('@/lib/server/env', () => ({
   Env: { R_APP_URL: 'https://app.example.com' },
 }));
@@ -193,6 +210,8 @@ vi.mock('../environment-variables', () => ({
     mockUpsertDeploymentEnvironmentVariables,
 }));
 
+import { TeamsBotCredentialValidationError } from '@roomote/communication/teams-credential-validation';
+
 import {
   classifyTelegramWebhookCheckError,
   clearCommsAuthConfigCommand,
@@ -241,6 +260,7 @@ describe('comms commands', () => {
       botUsername: null,
     });
     mockTelegramGetWebhookInfo.mockReset();
+    mockValidateTeamsBotCredentials.mockResolvedValue(undefined);
     mockDiscordListGuilds.mockResolvedValue([]);
     mockDiscordListGuildChannels.mockResolvedValue([]);
     mockDiscordDiagnoseChannelPermissions.mockReset();
@@ -924,5 +944,118 @@ describe('comms commands', () => {
         ]),
       );
     });
+
+    it('verifies the Teams bot credentials a Microsoft save will produce', async () => {
+      mockDbTransaction.mockImplementation(async (callback) => {
+        return callback({} as never);
+      });
+
+      await saveCommsAuthConfigCommand(buildMockAuth(), {
+        provider: 'microsoft',
+        values: {
+          R_MICROSOFT_CLIENT_ID: 'ms-client-id',
+          R_MICROSOFT_CLIENT_SECRET: 'ms-client-secret',
+          R_MICROSOFT_TENANT_ID: 'ms-tenant-id',
+        },
+      });
+
+      expect(mockValidateTeamsBotCredentials).toHaveBeenCalledWith(
+        expect.objectContaining({
+          appId: 'ms-client-id',
+          appPassword: 'ms-client-secret',
+          tenantId: 'ms-tenant-id',
+        }),
+      );
+    });
+
+    it('rejects a Microsoft save when Microsoft rejects the credentials', async () => {
+      mockDbTransaction.mockImplementation(async (callback) => {
+        return callback({} as never);
+      });
+      mockValidateTeamsBotCredentials.mockRejectedValue(
+        new TeamsBotCredentialValidationError(
+          'invalid_app_password',
+          'Microsoft rejected the client secret.',
+          'app_password',
+          'AADSTS7000215: Invalid client secret provided.',
+        ),
+      );
+
+      await expect(
+        saveCommsAuthConfigCommand(buildMockAuth(), {
+          provider: 'microsoft',
+          values: {
+            R_MICROSOFT_CLIENT_ID: '00000000-0000-0000-0000-000000000001',
+            R_MICROSOFT_CLIENT_SECRET: 'not-a-real-secret',
+            R_MICROSOFT_TENANT_ID: '00000000-0000-0000-0000-000000000002',
+          },
+        }),
+      ).rejects.toThrow(
+        /Client Secret Value \(R_MICROSOFT_CLIENT_SECRET\).*AADSTS7000215/su,
+      );
+
+      expect(mockUpsertDeploymentEnvironmentVariables).not.toHaveBeenCalled();
+    });
+
+    it('names the dedicated Teams bot field when that credential pair is in use', async () => {
+      mockDbTransaction.mockImplementation(async (callback) => {
+        return callback({} as never);
+      });
+      mockValidateTeamsBotCredentials.mockRejectedValue(
+        new TeamsBotCredentialValidationError(
+          'invalid_app_id',
+          'Microsoft rejected the app (client) id.',
+          'app_id',
+          "AADSTS700016: Application with identifier 'bot-app-id' was not found in the directory.",
+        ),
+      );
+
+      await expect(
+        saveCommsAuthConfigCommand(buildMockAuth(), {
+          provider: 'microsoft',
+          values: {
+            R_MICROSOFT_CLIENT_ID: 'ms-client-id',
+            R_MICROSOFT_CLIENT_SECRET: 'ms-client-secret',
+            R_MICROSOFT_TENANT_ID: 'ms-tenant-id',
+            R_TEAMS_BOT_APP_ID: 'bot-app-id',
+            R_TEAMS_BOT_APP_PASSWORD: 'bot-secret',
+          },
+        }),
+      ).rejects.toThrow(/Teams Bot App ID \(R_TEAMS_BOT_APP_ID\)/u);
+
+      expect(mockValidateTeamsBotCredentials).toHaveBeenCalledWith(
+        expect.objectContaining({
+          appId: 'bot-app-id',
+          appPassword: 'bot-secret',
+        }),
+      );
+    });
+
+    it('keeps a Microsoft save blocked when Microsoft cannot be reached', async () => {
+      mockDbTransaction.mockImplementation(async (callback) => {
+        return callback({} as never);
+      });
+      mockValidateTeamsBotCredentials.mockRejectedValue(
+        new TeamsBotCredentialValidationError(
+          'unreachable',
+          'Could not reach Microsoft to verify the Teams bot credentials (timed out).',
+          null,
+          'The operation timed out.',
+        ),
+      );
+
+      await expect(
+        saveCommsAuthConfigCommand(buildMockAuth(), {
+          provider: 'microsoft',
+          values: {
+            R_MICROSOFT_CLIENT_ID: 'ms-client-id',
+            R_MICROSOFT_CLIENT_SECRET: 'ms-client-secret',
+            R_MICROSOFT_TENANT_ID: 'ms-tenant-id',
+          },
+        }),
+      ).rejects.toThrow(/login\.microsoftonline\.com/u);
+
+      expect(mockUpsertDeploymentEnvironmentVariables).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/apps/web/src/trpc/commands/comms/index.ts b/apps/web/src/trpc/commands/comms/index.ts
index 860eacd1e..57bf7d67f 100644
--- a/apps/web/src/trpc/commands/comms/index.ts
+++ b/apps/web/src/trpc/commands/comms/index.ts
@@ -59,6 +59,10 @@ import {
   getPersistedEnvironmentVariableValues,
   upsertDeploymentEnvironmentVariables,
 } from '../environment-variables';
+import {
+  assertTeamsBotCredentialsAuthenticate,
+  invalidateTeamsBotCredentialCheckCache,
+} from '../teams/bot-credential-check';
 
 type AdditionalCommsProviderId = 'telegram' | 'discord';
 type CommsProviderId = SetupAuthProviderId | AdditionalCommsProviderId;
@@ -930,6 +934,13 @@ export async function saveCommsAuthConfigCommand(
     }
   }
 
+  // Prove the Teams bot credentials authenticate before storing them; a wrong
+  // app id or secret otherwise only surfaces as unexplained 401s on the
+  // messaging endpoint, long after setup reported success.
+  if (input.provider === 'microsoft') {
+    await assertTeamsBotCredentialsAuthenticate(input.values);
+  }
+
   await db.transaction(async (tx) => {
     const persistedEnvVarNames = await getPersistedEnvironmentVariableNames(tx);
     const authSetup = buildSetupAuthStatus({
@@ -1101,6 +1112,7 @@ export async function saveCommsAuthConfigCommand(
 
   if (input.provider === 'microsoft') {
     invalidateTeamsBotRuntimeCredentialsCache();
+    invalidateTeamsBotCredentialCheckCache();
   }
 
   if (input.provider === 'discord') {
@@ -1159,6 +1171,7 @@ export async function clearCommsAuthConfigCommand(
 
   if (input.provider === 'microsoft') {
     invalidateTeamsBotRuntimeCredentialsCache();
+    invalidateTeamsBotCredentialCheckCache();
   }
 
   if (input.provider === 'discord') {
diff --git a/apps/web/src/trpc/commands/environments/index.test.ts b/apps/web/src/trpc/commands/environments/index.test.ts
index b65bedf87..3e2a02847 100644
--- a/apps/web/src/trpc/commands/environments/index.test.ts
+++ b/apps/web/src/trpc/commands/environments/index.test.ts
@@ -3,6 +3,7 @@ const {
   mockDbSelect,
   mockEnqueueTask,
   mockGetBranches,
+  mockGetRepositoryEmptyStates,
   mockGetRepositories,
   mockBeginEnvironmentVerification,
   mockActiveVerificationRuns,
@@ -14,6 +15,7 @@ const {
     id: 'run-env-definition-1',
   }),
   mockGetBranches: vi.fn(),
+  mockGetRepositoryEmptyStates: vi.fn(async () => new Map<string, boolean>()),
   mockGetRepositories: vi.fn().mockResolvedValue([
     {
       id: 'repo-1',
@@ -38,6 +40,7 @@ vi.mock('@roomote/cloud-agents/server', () => ({
 
 vi.mock('@roomote/github', () => ({
   getBranches: mockGetBranches,
+  getRepositoryEmptyStates: mockGetRepositoryEmptyStates,
 }));
 
 vi.mock('@roomote/db/server', () => ({
@@ -185,6 +188,45 @@ describe('startEnvironmentDefinitionTaskCommand', () => {
       }),
     );
   });
+
+  it('flags empty repositories in the kickoff prompt instead of blocking', async () => {
+    mockGetRepositoryEmptyStates.mockResolvedValueOnce(
+      new Map([
+        ['repo-1', true],
+        ['repo-2', false],
+      ]),
+    );
+
+    await startEnvironmentDefinitionTaskCommand(buildMockAuth(), {
+      repositoryIds: ['repo-2', 'repo-1'],
+    });
+
+    expect(mockGetRepositoryEmptyStates).toHaveBeenCalledWith({
+      repositoryIds: ['repo-1', 'repo-2'],
+    });
+
+    const enqueueInput = mockEnqueueTask.mock.calls[0]?.[0] as {
+      task: { payload: { description: string } };
+    };
+    // Only the empty repo appears in the bootstrap list; acme/web has
+    // commits, so the list ends right after acme/api.
+    expect(enqueueInput.task.payload.description).toContain(
+      'These repositories are brand new and have no commits yet:\n- acme/api\n\nFor each empty repository',
+    );
+  });
+
+  it('keeps the kickoff prompt unchanged when no selected repository is empty', async () => {
+    await startEnvironmentDefinitionTaskCommand(buildMockAuth(), {
+      repositoryIds: ['repo-1'],
+    });
+
+    const enqueueInput = mockEnqueueTask.mock.calls[0]?.[0] as {
+      task: { payload: { description: string } };
+    };
+    expect(enqueueInput.task.payload.description).not.toContain(
+      'brand new and have no commits',
+    );
+  });
 });
 
 describe('retryEnvironmentVerificationCommand', () => {
diff --git a/apps/web/src/trpc/commands/environments/index.ts b/apps/web/src/trpc/commands/environments/index.ts
index b781300de..4802f39ac 100644
--- a/apps/web/src/trpc/commands/environments/index.ts
+++ b/apps/web/src/trpc/commands/environments/index.ts
@@ -828,11 +828,28 @@ export async function startEnvironmentDefinitionTaskCommand(
     throw new Error(modelSelection.error);
   }
 
-  let prompt = buildCreateEnvironmentDefinitionPrompt(
-    selectedRepositoryFullNames,
-  );
+  let prompt: string;
+
+  if (!input.environmentId) {
+    // Brand-new repos with no commits are a supported setup target: the
+    // environment-setup skill bootstraps them with an initial commit, so the
+    // prompt flags which selected repositories are empty. Non-GitHub repos
+    // never appear in the empty-state map and are treated as non-empty.
+    const emptyStates = await GitHub.getRepositoryEmptyStates({
+      repositoryIds: selectedRepositories.map((repository) => repository.id),
+    });
 
-  if (input.environmentId) {
+    const emptyRepositoryFullNames = selectedRepositories
+      .filter((repository) => emptyStates.get(repository.id) === true)
+      .map((repository) => repository.fullName);
+
+    prompt = buildCreateEnvironmentDefinitionPrompt(
+      selectedRepositoryFullNames,
+      emptyRepositoryFullNames.length > 0
+        ? { emptyRepositoryFullNames }
+        : undefined,
+    );
+  } else {
     const [environment] = await db
       .select({
         id: environments.id,
diff --git a/apps/web/src/trpc/commands/github/mutations.test.ts b/apps/web/src/trpc/commands/github/mutations.test.ts
index fc066fc7d..a71f291d1 100644
--- a/apps/web/src/trpc/commands/github/mutations.test.ts
+++ b/apps/web/src/trpc/commands/github/mutations.test.ts
@@ -165,6 +165,7 @@ describe('GitHub App manifest commands', () => {
         issues: 'write',
         merge_queues: 'read',
         metadata: 'read',
+        organization_projects: 'write',
         pull_requests: 'write',
         security_events: 'read',
         statuses: 'read',
diff --git a/apps/web/src/trpc/commands/github/mutations.ts b/apps/web/src/trpc/commands/github/mutations.ts
index bb9945cc5..0dc1fcd91 100644
--- a/apps/web/src/trpc/commands/github/mutations.ts
+++ b/apps/web/src/trpc/commands/github/mutations.ts
@@ -22,6 +22,10 @@ import type { UserAuthSuccess } from '@/types';
 import { Env } from '@/lib/server';
 import { encodeRecord } from '@/lib';
 import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
+import {
+  buildDeploymentAppName,
+  DEPLOYMENT_APP_DESCRIPTION,
+} from '@/lib/server/deployment-app-name';
 import {
   createSignedGitHubAuthState,
   decodeSignedGitHubAuthState,
@@ -81,8 +85,6 @@ const GITHUB_APP_DEFAULT_EVENTS = [
   'workflow_run',
 ] as const;
 
-const GITHUB_APP_MANIFEST_DESCRIPTION = 'Cloud coding agents for all';
-
 type GitHubAppManifest = {
   name: string;
   description: string;
@@ -103,6 +105,7 @@ type GitHubAppManifest = {
     issues: 'write';
     merge_queues: 'read';
     metadata: 'read';
+    organization_projects: 'write';
     pull_requests: 'write';
     security_events: 'read';
     statuses: 'read';
@@ -207,32 +210,12 @@ function getGitHubWebhookUrl() {
   return new URL('/api/webhooks/github', webhookBaseUrl).toString();
 }
 
-function buildGitHubManifestName() {
-  // GitHub enforces a 34-character maximum on GitHub App names.
-  const GITHUB_APP_NAME_MAX_LENGTH = 34;
-  const prefix = 'roomote-';
-
-  const host = new URL(getPublicAppUrl(Env)).hostname
-    .replace(/[^a-zA-Z0-9-]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-
-  if (!host) {
-    return 'roomote';
-  }
-
-  // Optionally prefix with `roomote-` when the deployment hostname does not
-  // already start with `roomote`, then trim the final name to GitHub's limit.
-  const candidate = host.startsWith('roomote') ? host : `${prefix}${host}`;
-
-  return candidate.slice(0, GITHUB_APP_NAME_MAX_LENGTH).replace(/-+$/g, '');
-}
-
 function buildGitHubAppManifest(): GitHubAppManifest {
   const callbackUrl = getGitHubCallbackUrl();
 
   return {
-    name: buildGitHubManifestName(),
-    description: GITHUB_APP_MANIFEST_DESCRIPTION,
+    name: buildDeploymentAppName(getPublicAppUrl(Env)),
+    description: DEPLOYMENT_APP_DESCRIPTION,
     url: callbackUrl,
     redirect_url: callbackUrl,
     setup_url: callbackUrl,
@@ -249,6 +232,7 @@ function buildGitHubAppManifest(): GitHubAppManifest {
       issues: 'write',
       merge_queues: 'read',
       metadata: 'read',
+      organization_projects: 'write',
       pull_requests: 'write',
       security_events: 'read',
       statuses: 'read',
diff --git a/apps/web/src/trpc/commands/linear/index.test.ts b/apps/web/src/trpc/commands/linear/index.test.ts
new file mode 100644
index 000000000..2799424c6
--- /dev/null
+++ b/apps/web/src/trpc/commands/linear/index.test.ts
@@ -0,0 +1,276 @@
+const {
+  envState,
+  deletedConnectionsState,
+  persistedEnvVarNamesState,
+  deleteDeploymentEnvironmentVariablesMock,
+  getPersistedEnvironmentVariableNamesMock,
+  resolveDeploymentEnvVarMock,
+  upsertDeploymentEnvironmentVariablesMock,
+} = vi.hoisted(() => ({
+  envState: {} as Record<string, string | undefined>,
+  deletedConnectionsState: [] as Array<{ id: string }>,
+  persistedEnvVarNamesState: [] as string[],
+  deleteDeploymentEnvironmentVariablesMock: vi.fn(),
+  getPersistedEnvironmentVariableNamesMock: vi.fn(),
+  resolveDeploymentEnvVarMock: vi.fn(),
+  upsertDeploymentEnvironmentVariablesMock: vi.fn(),
+}));
+
+vi.mock('@/lib/server/env', () => ({ Env: envState }));
+vi.mock('@/lib/server/get-public-app-url', () => ({
+  getPublicAppUrl: () => 'https://roomote.example',
+}));
+vi.mock('../environment-variables', () => ({
+  deleteDeploymentEnvironmentVariables:
+    deleteDeploymentEnvironmentVariablesMock,
+  getPersistedEnvironmentVariableNames:
+    getPersistedEnvironmentVariableNamesMock,
+  upsertDeploymentEnvironmentVariables:
+    upsertDeploymentEnvironmentVariablesMock,
+}));
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    transaction: async (operation: (tx: unknown) => Promise<unknown>) =>
+      operation({
+        delete: () => ({
+          where: () => ({
+            returning: async () => deletedConnectionsState,
+          }),
+        }),
+        insert: () => ({
+          values: () => ({
+            onConflictDoUpdate: async () => undefined,
+          }),
+        }),
+      }),
+  },
+  resolveDeploymentEnvVar: resolveDeploymentEnvVarMock,
+  and: vi.fn(),
+  eq: vi.fn(),
+  isNull: vi.fn(),
+  mcpConnections: {
+    id: 'id',
+    mcpId: 'mcpId',
+    connectionRole: 'connectionRole',
+    userId: 'userId',
+  },
+  deploymentMcpEnablements: { mcpId: 'mcpId' },
+}));
+vi.mock('@roomote/sdk/server', () => ({
+  findLinearDeploymentMcpConnection: vi.fn(),
+  getLinearDeploymentMetadata: vi.fn(),
+  LINEAR_ORG_CONNECTION_ROLE: 'linear_org_install',
+}));
+
+import {
+  getLinearOauthSetupCommand,
+  removeLinearOauthSetupCommand,
+  saveLinearOauthSetupCommand,
+} from './index';
+
+const ADMIN = {
+  userId: 'admin-1',
+  isAdmin: true,
+} as Parameters<typeof getLinearOauthSetupCommand>[0];
+
+describe('Linear OAuth setup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    for (const key of Object.keys(envState)) {
+      delete envState[key];
+    }
+    deletedConnectionsState.splice(0);
+    persistedEnvVarNamesState.splice(0);
+    getPersistedEnvironmentVariableNamesMock.mockImplementation(
+      async () => persistedEnvVarNamesState,
+    );
+    resolveDeploymentEnvVarMock.mockResolvedValue(null);
+  });
+
+  it('builds a private Linear app manifest for this deployment', async () => {
+    const setup = await getLinearOauthSetupCommand(ADMIN);
+    const setupUrl = new URL(setup.manifestUrl);
+    const manifest = JSON.parse(setupUrl.searchParams.get('manifest')!);
+
+    expect(setup.callbackUrl).toBe(
+      'https://roomote.example/api/mcp-oauth/callback',
+    );
+    expect(setup.webhookUrl).toBe(
+      'https://roomote.example/api/webhooks/linear',
+    );
+    expect(manifest).toMatchObject({
+      schemaVersion: '1.0.0',
+      distribution: 'private',
+      display: {
+        description: 'Work from Linear with your own coding agent',
+        iconUrl: 'https://roomote.example/roomote-logo.png',
+      },
+      developer: { name: 'Roomote' },
+      oauth: {
+        client_name: 'Roomote',
+        redirect_uris: [setup.callbackUrl],
+      },
+      webhook: {
+        enabled: true,
+        url: setup.webhookUrl,
+        resourceTypes: ['AgentSessionEvent'],
+      },
+    });
+  });
+
+  it('identifies credentials saved in Roomote separately from runtime values', async () => {
+    persistedEnvVarNamesState.push(
+      'R_LINEAR_CLIENT_ID',
+      'R_LINEAR_CLIENT_SECRET',
+    );
+    envState.R_LINEAR_CLIENT_ID = 'runtime-client';
+    resolveDeploymentEnvVarMock.mockResolvedValue('configured');
+
+    const setup = await getLinearOauthSetupCommand(ADMIN);
+
+    expect(setup.fields).toEqual({
+      clientId: {
+        configured: true,
+        managedByEnvironment: true,
+        savedInRoomote: true,
+      },
+      clientSecret: {
+        configured: true,
+        managedByEnvironment: false,
+        savedInRoomote: true,
+      },
+      webhookSecret: {
+        configured: true,
+        managedByEnvironment: false,
+        savedInRoomote: false,
+      },
+    });
+  });
+
+  it('requires an administrator to view, save, or remove app setup', async () => {
+    const nonAdmin = { ...ADMIN, isAdmin: false };
+
+    await expect(getLinearOauthSetupCommand(nonAdmin)).rejects.toThrow(
+      'Unauthorized',
+    );
+    await expect(
+      saveLinearOauthSetupCommand(nonAdmin, {
+        clientId: 'client-id',
+        clientSecret: 'client-secret',
+        webhookSecret: 'webhook-secret',
+      }),
+    ).rejects.toThrow('Unauthorized');
+    await expect(removeLinearOauthSetupCommand(nonAdmin)).rejects.toThrow(
+      'Unauthorized',
+    );
+  });
+
+  it('removes saved credentials and disconnects the current workspace', async () => {
+    deletedConnectionsState.push({ id: 'linear-connection' });
+
+    const result = await removeLinearOauthSetupCommand(ADMIN);
+
+    expect(deleteDeploymentEnvironmentVariablesMock).toHaveBeenCalledWith(
+      expect.anything(),
+      [
+        'R_LINEAR_CLIENT_ID',
+        'R_LINEAR_CLIENT_SECRET',
+        'R_LINEAR_WEBHOOK_SECRET',
+      ],
+    );
+    expect(result).toEqual({ success: true });
+  });
+
+  it('saves all three credentials in the encrypted deployment store', async () => {
+    await saveLinearOauthSetupCommand(ADMIN, {
+      clientId: ' client-id ',
+      clientSecret: ' client-secret ',
+      webhookSecret: ' webhook-secret ',
+    });
+
+    expect(upsertDeploymentEnvironmentVariablesMock).toHaveBeenCalledWith(
+      expect.anything(),
+      {
+        userId: 'admin-1',
+        values: [
+          { name: 'R_LINEAR_CLIENT_ID', value: 'client-id' },
+          { name: 'R_LINEAR_CLIENT_SECRET', value: 'client-secret' },
+          { name: 'R_LINEAR_WEBHOOK_SECRET', value: 'webhook-secret' },
+        ],
+      },
+    );
+  });
+
+  it('requires an existing workspace to reconnect when its OAuth client changes', async () => {
+    deletedConnectionsState.push({ id: 'legacy-linear-connection' });
+
+    const result = await saveLinearOauthSetupCommand(ADMIN, {
+      clientId: 'new-client-id',
+      clientSecret: 'new-client-secret',
+      webhookSecret: 'new-webhook-secret',
+    });
+
+    expect(result.requiresReconnect).toBe(true);
+  });
+
+  it('keeps the workspace connected when only the webhook secret changes', async () => {
+    deletedConnectionsState.push({ id: 'current-linear-connection' });
+    resolveDeploymentEnvVarMock.mockResolvedValue('already-configured');
+
+    const result = await saveLinearOauthSetupCommand(ADMIN, {
+      clientId: '',
+      clientSecret: '',
+      webhookSecret: 'rotated-webhook-secret',
+    });
+
+    expect(result.requiresReconnect).toBe(false);
+  });
+
+  it('keeps saved values when an administrator leaves their fields blank', async () => {
+    resolveDeploymentEnvVarMock.mockResolvedValue('already-configured');
+
+    await saveLinearOauthSetupCommand(ADMIN, {
+      clientId: '',
+      clientSecret: '',
+      webhookSecret: '',
+    });
+
+    expect(upsertDeploymentEnvironmentVariablesMock).toHaveBeenCalledWith(
+      expect.anything(),
+      { userId: 'admin-1', values: [] },
+    );
+  });
+
+  it('does not copy runtime-managed credentials into the database', async () => {
+    envState.R_LINEAR_CLIENT_ID = 'runtime-client';
+    envState.R_LINEAR_CLIENT_SECRET = 'runtime-secret';
+    envState.R_LINEAR_WEBHOOK_SECRET = 'runtime-webhook-secret';
+    resolveDeploymentEnvVarMock.mockImplementation(
+      async (name: string, _db: unknown, runtimeEnv: Record<string, string>) =>
+        runtimeEnv[name] ?? null,
+    );
+
+    await saveLinearOauthSetupCommand(ADMIN, {
+      clientId: 'ignored-client',
+      clientSecret: 'ignored-secret',
+      webhookSecret: 'ignored-webhook-secret',
+    });
+
+    expect(upsertDeploymentEnvironmentVariablesMock).toHaveBeenCalledWith(
+      expect.anything(),
+      { userId: 'admin-1', values: [] },
+    );
+  });
+
+  it('requires every value that is not already configured', async () => {
+    await expect(
+      saveLinearOauthSetupCommand(ADMIN, {
+        clientId: 'client-id',
+        clientSecret: '',
+        webhookSecret: '',
+      }),
+    ).rejects.toThrow('client secret, webhook secret');
+
+    expect(upsertDeploymentEnvironmentVariablesMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/trpc/commands/linear/index.ts b/apps/web/src/trpc/commands/linear/index.ts
index dbb00625e..d93a98289 100644
--- a/apps/web/src/trpc/commands/linear/index.ts
+++ b/apps/web/src/trpc/commands/linear/index.ts
@@ -1,19 +1,19 @@
-import {
-  and,
-  db,
-  eq,
-  isNull,
-  mcpConnections,
-  deploymentMcpEnablements,
-} from '@roomote/db/server';
+import { db } from '@roomote/db/server';
 import {
   findLinearDeploymentMcpConnection,
   getLinearDeploymentMetadata,
-  LINEAR_ORG_CONNECTION_ROLE,
 } from '@roomote/sdk/server';
 
 import type { UserAuthSuccess } from '@/types';
 
+import { clearLinearDeploymentConnection } from './oauth-setup';
+
+export {
+  getLinearOauthSetupCommand,
+  removeLinearOauthSetupCommand,
+  saveLinearOauthSetupCommand,
+} from './oauth-setup';
+
 type LinearInstallationSummary = {
   id: string;
   authStatus: 'pending' | 'authenticated' | 'error' | null;
@@ -55,31 +55,7 @@ export async function disconnectLinearAppCommand(
       };
     }
 
-    await db
-      .delete(mcpConnections)
-      .where(
-        and(
-          eq(mcpConnections.mcpId, 'linear'),
-          eq(mcpConnections.connectionRole, LINEAR_ORG_CONNECTION_ROLE),
-          isNull(mcpConnections.userId),
-        ),
-      );
-
-    await db
-      .insert(deploymentMcpEnablements)
-      .values({
-        mcpId: 'linear',
-        enabled: false,
-        enabledByUserId: auth.userId,
-      })
-      .onConflictDoUpdate({
-        target: deploymentMcpEnablements.mcpId,
-        set: {
-          enabled: false,
-          enabledByUserId: auth.userId,
-          updatedAt: new Date(),
-        },
-      });
+    await clearLinearDeploymentConnection(db, auth.userId);
 
     return { success: true };
   } catch (error) {
diff --git a/apps/web/src/trpc/commands/linear/oauth-setup.ts b/apps/web/src/trpc/commands/linear/oauth-setup.ts
new file mode 100644
index 000000000..e134c6070
--- /dev/null
+++ b/apps/web/src/trpc/commands/linear/oauth-setup.ts
@@ -0,0 +1,253 @@
+import {
+  and,
+  db,
+  deploymentMcpEnablements,
+  eq,
+  isNull,
+  mcpConnections,
+  resolveDeploymentEnvVar,
+  type DatabaseOrTransaction,
+} from '@roomote/db/server';
+import { LINEAR_ORG_CONNECTION_ROLE } from '@roomote/sdk/server';
+
+import { Env } from '@/lib/server/env';
+import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
+import type { UserAuthSuccess } from '@/types';
+
+import {
+  deleteDeploymentEnvironmentVariables,
+  getPersistedEnvironmentVariableNames,
+  upsertDeploymentEnvironmentVariables,
+} from '../environment-variables';
+
+const LINEAR_OAUTH_ENV_FIELDS = {
+  clientId: 'R_LINEAR_CLIENT_ID',
+  clientSecret: 'R_LINEAR_CLIENT_SECRET',
+  webhookSecret: 'R_LINEAR_WEBHOOK_SECRET',
+} as const;
+
+type LinearOauthSetupField = keyof typeof LINEAR_OAUTH_ENV_FIELDS;
+
+type SaveLinearOauthSetupInput = Record<LinearOauthSetupField, string>;
+
+function assertAdmin(auth: Pick<UserAuthSuccess, 'isAdmin'>) {
+  if (!auth.isAdmin) {
+    throw new Error('Unauthorized');
+  }
+}
+
+function getRuntimeEnvValue(name: string): string | null {
+  const value = (Env as unknown as Record<string, unknown>)[name];
+  if (typeof value !== 'string') {
+    return null;
+  }
+
+  const normalizedValue = value.trim();
+  return normalizedValue || null;
+}
+
+function getLinearRuntimeEnv(): Partial<Record<string, string | undefined>> {
+  return Object.fromEntries(
+    Object.values(LINEAR_OAUTH_ENV_FIELDS).flatMap((envName) => {
+      const value = getRuntimeEnvValue(envName);
+      return value ? [[envName, value]] : [];
+    }),
+  );
+}
+
+function buildLinearOauthSetup(publicOrigin: string) {
+  const callbackUrl = new URL(
+    '/api/mcp-oauth/callback',
+    publicOrigin,
+  ).toString();
+  const webhookUrl = new URL('/api/webhooks/linear', publicOrigin).toString();
+  const manifest = {
+    $schema: 'https://linear.app/.well-known/oauth-app-manifest.schema.json',
+    schemaVersion: '1.0.0',
+    distribution: 'private',
+    display: {
+      description: 'Work from Linear with your own coding agent',
+      iconUrl: new URL('/roomote-logo.png', publicOrigin).toString(),
+    },
+    developer: { name: 'Roomote' },
+    oauth: {
+      client_name: 'Roomote',
+      client_uri: publicOrigin,
+      redirect_uris: [callbackUrl],
+      grant_types: ['authorization_code'],
+    },
+    webhook: {
+      enabled: true,
+      url: webhookUrl,
+      resourceTypes: ['AgentSessionEvent'],
+    },
+  };
+  const url = new URL('https://linear.app/settings/api/applications/new');
+  url.searchParams.set('manifest', JSON.stringify(manifest));
+  return {
+    callbackUrl,
+    webhookUrl,
+    manifestUrl: url.toString(),
+  };
+}
+
+export async function clearLinearDeploymentConnection(
+  executor: DatabaseOrTransaction,
+  userId: string,
+): Promise<boolean> {
+  const deletedConnections = await executor
+    .delete(mcpConnections)
+    .where(
+      and(
+        eq(mcpConnections.mcpId, 'linear'),
+        eq(mcpConnections.connectionRole, LINEAR_ORG_CONNECTION_ROLE),
+        isNull(mcpConnections.userId),
+      ),
+    )
+    .returning({ id: mcpConnections.id });
+
+  await executor
+    .insert(deploymentMcpEnablements)
+    .values({
+      mcpId: 'linear',
+      enabled: false,
+      enabledByUserId: userId,
+    })
+    .onConflictDoUpdate({
+      target: deploymentMcpEnablements.mcpId,
+      set: {
+        enabled: false,
+        enabledByUserId: userId,
+        updatedAt: new Date(),
+      },
+    });
+
+  return deletedConnections.length > 0;
+}
+
+export async function getLinearOauthSetupCommand(auth: UserAuthSuccess) {
+  assertAdmin(auth);
+
+  const publicOrigin = getPublicAppUrl(Env);
+  const runtimeEnv = getLinearRuntimeEnv();
+  const urls = buildLinearOauthSetup(publicOrigin);
+  const persistedEnvVarNames = await getPersistedEnvironmentVariableNames();
+  const savedEnvVarNames = new Set(persistedEnvVarNames);
+  const fieldEntries = await Promise.all(
+    Object.entries(LINEAR_OAUTH_ENV_FIELDS).map(async ([field, envName]) => {
+      const runtimeValue = getRuntimeEnvValue(envName);
+      const effectiveValue = await resolveDeploymentEnvVar(
+        envName,
+        db,
+        runtimeEnv,
+      );
+
+      return [
+        field,
+        {
+          configured: Boolean(effectiveValue),
+          managedByEnvironment: Boolean(runtimeValue),
+          savedInRoomote: savedEnvVarNames.has(envName),
+        },
+      ] as const;
+    }),
+  );
+
+  return {
+    ...urls,
+    fields: Object.fromEntries(fieldEntries) as Record<
+      LinearOauthSetupField,
+      {
+        configured: boolean;
+        managedByEnvironment: boolean;
+        savedInRoomote: boolean;
+      }
+    >,
+  };
+}
+
+export async function removeLinearOauthSetupCommand(auth: UserAuthSuccess) {
+  assertAdmin(auth);
+
+  await db.transaction(async (tx) => {
+    await deleteDeploymentEnvironmentVariables(
+      tx,
+      Object.values(LINEAR_OAUTH_ENV_FIELDS),
+    );
+    await clearLinearDeploymentConnection(tx, auth.userId);
+  });
+
+  return { success: true as const };
+}
+
+export async function saveLinearOauthSetupCommand(
+  auth: UserAuthSuccess,
+  input: SaveLinearOauthSetupInput,
+) {
+  assertAdmin(auth);
+  const runtimeEnv = getLinearRuntimeEnv();
+
+  const currentValues = await Promise.all(
+    Object.entries(LINEAR_OAUTH_ENV_FIELDS).map(async ([field, envName]) => [
+      field,
+      await resolveDeploymentEnvVar(envName, db, runtimeEnv),
+    ]),
+  );
+  const currentByField = Object.fromEntries(currentValues) as Record<
+    LinearOauthSetupField,
+    string | null
+  >;
+  const labels: Record<LinearOauthSetupField, string> = {
+    clientId: 'client ID',
+    clientSecret: 'client secret',
+    webhookSecret: 'webhook secret',
+  };
+  const missingFields = (
+    Object.keys(LINEAR_OAUTH_ENV_FIELDS) as LinearOauthSetupField[]
+  ).filter((field) => !input[field].trim() && !currentByField[field]);
+
+  if (missingFields.length > 0) {
+    throw new Error(
+      `Enter the Linear ${missingFields.map((field) => labels[field]).join(', ')}.`,
+    );
+  }
+
+  const values = (
+    Object.entries(LINEAR_OAUTH_ENV_FIELDS) as Array<
+      [LinearOauthSetupField, string]
+    >
+  ).flatMap(([field, envName]) => {
+    const value = input[field].trim();
+    return value && !getRuntimeEnvValue(envName)
+      ? [{ name: envName, value }]
+      : [];
+  });
+  const clientCredentialsChanged = (['clientId', 'clientSecret'] as const).some(
+    (field) => {
+      const value = input[field].trim();
+      const envName = LINEAR_OAUTH_ENV_FIELDS[field];
+      return (
+        Boolean(value) &&
+        !getRuntimeEnvValue(envName) &&
+        value !== currentByField[field]
+      );
+    },
+  );
+  let requiresReconnect = false;
+
+  await db.transaction(async (tx) => {
+    await upsertDeploymentEnvironmentVariables(tx, {
+      userId: auth.userId,
+      values,
+    });
+
+    if (clientCredentialsChanged) {
+      requiresReconnect = await clearLinearDeploymentConnection(
+        tx,
+        auth.userId,
+      );
+    }
+  });
+
+  return { success: true as const, requiresReconnect };
+}
diff --git a/apps/web/src/trpc/commands/mcp-connections/index.ts b/apps/web/src/trpc/commands/mcp-connections/index.ts
index 67b4681b5..30d5d799e 100644
--- a/apps/web/src/trpc/commands/mcp-connections/index.ts
+++ b/apps/web/src/trpc/commands/mcp-connections/index.ts
@@ -32,10 +32,9 @@ import { encrypt } from '@roomote/db/encryption';
 import { getValidAccessToken } from '@roomote/sdk/server';
 
 import type { UserAuthSuccess } from '@/types';
-import {
-  getStaticOauthEnvCandidates,
-  resolveStaticOauthClientInformation,
-} from '@/lib/server/mcp-static-oauth';
+import type { StaticOauthReadiness } from '@/lib/server/mcp-static-oauth';
+import { getDeploymentStaticOauthReadiness } from '@/lib/server/deployment-static-oauth';
+import { Env } from '@/lib/server/env';
 import { MCP_TOOL_CATALOG_REQUIRES_PERSONAL_CONNECTION } from '@/lib/mcp-tool-errors';
 import type {
   SaveAsanaConnectionInput,
@@ -71,23 +70,30 @@ function assertAdmin(auth: UserAuthSuccess) {
   }
 }
 
-function getMissingStaticOauthEnvNames(
-  integration: Pick<McpIntegration, 'id' | 'oauthClientEnv'>,
-): string[] {
-  const candidates = getStaticOauthEnvCandidates(integration);
-
-  if (candidates.length === 0) {
-    return [];
+function getStaticOauthSetupError(
+  integration: Pick<McpIntegration, 'name'>,
+  readiness: StaticOauthReadiness,
+): string | null {
+  if (readiness === 'ready' || readiness === 'not_required') {
+    return null;
   }
 
-  if (resolveStaticOauthClientInformation(process.env, integration)) {
-    return [];
+  if (readiness === 'partial') {
+    return `${integration.name} OAuth setup is incomplete on this Roomote deployment. Ask the team managing this deployment to finish configuring it before connecting.`;
   }
 
-  return [
-    integration.oauthClientEnv?.clientIdEnv,
-    integration.oauthClientEnv?.clientSecretEnv,
-  ].filter((envName): envName is string => Boolean(envName));
+  return `${integration.name} isn't available on this Roomote deployment yet. Ask the team managing this deployment to configure OAuth before connecting.`;
+}
+
+async function assertStaticOauthReady(
+  integration: McpIntegration,
+): Promise<void> {
+  const readiness = await getDeploymentStaticOauthReadiness(Env, integration);
+  const error = getStaticOauthSetupError(integration, readiness);
+
+  if (error) {
+    throw new Error(error);
+  }
 }
 
 const ALL_DEPLOYMENT_CONTROLLED_APP_IDS = new Set([
@@ -515,6 +521,29 @@ export async function getDeploymentMcpEnablementsCommand(
   });
 }
 
+/**
+ * Return public-safe OAuth setup status for integrations that require a
+ * deployment-configured client. Credential names and values never leave the
+ * server.
+ */
+export async function getMcpOauthReadinessCommand(_auth: UserAuthSuccess) {
+  const readiness = await Promise.all(
+    MCP_INTEGRATIONS.map(async (integration) => ({
+      mcpId: integration.id,
+      status: await getDeploymentStaticOauthReadiness(Env, integration),
+    })),
+  );
+
+  return readiness.filter(
+    (
+      entry,
+    ): entry is {
+      mcpId: string;
+      status: Exclude<StaticOauthReadiness, 'not_required'>;
+    } => entry.status !== 'not_required',
+  );
+}
+
 /**
  * Admin: enable or disable a curated MCP for the deployment
  */
@@ -560,13 +589,7 @@ export async function setDeploymentMcpEnabledCommand(
     integration?.oauthClientEnv &&
     !isDeploymentScopedMcpIntegration(input.mcpId)
   ) {
-    const missingEnvNames = getMissingStaticOauthEnvNames(integration);
-
-    if (missingEnvNames.length > 0) {
-      throw new Error(
-        `${integration.name} isn't available on this Roomote deployment yet. Ask the team managing this Roomote deployment to finish the required OAuth setup before enabling it.`,
-      );
-    }
+    await assertStaticOauthReady(integration);
   }
 
   const [result] = await db
@@ -1249,6 +1272,8 @@ export async function connectMcpCommand(
     );
   }
 
+  await assertStaticOauthReady(integration);
+
   if (
     input.redirectTo &&
     (!input.redirectTo.startsWith('/') || input.redirectTo.startsWith('//'))
diff --git a/apps/web/src/trpc/commands/product-releases/index.test.ts b/apps/web/src/trpc/commands/product-releases/index.test.ts
index 385b1905d..9984a475d 100644
--- a/apps/web/src/trpc/commands/product-releases/index.test.ts
+++ b/apps/web/src/trpc/commands/product-releases/index.test.ts
@@ -81,6 +81,7 @@ const memberAuth = {
 describe('releases commands', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    vi.unstubAllEnvs();
     mockEnv.RELEASE_VERSION = 'v0.14.0';
     delete mockEnv.RELEASE_PRODUCT_VERSION;
     mockIsRoomoteCloudEnabled.mockReturnValue(false);
@@ -96,6 +97,7 @@ describe('releases commands', () => {
   it('exposes update status only to self-host admins', async () => {
     await expect(getReleaseStatusCommand(adminAuth)).resolves.toEqual({
       runningVersion: '0.14.0',
+      displayVersion: 'v0.14.0',
       latestKnownVersion: '0.15.0',
       latestVersionCheckedAt: '2026-07-20T00:00:00.000Z',
       updateAvailable: true,
@@ -103,6 +105,7 @@ describe('releases commands', () => {
 
     await expect(getReleaseStatusCommand(memberAuth)).resolves.toEqual({
       runningVersion: '0.14.0',
+      displayVersion: 'v0.14.0',
       latestKnownVersion: null,
       latestVersionCheckedAt: null,
       updateAvailable: false,
@@ -115,12 +118,13 @@ describe('releases commands', () => {
     });
   });
 
-  it('prefers the baked product version over a channel build tag', async () => {
+  it('uses the commit for display while preserving the baked product version for notices', async () => {
     mockEnv.RELEASE_VERSION = 'main-037146ca';
     mockEnv.RELEASE_PRODUCT_VERSION = '0.14.0';
 
     await expect(getReleaseStatusCommand(adminAuth)).resolves.toMatchObject({
       runningVersion: '0.14.0',
+      displayVersion: '037146ca',
       updateAvailable: true,
     });
   });
@@ -130,10 +134,20 @@ describe('releases commands', () => {
 
     await expect(getReleaseStatusCommand(adminAuth)).resolves.toMatchObject({
       runningVersion: 'main-037146ca',
+      displayVersion: '037146ca',
       updateAvailable: false,
     });
   });
 
+  it('uses the GitHub build commit when a branch build has no named version', async () => {
+    mockEnv.RELEASE_VERSION = 'main';
+    vi.stubEnv('GITHUB_SHA', '037146ca');
+
+    await expect(getReleaseStatusCommand(memberAuth)).resolves.toMatchObject({
+      displayVersion: '037146ca',
+    });
+  });
+
   it('fetches and caches release notes for the running version', async () => {
     mockFetch.mockResolvedValue({
       ok: true,
diff --git a/apps/web/src/trpc/commands/product-releases/index.ts b/apps/web/src/trpc/commands/product-releases/index.ts
index 82b596031..a2748d302 100644
--- a/apps/web/src/trpc/commands/product-releases/index.ts
+++ b/apps/web/src/trpc/commands/product-releases/index.ts
@@ -1,3 +1,5 @@
+import { execFileSync } from 'node:child_process';
+
 import { db, deploymentSettings, eq } from '@roomote/db/server';
 import {
   getRedis,
@@ -14,6 +16,7 @@ import {
   ROOMOTE_GITHUB_REPO,
 } from '@/lib/release-links';
 import {
+  isParsableProductVersion,
   isProductVersionNewer,
   normalizeProductVersion,
   toReleaseTag,
@@ -25,6 +28,7 @@ const PRODUCT_VERSION_PATTERN = /^v?\d+\.\d+\.\d+(?:-[\w.]+)?$/i;
 
 type ReleaseStatus = {
   runningVersion: string | null;
+  displayVersion: string | null;
   latestKnownVersion: string | null;
   latestVersionCheckedAt: string | null;
   updateAvailable: boolean;
@@ -50,6 +54,53 @@ function getRunningVersion(): string | null {
   );
 }
 
+function getDisplayVersion(): string | null {
+  const releaseVersion = Env.RELEASE_VERSION?.trim();
+  if (releaseVersion) {
+    if (isParsableProductVersion(releaseVersion)) {
+      return toReleaseTag(releaseVersion);
+    }
+
+    // Channel builds include their commit after the final dash.
+    const commitFromRelease = releaseVersion.match(/[a-f0-9]{7,40}$/i)?.[0];
+    if (commitFromRelease) {
+      return commitFromRelease;
+    }
+  }
+
+  // Channel image builds receive their commit from GitHub Actions. A source
+  // checkout (the normal development path) has neither build metadata value,
+  // so resolve HEAD directly instead.
+  const commit = process.env.GITHUB_SHA?.trim() || getLocalGitCommit();
+  if (commit) {
+    return commit;
+  }
+
+  const productVersion = normalizeProductVersion(Env.RELEASE_PRODUCT_VERSION);
+  if (productVersion) {
+    return toReleaseTag(productVersion);
+  }
+
+  // Keep a useful identifier for deployments that do not expose commit
+  // metadata (for example a locally built self-hosted image).
+  return releaseVersion ?? null;
+}
+
+function getLocalGitCommit(): string | null {
+  try {
+    const commit = execFileSync('git', ['rev-parse', '--short=12', 'HEAD'], {
+      cwd: process.cwd(),
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    return commit || null;
+  } catch {
+    // Release images do not include .git. They always have RELEASE_VERSION,
+    // but keep this fallback safe for custom and detached deployments.
+    return null;
+  }
+}
+
 function canSeeUpdateStatus(auth: UserAuthSuccess): boolean {
   return auth.isAdmin && !isRoomoteCloudEnabled(Env.R_CLOUD_ENABLED);
 }
@@ -62,10 +113,12 @@ export async function getReleaseStatusCommand(
   auth: UserAuthSuccess,
 ): Promise<ReleaseStatus> {
   const runningVersion = getRunningVersion();
+  const displayVersion = getDisplayVersion();
 
   if (!canSeeUpdateStatus(auth)) {
     return {
       runningVersion,
+      displayVersion,
       latestKnownVersion: null,
       latestVersionCheckedAt: null,
       updateAvailable: false,
@@ -88,6 +141,7 @@ export async function getReleaseStatusCommand(
 
   return {
     runningVersion,
+    displayVersion,
     latestKnownVersion,
     latestVersionCheckedAt,
     updateAvailable: isProductVersionNewer(latestKnownVersion, runningVersion),
diff --git a/apps/web/src/trpc/commands/sandbox-session/index.ts b/apps/web/src/trpc/commands/sandbox-session/index.ts
index 307d48401..82928fc61 100644
--- a/apps/web/src/trpc/commands/sandbox-session/index.ts
+++ b/apps/web/src/trpc/commands/sandbox-session/index.ts
@@ -5,9 +5,11 @@ import {
   getEnvironmentDefinitionIdFromPayload,
   isBootingRunStatus,
   isExitedRunStatus,
+  resolveSourceControlProviderFromPayload,
   taskToolDispatchPayloadSchema,
 } from '@roomote/types';
 import { createRunToken } from '@roomote/auth';
+import { trackLatestUserMessageForReplyQuote } from '@roomote/communication/messages';
 import {
   and,
   compareAndSetTrustedRunActingUser,
@@ -296,11 +298,12 @@ export async function sendSandboxPromptCommand(
       ],
     });
 
-    return await client.commands.sendPrompt.mutate({
+    const result = await client.commands.sendPrompt.mutate({
       prompt:
         outOfBandContext && typeof parsed.prompt === 'string'
           ? withOutOfBandContext(outOfBandContext, parsed.prompt)
           : parsed.prompt,
+      quoteText: parsed.prompt,
       taskTool: parsed.taskTool,
       images: parsed.images,
       source: parsed.source,
@@ -313,6 +316,21 @@ export async function sendSandboxPromptCommand(
         ? true
         : parsed.autoSteerWhenQueued,
     });
+
+    if (
+      parsed.source === 'web' &&
+      typeof parsed.prompt === 'string' &&
+      resolveSourceControlProviderFromPayload(taskRun.payload) === 'github'
+    ) {
+      await trackLatestUserMessageForReplyQuote({
+        provider: 'github',
+        runId: taskRun.id,
+        text: parsed.prompt,
+        userName: getAuthenticatedPromptUserName(auth) ?? 'Someone',
+      });
+    }
+
+    return result;
   } catch (error) {
     await releaseOutOfBandContext(outOfBandContext);
 
diff --git a/apps/web/src/trpc/commands/sandbox-session/send-prompt.test.ts b/apps/web/src/trpc/commands/sandbox-session/send-prompt.test.ts
index 8039d0243..c1607cd26 100644
--- a/apps/web/src/trpc/commands/sandbox-session/send-prompt.test.ts
+++ b/apps/web/src/trpc/commands/sandbox-session/send-prompt.test.ts
@@ -1,7 +1,9 @@
-const { mockCreateRunToken, mockSendPromptMutate } = vi.hoisted(() => ({
-  mockCreateRunToken: vi.fn(),
-  mockSendPromptMutate: vi.fn(),
-}));
+const { mockCreateRunToken, mockSendPromptMutate, mockClaimOutOfBandContext } =
+  vi.hoisted(() => ({
+    mockCreateRunToken: vi.fn(),
+    mockSendPromptMutate: vi.fn(),
+    mockClaimOutOfBandContext: vi.fn(),
+  }));
 
 vi.mock('@roomote/auth', async () => {
   const actual =
@@ -29,6 +31,17 @@ vi.mock('@trpc/client', async () => {
   };
 });
 
+vi.mock('@/lib/server/out-of-band-context', async () => {
+  const actual = await vi.importActual<
+    typeof import('@/lib/server/out-of-band-context')
+  >('@/lib/server/out-of-band-context');
+
+  return {
+    ...actual,
+    claimOutOfBandContextForPrompt: mockClaimOutOfBandContext,
+  };
+});
+
 import {
   db,
   eq,
@@ -87,6 +100,7 @@ describe('sendSandboxPromptCommand', () => {
     );
     mockCreateRunToken.mockResolvedValue('run-token');
     mockSendPromptMutate.mockResolvedValue({ success: true });
+    mockClaimOutOfBandContext.mockResolvedValue(null);
   });
 
   afterEach(() => {
@@ -137,12 +151,44 @@ describe('sendSandboxPromptCommand', () => {
     expect(mockSendPromptMutate).toHaveBeenCalledWith(
       expect.objectContaining({
         prompt: 'keep going',
+        quoteText: 'keep going',
         source: 'web',
         userName: 'Auth Fallback Name',
       }),
     );
   });
 
+  it('keeps the original user text separate from injected out-of-band context', async () => {
+    const user = await userFactory.create({ name: 'DB User' });
+    const task = await taskFactory.create({ initiatorUserId: user.id });
+
+    await runFactory.create({
+      actingUserId: user.id,
+      taskId: task.id,
+      status: RunStatus.Running,
+      sandboxServerUrl: 'http://sandbox.example.test',
+      result: {},
+    });
+    mockClaimOutOfBandContext.mockResolvedValue({
+      contextBlock: '<out_of_band_context>\nnotice\n</out_of_band_context>',
+      messageIds: ['out-of-band-message'],
+    });
+
+    await sendSandboxPromptCommand(buildMockAuth({ userId: user.id }), {
+      taskId: task.id,
+      prompt: 'Please fix it.',
+      source: 'web',
+    });
+
+    expect(mockSendPromptMutate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        prompt:
+          '<out_of_band_context>\nnotice\n</out_of_band_context>\n\nPlease fix it.',
+        quoteText: 'Please fix it.',
+      }),
+    );
+  });
+
   it('forwards autoSteerWhenQueued to the sandbox sendPrompt command', async () => {
     const user = await userFactory.create({ name: 'DB User' });
     const task = await taskFactory.create({
diff --git a/apps/web/src/trpc/commands/setup-new/index.test.ts b/apps/web/src/trpc/commands/setup-new/index.test.ts
index d83d98b0c..140f47add 100644
--- a/apps/web/src/trpc/commands/setup-new/index.test.ts
+++ b/apps/web/src/trpc/commands/setup-new/index.test.ts
@@ -8,6 +8,7 @@ const {
   mockUpsertDeploymentEnvironmentVariables,
   mockGetPersistedEnvironmentVariableNames,
   mockGetPersistedEnvironmentVariableValues,
+  mockValidateTeamsBotCredentials,
   mockGetSetupBootstrapState,
   mockSetupTokenState,
   mockRunComputeProvisioning,
@@ -16,6 +17,7 @@ const {
   mockResolveGiteaBaseUrl,
   mockResolveDeploymentEnvVar,
 } = vi.hoisted(() => ({
+  mockValidateTeamsBotCredentials: vi.fn(async () => undefined),
   mockTxSelect: vi.fn(),
   mockDbTransaction: vi.fn(),
   mockUpsertDeploymentEnvironmentVariables: vi.fn(),
@@ -122,6 +124,7 @@ vi.mock('@roomote/db/server', () => ({
     identitySource: null,
     identityErrorCode: null,
   })),
+  invalidateTeamsBotRuntimeCredentialsCache: vi.fn(),
   slackInstallations: {},
   slackUserMappings: {},
   sql: vi.fn(),
@@ -185,6 +188,21 @@ vi.mock('../environment-variables', () => ({
     mockGetPersistedEnvironmentVariableValues,
 }));
 
+vi.mock('@roomote/communication/teams-credential-validation', () => ({
+  validateTeamsBotCredentials: mockValidateTeamsBotCredentials,
+  TeamsBotCredentialValidationError: class TeamsBotCredentialValidationError extends Error {
+    constructor(
+      readonly code: string,
+      message: string,
+      readonly field: string | null = null,
+      readonly detail: string | null = null,
+    ) {
+      super(message);
+      this.name = 'TeamsBotCredentialValidationError';
+    }
+  },
+}));
+
 vi.mock('../task-suggestions', () => ({
   triggerTaskSuggestionsCommand: vi.fn(),
 }));
@@ -220,9 +238,11 @@ import { enqueueTask } from '@roomote/cloud-agents/server';
 import { TelegramCommunicationProvider } from '@roomote/communication/telegram-provider';
 import { DiscordCommunicationProvider } from '@roomote/communication/discord-provider';
 import {
+  invalidateTeamsBotRuntimeCredentialsCache,
   resolveDiscordRuntimeCredentials,
   resolveTelegramRuntimeCredentials,
 } from '@roomote/db/server';
+import { TeamsBotCredentialValidationError } from '@roomote/communication/teams-credential-validation';
 import {
   createTeamsCommunicationProviderFromRuntimeCredentials,
   findTelegramPrimaryChatId,
@@ -286,6 +306,7 @@ describe('setup-new auth config commands', () => {
     vi.clearAllMocks();
     mockTxSelect.mockReset();
     mockGetPersistedEnvironmentVariableNames.mockResolvedValue([]);
+    mockValidateTeamsBotCredentials.mockResolvedValue(undefined);
     process.env.E2B_TEMPLATE_ID = '';
     process.env.DAYTONA_SNAPSHOT_NAME = '';
     process.env.BLAXEL_IMAGE = '';
@@ -335,6 +356,56 @@ describe('setup-new auth config commands', () => {
     );
   });
 
+  it('verifies Teams bot credentials and drops both caches after the commit', async () => {
+    mockGetSetupBootstrapState.mockResolvedValue({ setupOpen: false });
+
+    await saveSetupNewAuthConfigCommand(buildMockAuth(), {
+      provider: 'microsoft',
+      values: {
+        R_MICROSOFT_CLIENT_ID: 'ms-client-id',
+        R_MICROSOFT_CLIENT_SECRET: 'ms-client-secret',
+        R_MICROSOFT_TENANT_ID: 'ms-tenant-id',
+      },
+    });
+
+    expect(mockValidateTeamsBotCredentials).toHaveBeenCalledWith(
+      expect.objectContaining({
+        appId: 'ms-client-id',
+        appPassword: 'ms-client-secret',
+        tenantId: 'ms-tenant-id',
+      }),
+    );
+    // A stale 30s runtime cache would make the next status refresh report the
+    // credentials that were replaced, not the ones just verified.
+    expect(invalidateTeamsBotRuntimeCredentialsCache).toHaveBeenCalled();
+  });
+
+  it('does not save Teams credentials Microsoft rejects', async () => {
+    mockGetSetupBootstrapState.mockResolvedValue({ setupOpen: false });
+    mockValidateTeamsBotCredentials.mockRejectedValue(
+      new TeamsBotCredentialValidationError(
+        'invalid_app_password',
+        'Microsoft rejected the client secret.',
+        'app_password',
+        'AADSTS7000215: Invalid client secret provided.',
+      ),
+    );
+
+    await expect(
+      saveSetupNewAuthConfigCommand(buildMockAuth(), {
+        provider: 'microsoft',
+        values: {
+          R_MICROSOFT_CLIENT_ID: 'ms-client-id',
+          R_MICROSOFT_CLIENT_SECRET: 'wrong-secret',
+          R_MICROSOFT_TENANT_ID: 'ms-tenant-id',
+        },
+      }),
+    ).rejects.toThrow(/AADSTS7000215/u);
+
+    expect(mockUpsertDeploymentEnvironmentVariables).not.toHaveBeenCalled();
+    expect(invalidateTeamsBotRuntimeCredentialsCache).not.toHaveBeenCalled();
+  });
+
   it('records bootstrap auth config without manufacturing a user', async () => {
     mockGetSetupBootstrapState.mockResolvedValue({ setupOpen: true });
 
@@ -1131,6 +1202,36 @@ describe('setup-new onboarding task start command', () => {
     );
   });
 
+  it('launches with bootstrap instructions instead of blocking when every selected repo is empty', async () => {
+    const { getRepositoryEmptyStates } = await import('@roomote/github');
+    vi.mocked(getRepositoryEmptyStates).mockResolvedValue(
+      new Map([['repo-1', true]]),
+    );
+    mockOnboardingTransaction({ slackInstallation: null });
+
+    const result = await startSetupNewOnboardingTaskCommand(buildMockAuth());
+
+    expect(result.taskId).toBe('task-onboarding-1');
+    expect(buildSetupNewKickoffPrompt).toHaveBeenCalledWith(['acme/api'], {
+      emptyRepositoryFullNames: ['acme/api'],
+    });
+  });
+
+  it('omits the empty-repository flag when selected repos have commits', async () => {
+    const { getRepositoryEmptyStates } = await import('@roomote/github');
+    vi.mocked(getRepositoryEmptyStates).mockResolvedValue(
+      new Map([['repo-1', false]]),
+    );
+    mockOnboardingTransaction({ slackInstallation: null });
+
+    await startSetupNewOnboardingTaskCommand(buildMockAuth());
+
+    expect(buildSetupNewKickoffPrompt).toHaveBeenCalledWith(
+      ['acme/api'],
+      undefined,
+    );
+  });
+
   it('rejects a stale excluded compute provider before launch', async () => {
     vi.stubEnv('EXCLUDED_COMPUTE_PROVIDERS', 'docker');
     mockOnboardingTransaction({
diff --git a/apps/web/src/trpc/commands/setup-new/index.ts b/apps/web/src/trpc/commands/setup-new/index.ts
index 9fa1bc2e7..d6e4ea740 100644
--- a/apps/web/src/trpc/commands/setup-new/index.ts
+++ b/apps/web/src/trpc/commands/setup-new/index.ts
@@ -35,6 +35,7 @@ import {
   purgeSavedDeploymentWorkerImage,
   resolveTelegramRuntimeCredentials,
   resolveDiscordRuntimeCredentials,
+  invalidateTeamsBotRuntimeCredentialsCache,
   isChatGptSubscriptionConnected,
   isGitHubCopilotSubscriptionConnected,
   isXaiSubscriptionConnected,
@@ -117,7 +118,6 @@ import {
   isSetupTokenRequired,
   isSetupTokenValid,
 } from '@/lib/server';
-import { areAllRepositoriesEmpty } from '@/lib/repositories';
 import {
   appendEnvironmentDefinitionGuidance,
   buildSetupEnvironmentTaskTitle,
@@ -142,6 +142,10 @@ import {
   getPersistedEnvironmentVariableValues,
   upsertDeploymentEnvironmentVariables,
 } from '../environment-variables';
+import {
+  assertTeamsBotCredentialsAuthenticate,
+  invalidateTeamsBotCredentialCheckCache,
+} from '../teams/bot-credential-check';
 import {
   getPersistedRuntimeComputeConfig,
   savePersistedRuntimeComputeConfig,
@@ -310,23 +314,17 @@ async function resolveSelectedRepositories(repositoryIds: string[]): Promise<{
   };
 }
 
-async function assertHasCommittedRepositorySelection(repositoryIds: string[]) {
-  const emptyStates = await GitHub.getRepositoryEmptyStates({
-    repositoryIds,
-  });
-
-  if (
-    emptyStates.size === repositoryIds.length &&
-    areAllRepositoriesEmpty(
-      [...emptyStates.values()].map((isEmpty) => ({ isEmpty })),
-    )
-  ) {
-    throw new Error(
-      emptyStates.size === 1
-        ? 'The selected repository has no commits yet. Push an initial commit first, or choose a different repository.'
-        : 'All selected repositories have no commits yet. Push an initial commit first, or choose different repositories.',
-    );
-  }
+/**
+ * Look up which selected repositories have no commits yet. Empty repos are a
+ * supported onboarding target (the environment-setup agent bootstraps them
+ * with an initial commit), so this only informs the kickoff prompt — it never
+ * blocks the selection. Non-GitHub repos are absent from the returned map and
+ * treated as non-empty.
+ */
+async function resolveRepositorySelectionEmptyStates(
+  repositoryIds: string[],
+): Promise<Map<string, boolean>> {
+  return GitHub.getRepositoryEmptyStates({ repositoryIds });
 }
 
 async function clearTaskSuggestions(
@@ -2093,7 +2091,13 @@ async function saveSetupAuthConfig(input: {
   }
   const provider = getSetupAuthProvider(input.provider);
 
-  return db.transaction(async (tx) => {
+  // Runs before the transaction: it talks to Microsoft, and onboarding must
+  // not report a configured Teams bot for credentials that never authenticated.
+  if (input.provider === 'microsoft') {
+    await assertTeamsBotCredentialsAuthenticate(input.values);
+  }
+
+  const result = await db.transaction(async (tx) => {
     const [currentState, persistedEnvVarNames] = await Promise.all([
       getPersistedSetupNewState(tx),
       getPersistedEnvironmentVariableNames(tx),
@@ -2187,6 +2191,16 @@ async function saveSetupAuthConfig(input: {
       setupNewState,
     };
   });
+
+  // After the commit, or the 30s runtime credential cache keeps serving the
+  // pre-save tuple and the next status refresh reports the old credentials
+  // instead of the ones that were just verified and stored.
+  if (input.provider === 'microsoft') {
+    invalidateTeamsBotRuntimeCredentialsCache();
+    invalidateTeamsBotCredentialCheckCache();
+  }
+
+  return result;
 }
 
 export async function saveSetupNewSourceControlProviderChoiceCommand(
@@ -2382,7 +2396,6 @@ export async function saveSetupNewSelectionCommand(
   const { normalizedRepositoryIds } = await resolveSelectedRepositories(
     input.repositoryIds,
   );
-  await assertHasCommittedRepositorySelection(normalizedRepositoryIds);
   const nextSetupGuidance = input.setupGuidance?.trim() || null;
   const nextSelectedModelId = input.selectedModelId?.trim() || null;
 
@@ -2463,7 +2476,9 @@ export async function startSetupNewOnboardingTaskCommand(
 
     const { normalizedRepositoryIds, selectedRepositories } =
       await resolveSelectedRepositories(currentState.selectedRepositoryIds);
-    await assertHasCommittedRepositorySelection(normalizedRepositoryIds);
+    const repositoryEmptyStates = await resolveRepositorySelectionEmptyStates(
+      selectedRepositories.map((repository) => repository.id),
+    );
 
     if (selectedRepositories.length === 0) {
       throw new Error('Select at least one repository before starting setup.');
@@ -2485,8 +2500,16 @@ export async function startSetupNewOnboardingTaskCommand(
         (repository) => repository.sourceControlProvider,
       ),
     );
+    const emptyRepositoryFullNames = selectedRepositories
+      .filter((repository) => repositoryEmptyStates.get(repository.id) === true)
+      .map((repository) => repository.fullName);
     const prompt = appendEnvironmentDefinitionGuidance(
-      buildSetupNewKickoffPrompt(selectedRepositoryFullNames),
+      buildSetupNewKickoffPrompt(
+        selectedRepositoryFullNames,
+        emptyRepositoryFullNames.length > 0
+          ? { emptyRepositoryFullNames }
+          : undefined,
+      ),
       currentState.setupGuidance,
     );
     const modelSelection = resolveEvalHarnessSelection({
diff --git a/apps/web/src/trpc/commands/teams/bot-credential-check.ts b/apps/web/src/trpc/commands/teams/bot-credential-check.ts
new file mode 100644
index 000000000..74effb466
--- /dev/null
+++ b/apps/web/src/trpc/commands/teams/bot-credential-check.ts
@@ -0,0 +1,272 @@
+import {
+  TeamsBotCredentialValidationError,
+  validateTeamsBotCredentials,
+  type TeamsBotCredentialField,
+  type TeamsBotCredentialValidationCode,
+} from '@roomote/communication/teams-credential-validation';
+import {
+  getSetupAuthProvider,
+  resolveTeamsBotRuntimeCredentialsFromEnv,
+  TEAMS_BOT_CREDENTIAL_ENV_VAR_NAMES,
+  type TeamsBotCredentialSource,
+  type TeamsBotRuntimeCredentials,
+} from '@roomote/types';
+
+import { getPersistedEnvironmentVariableValues } from '../environment-variables';
+
+/**
+ * Saves block on this check, so keep it short enough that a wedged network
+ * does not look like a hung form.
+ */
+const SAVE_VALIDATION_TIMEOUT_MS = 8_000;
+const STATUS_VALIDATION_TIMEOUT_MS = 5_000;
+const STATUS_CHECK_CACHE_TTL_MS = 60_000;
+
+const FIELD_ENV_VAR_NAMES: Record<
+  TeamsBotCredentialField,
+  Record<Exclude<TeamsBotCredentialSource, null>, string>
+> = {
+  app_id: {
+    teams_bot: 'R_TEAMS_BOT_APP_ID',
+    microsoft_auth: 'R_MICROSOFT_CLIENT_ID',
+  },
+  app_password: {
+    teams_bot: 'R_TEAMS_BOT_APP_PASSWORD',
+    microsoft_auth: 'R_MICROSOFT_CLIENT_SECRET',
+  },
+  tenant_id: {
+    teams_bot: 'R_TEAMS_BOT_TENANT_ID',
+    microsoft_auth: 'R_MICROSOFT_TENANT_ID',
+  },
+};
+
+const FIELD_GUIDANCE: Partial<
+  Record<TeamsBotCredentialValidationCode, string>
+> = {
+  invalid_app_id:
+    'Copy the Application (client) ID from the Entra app registration overview.',
+  invalid_app_password:
+    'Use the client secret Value from Certificates & secrets, not the Secret ID.',
+  expired_app_password:
+    'Create a new client secret in Certificates & secrets and save its value here.',
+  invalid_tenant_id:
+    'Copy the Directory (tenant) ID from the Entra app registration overview.',
+};
+
+function getFieldDescription(
+  field: TeamsBotCredentialField,
+  source: TeamsBotCredentialSource,
+): string {
+  const envVarName = source ? FIELD_ENV_VAR_NAMES[field][source] : null;
+
+  if (!envVarName) {
+    return 'the Teams bot credentials';
+  }
+
+  const label = getSetupAuthProvider('microsoft').fields.find(
+    (candidate) => candidate.envVarName === envVarName,
+  )?.label;
+
+  return label ? `${label} (${envVarName})` : envVarName;
+}
+
+/**
+ * Turn a validation failure into copy an admin can act on: which value
+ * Microsoft rejected, what Microsoft said, and where to find the right value.
+ */
+function describeTeamsBotCredentialFailure(
+  error: TeamsBotCredentialValidationError,
+  source: TeamsBotCredentialSource,
+): string {
+  const detail = error.detail ? ` ${error.detail}` : '';
+
+  if (error.code === 'unreachable') {
+    return `${error.message}${detail} Check outbound access to login.microsoftonline.com and try again.`;
+  }
+
+  if (!error.field) {
+    return `${error.message}${detail}`;
+  }
+
+  const guidance = FIELD_GUIDANCE[error.code];
+
+  return `Microsoft rejected ${getFieldDescription(error.field, source)}.${detail}${
+    guidance ? ` ${guidance}` : ''
+  }`;
+}
+
+/**
+ * Resolve the Teams bot credentials a save is about to produce, the same way
+ * `resolveTeamsBotRuntimeCredentials` resolves them at runtime: real
+ * environment variables win, then the values being submitted, then what is
+ * already stored.
+ */
+async function resolvePendingTeamsBotCredentials(
+  values: Partial<Record<string, string>> | undefined,
+): Promise<TeamsBotRuntimeCredentials> {
+  const persisted = await getPersistedEnvironmentVariableValues([
+    ...TEAMS_BOT_CREDENTIAL_ENV_VAR_NAMES,
+  ]);
+  const merged: Partial<Record<string, string>> = {};
+
+  for (const name of TEAMS_BOT_CREDENTIAL_ENV_VAR_NAMES) {
+    merged[name] =
+      process.env[name]?.trim() || values?.[name]?.trim() || persisted[name];
+  }
+
+  return resolveTeamsBotRuntimeCredentialsFromEnv(merged);
+}
+
+/**
+ * Fail a Microsoft/Teams save when the credentials have never authenticated.
+ * Presence of non-empty values used to be enough to report "Bot configured",
+ * which left admins unable to tell a typo from a missing permission until the
+ * Azure Bot Service started getting 401s from the messaging endpoint.
+ */
+export async function assertTeamsBotCredentialsAuthenticate(
+  values: Partial<Record<string, string>> | undefined,
+): Promise<void> {
+  const credentials = await resolvePendingTeamsBotCredentials(values);
+
+  if (!credentials.botAppId || !credentials.botAppPassword) {
+    // The per-field required-value check reports missing values with copy that
+    // points at the specific empty field.
+    return;
+  }
+
+  try {
+    await validateTeamsBotCredentials({
+      appId: credentials.botAppId,
+      appPassword: credentials.botAppPassword,
+      tenantId: credentials.botTenantId,
+      tokenEndpoint: credentials.botTokenEndpoint,
+      oauthScope: credentials.botOauthScope,
+      timeoutMs: SAVE_VALIDATION_TIMEOUT_MS,
+    });
+  } catch (error) {
+    if (error instanceof TeamsBotCredentialValidationError) {
+      throw new Error(
+        describeTeamsBotCredentialFailure(error, credentials.source),
+      );
+    }
+
+    throw error;
+  }
+}
+
+export type TeamsBotCredentialCheck = {
+  /**
+   * `unchecked` means Roomote could not get an answer from Microsoft (no
+   * credentials configured, or the token endpoint was unreachable) — it is not
+   * a verdict on the credentials.
+   */
+  status: 'ok' | 'failed' | 'unchecked';
+  message: string | null;
+};
+
+type TeamsBotCredentialIdentity = Pick<
+  TeamsBotRuntimeCredentials,
+  | 'botAppId'
+  | 'botAppPassword'
+  | 'botTenantId'
+  | 'botTokenEndpoint'
+  | 'botOauthScope'
+>;
+
+let cachedStatusCheck: {
+  credentials: TeamsBotCredentialIdentity;
+  value: TeamsBotCredentialCheck;
+  expiresAtMs: number;
+} | null = null;
+
+/**
+ * Compare the resolved tuple directly instead of digesting it. A fast hash
+ * over a client secret is indistinguishable from insecure password hashing,
+ * and an exact comparison answers "are these the same credentials?" without
+ * the collision surface a digest would add.
+ */
+function isSameCredentialIdentity(
+  a: TeamsBotCredentialIdentity,
+  b: TeamsBotCredentialIdentity,
+): boolean {
+  return (
+    a.botAppId === b.botAppId &&
+    a.botAppPassword === b.botAppPassword &&
+    a.botTenantId === b.botTenantId &&
+    a.botTokenEndpoint === b.botTokenEndpoint &&
+    a.botOauthScope === b.botOauthScope
+  );
+}
+
+/**
+ * Report whether the currently resolved Teams bot credentials authenticate.
+ * Credentials supplied through real environment variables never pass through a
+ * save, and client secrets expire, so status cannot infer this from presence.
+ * Cached briefly because the settings page polls it.
+ */
+export async function checkTeamsBotCredentials(
+  credentials: TeamsBotRuntimeCredentials,
+): Promise<TeamsBotCredentialCheck> {
+  if (!credentials.botAppId || !credentials.botAppPassword) {
+    return { status: 'unchecked', message: null };
+  }
+
+  const nowMs = Date.now();
+
+  if (
+    cachedStatusCheck &&
+    cachedStatusCheck.expiresAtMs > nowMs &&
+    isSameCredentialIdentity(cachedStatusCheck.credentials, credentials)
+  ) {
+    return cachedStatusCheck.value;
+  }
+
+  let value: TeamsBotCredentialCheck;
+
+  try {
+    await validateTeamsBotCredentials({
+      appId: credentials.botAppId,
+      appPassword: credentials.botAppPassword,
+      tenantId: credentials.botTenantId,
+      tokenEndpoint: credentials.botTokenEndpoint,
+      oauthScope: credentials.botOauthScope,
+      timeoutMs: STATUS_VALIDATION_TIMEOUT_MS,
+    });
+    value = { status: 'ok', message: null };
+  } catch (error) {
+    if (error instanceof TeamsBotCredentialValidationError) {
+      const message = describeTeamsBotCredentialFailure(
+        error,
+        credentials.source,
+      );
+      value =
+        error.code === 'unreachable'
+          ? { status: 'unchecked', message }
+          : { status: 'failed', message };
+    } else {
+      value = {
+        status: 'unchecked',
+        message: 'Could not verify the Teams bot credentials with Microsoft.',
+      };
+    }
+  }
+
+  cachedStatusCheck = {
+    credentials: {
+      botAppId: credentials.botAppId,
+      botAppPassword: credentials.botAppPassword,
+      botTenantId: credentials.botTenantId,
+      botTokenEndpoint: credentials.botTokenEndpoint,
+      botOauthScope: credentials.botOauthScope,
+    },
+    value,
+    expiresAtMs: nowMs + STATUS_CHECK_CACHE_TTL_MS,
+  };
+
+  return value;
+}
+
+/** Drop the cached status verdict, e.g. right after credentials change. */
+export function invalidateTeamsBotCredentialCheckCache(): void {
+  cachedStatusCheck = null;
+}
diff --git a/apps/web/src/trpc/commands/teams/index.test.ts b/apps/web/src/trpc/commands/teams/index.test.ts
index c72fbca29..c94e858b9 100644
--- a/apps/web/src/trpc/commands/teams/index.test.ts
+++ b/apps/web/src/trpc/commands/teams/index.test.ts
@@ -1,4 +1,7 @@
+import { TeamsBotCredentialValidationError } from '@roomote/communication/teams-credential-validation';
+
 import { getTeamsIntegrationStatusCommand } from './index';
+import { invalidateTeamsBotCredentialCheckCache } from './bot-credential-check';
 
 import type { UserAuthSuccess } from '@/types';
 
@@ -6,10 +9,27 @@ const {
   mockResolveTeamsBotRuntimeCredentials,
   mockFindTeamsPrimaryConversation,
   mockResolveAuthProviderConfig,
+  mockValidateTeamsBotCredentials,
 } = vi.hoisted(() => ({
   mockResolveTeamsBotRuntimeCredentials: vi.fn(),
   mockFindTeamsPrimaryConversation: vi.fn(),
   mockResolveAuthProviderConfig: vi.fn(),
+  mockValidateTeamsBotCredentials: vi.fn(async () => undefined),
+}));
+
+vi.mock('@roomote/communication/teams-credential-validation', () => ({
+  validateTeamsBotCredentials: mockValidateTeamsBotCredentials,
+  TeamsBotCredentialValidationError: class TeamsBotCredentialValidationError extends Error {
+    constructor(
+      readonly code: string,
+      message: string,
+      readonly field: string | null = null,
+      readonly detail: string | null = null,
+    ) {
+      super(message);
+      this.name = 'TeamsBotCredentialValidationError';
+    }
+  },
 }));
 
 vi.mock('@roomote/db/server', () => ({
@@ -56,6 +76,8 @@ function buildCredentials(
 describe('getTeamsIntegrationStatusCommand', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    invalidateTeamsBotCredentialCheckCache();
+    mockValidateTeamsBotCredentials.mockResolvedValue(undefined);
     mockResolveTeamsBotRuntimeCredentials.mockResolvedValue(buildCredentials());
     mockFindTeamsPrimaryConversation.mockResolvedValue(null);
     mockResolveAuthProviderConfig.mockResolvedValue({
@@ -69,6 +91,7 @@ describe('getTeamsIntegrationStatusCommand', () => {
     const status = await getTeamsIntegrationStatusCommand(mockAuth);
 
     expect(status.botConfigured).toBe(true);
+    expect(status.botCredentialCheck).toEqual({ status: 'ok', message: null });
     expect(status.microsoftAuthConfigured).toBe(true);
     expect(status.primaryConversationReady).toBe(false);
     expect(status.primaryConversationType).toBeNull();
@@ -106,8 +129,69 @@ describe('getTeamsIntegrationStatusCommand', () => {
     const status = await getTeamsIntegrationStatusCommand(mockAuth);
 
     expect(status.botConfigured).toBe(false);
+    expect(status.botCredentialCheck).toEqual({
+      status: 'unchecked',
+      message: null,
+    });
     expect(status.openInTeamsUrl).toBeNull();
     expect(status.primaryConversationReady).toBe(false);
     expect(status.primaryConversationType).toBeNull();
+    expect(mockValidateTeamsBotCredentials).not.toHaveBeenCalled();
+  });
+
+  it('reports credentials that never authenticated as failed, not configured', async () => {
+    mockValidateTeamsBotCredentials.mockRejectedValue(
+      new TeamsBotCredentialValidationError(
+        'invalid_app_id',
+        'Microsoft rejected the app (client) id.',
+        'app_id',
+        "AADSTS700016: Application with identifier 'bot-app-id' was not found in the directory.",
+      ),
+    );
+
+    const status = await getTeamsIntegrationStatusCommand(mockAuth);
+
+    expect(status.botConfigured).toBe(true);
+    expect(status.botCredentialCheck.status).toBe('failed');
+    expect(status.botCredentialCheck.message).toContain(
+      'Teams Bot App ID (R_TEAMS_BOT_APP_ID)',
+    );
+    expect(status.botCredentialCheck.message).toContain('AADSTS700016');
+  });
+
+  it('treats an unreachable Microsoft as unchecked, not as a credential failure', async () => {
+    mockValidateTeamsBotCredentials.mockRejectedValue(
+      new TeamsBotCredentialValidationError(
+        'unreachable',
+        'Could not reach Microsoft to verify the Teams bot credentials (timed out).',
+        null,
+        'The operation timed out.',
+      ),
+    );
+
+    const status = await getTeamsIntegrationStatusCommand(mockAuth);
+
+    expect(status.botCredentialCheck.status).toBe('unchecked');
+    expect(status.botCredentialCheck.message).toContain(
+      'login.microsoftonline.com',
+    );
+  });
+
+  it('caches the credential verdict so status polling does not hammer Microsoft', async () => {
+    await getTeamsIntegrationStatusCommand(mockAuth);
+    await getTeamsIntegrationStatusCommand(mockAuth);
+
+    expect(mockValidateTeamsBotCredentials).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-checks when only the client secret changed', async () => {
+    await getTeamsIntegrationStatusCommand(mockAuth);
+    mockResolveTeamsBotRuntimeCredentials.mockResolvedValue(
+      buildCredentials({ botAppPassword: 'rotated-app-password' }),
+    );
+
+    await getTeamsIntegrationStatusCommand(mockAuth);
+
+    expect(mockValidateTeamsBotCredentials).toHaveBeenCalledTimes(2);
   });
 });
diff --git a/apps/web/src/trpc/commands/teams/index.ts b/apps/web/src/trpc/commands/teams/index.ts
index 38e731b56..3889a4617 100644
--- a/apps/web/src/trpc/commands/teams/index.ts
+++ b/apps/web/src/trpc/commands/teams/index.ts
@@ -8,8 +8,19 @@ import type { UserAuthSuccess } from '@/types';
 import { Env } from '@/lib/server';
 import { resolveAuthProviderConfig } from '@/lib/server/auth-provider-config';
 
+import {
+  checkTeamsBotCredentials,
+  type TeamsBotCredentialCheck,
+} from './bot-credential-check';
+
 type TeamsIntegrationStatus = {
   botConfigured: boolean;
+  /**
+   * Whether the configured credentials actually authenticate with Microsoft.
+   * `botConfigured` only reports that values are present, which cannot
+   * distinguish a typo or an expired secret from a working bot.
+   */
+  botCredentialCheck: TeamsBotCredentialCheck;
   botUsesTenantSpecificTokenFlow: boolean;
   botUsesMicrosoftAuthFallback: boolean;
   microsoftAuthConfigured: boolean;
@@ -46,16 +57,18 @@ export async function getTeamsIntegrationStatusCommand(
 ): Promise<TeamsIntegrationStatus> {
   void auth;
 
-  const [credentials, authProviderConfig, primaryConversation, botName] =
+  const credentials = await resolveTeamsBotRuntimeCredentials();
+  const [authProviderConfig, primaryConversation, botName, botCredentialCheck] =
     await Promise.all([
-      resolveTeamsBotRuntimeCredentials(),
       resolveAuthProviderConfig(),
       findTeamsPrimaryConversation(),
       resolveTeamsInvocationBotName(),
+      checkTeamsBotCredentials(credentials),
     ]);
 
   return {
     botConfigured: Boolean(credentials.botAppId && credentials.botAppPassword),
+    botCredentialCheck,
     botUsesTenantSpecificTokenFlow: Boolean(credentials.botTenantId),
     botUsesMicrosoftAuthFallback: false,
     microsoftAuthConfigured: Boolean(
diff --git a/apps/web/src/trpc/routers/_app.ts b/apps/web/src/trpc/routers/_app.ts
index b9cadafc9..8d25233a4 100644
--- a/apps/web/src/trpc/routers/_app.ts
+++ b/apps/web/src/trpc/routers/_app.ts
@@ -112,6 +112,9 @@ import {
 import {
   getLinearInstallationCommand,
   disconnectLinearAppCommand,
+  getLinearOauthSetupCommand,
+  removeLinearOauthSetupCommand,
+  saveLinearOauthSetupCommand,
 } from '../commands/linear';
 import { getTeamsIntegrationStatusCommand } from '../commands/teams';
 import {
@@ -184,6 +187,7 @@ import {
 } from '../commands/sandbox-session';
 import {
   getDeploymentMcpEnablementsCommand,
+  getMcpOauthReadinessCommand,
   setDeploymentMcpEnabledCommand,
   getUserMcpConnectionsCommand,
   getAsanaConnectionCommand,
@@ -1145,6 +1149,26 @@ export const appRouter = createRouter({
     disconnectApp: protectedProcedure.mutation(({ ctx: { auth } }) =>
       disconnectLinearAppCommand(auth),
     ),
+
+    oauthSetup: protectedProcedure.query(({ ctx: { auth } }) =>
+      getLinearOauthSetupCommand(auth),
+    ),
+
+    removeOauthSetup: protectedProcedure.mutation(({ ctx: { auth } }) =>
+      removeLinearOauthSetupCommand(auth),
+    ),
+
+    saveOauthSetup: protectedProcedure
+      .input(
+        z.object({
+          clientId: z.string().max(1_000),
+          clientSecret: z.string().max(10_000),
+          webhookSecret: z.string().max(10_000),
+        }),
+      )
+      .mutation(({ ctx: { auth }, input }) =>
+        saveLinearOauthSetupCommand(auth, input),
+      ),
   }),
 
   teams: createRouter({
@@ -1470,6 +1494,10 @@ export const appRouter = createRouter({
       getDeploymentMcpEnablementsCommand(auth),
     ),
 
+    oauthReadiness: protectedProcedure.query(({ ctx: { auth } }) =>
+      getMcpOauthReadinessCommand(auth),
+    ),
+
     setDeploymentEnabled: protectedProcedure
       .input(z.object({ mcpId: z.string(), enabled: z.boolean() }))
       .mutation(({ ctx: { auth }, input }) =>
diff --git a/apps/worker/src/mcp/roomote-mcp-server/integration-setup.ts b/apps/worker/src/mcp/roomote-mcp-server/integration-setup.ts
index 17b617265..a9c25435a 100644
--- a/apps/worker/src/mcp/roomote-mcp-server/integration-setup.ts
+++ b/apps/worker/src/mcp/roomote-mcp-server/integration-setup.ts
@@ -21,7 +21,7 @@ An admin connects Linear from Settings > Integrations. This uses OAuth to link t
 
 # GitHub
 
-GitHub is connected via a GitHub App installation. An admin installs the Roomote GitHub App on the relevant GitHub organization/repos from Settings > Integrations. Once installed, I can access repo context through the GitHub App installation. Automatic PR review and direct PR @roomote follow-up or re-review requests also require Code Reviewer to be enabled. Automatic review still follows the current reviewer gate, while direct PR mentions are manual requests in the PR thread rather than part of that proactive gate. No per-user OAuth is needed since access goes through the GitHub App installation.
+GitHub is connected via a GitHub App installation. An admin installs the Roomote GitHub App on the relevant GitHub organization/repos from Settings > Integrations. Once installed, I can access repo context through the GitHub App installation. Tasks can manage repository labels and milestones, and can inspect or update accessible GitHub Projects V2 Status fields after confirming mutations. Projects require the GitHub App's Organization projects permission and installation-owner approval. Native GitHub saved views are not available until their API and installation-token compatibility are verified. Automatic PR review and direct PR @roomote follow-up or re-review requests also require Code Reviewer to be enabled. Automatic review still follows the current reviewer gate, while direct PR mentions are manual requests in the PR thread rather than part of that proactive gate. No per-user OAuth is needed since access goes through the GitHub App installation.
 
 # Notion
 
diff --git a/apps/worker/src/sandbox-server/procedures/__tests__/slackQuoteTracking.test.ts b/apps/worker/src/sandbox-server/procedures/__tests__/slackQuoteTracking.test.ts
index ce447ae2a..b4e670fe2 100644
--- a/apps/worker/src/sandbox-server/procedures/__tests__/slackQuoteTracking.test.ts
+++ b/apps/worker/src/sandbox-server/procedures/__tests__/slackQuoteTracking.test.ts
@@ -189,71 +189,6 @@ describe('trackLatestUserMessageForSlackThreadQuote', () => {
     );
   });
 
-  it('strips the <github-pr-follow-up> wrapper and tracks only the clean comment body', async () => {
-    const wrappedMessage = [
-      '<github-pr-follow-up>',
-      'This GitHub PR mention was routed into the existing Roomote task.',
-      '',
-      '<requested-follow-up>',
-      '@roomote please fix the failing CI test',
-      '</requested-follow-up>',
-      '',
-      '<task_context>',
-      '  <repository>owner/repo</repository>',
-      '</task_context>',
-      '</github-pr-follow-up>',
-      '',
-      '<github_message_instructions>',
-      '  <rule>Keep GitHub replies brief.</rule>',
-      '</github_message_instructions>',
-    ].join('\n');
-
-    await trackLatestUserMessageForSlackThreadQuote({
-      runId: 1,
-      text: wrappedMessage,
-      userName: 'Ada Lovelace',
-      logPrefix: 'testProcedure',
-    });
-
-    expect(mockTrackSlackReplyQuote).toHaveBeenCalledWith(
-      {
-        token: 'run-token',
-        platformApiUrl: 'https://platform.example.com',
-      },
-      {
-        runId: 1,
-        text: '@roomote please fix the failing CI test',
-        userName: 'Ada Lovelace',
-      },
-    );
-  });
-
-  it('strips the leading marker even when the envelope is malformed so it never leaks into the quote', async () => {
-    const malformedMessage = [
-      '<github-pr-follow-up>',
-      'This envelope is missing the requested-follow-up block so it will not fully parse.',
-    ].join('\n');
-
-    await trackLatestUserMessageForSlackThreadQuote({
-      runId: 1,
-      text: malformedMessage,
-      userName: 'Ada Lovelace',
-      logPrefix: 'testProcedure',
-    });
-
-    expect(mockTrackSlackReplyQuote).toHaveBeenCalledWith(
-      {
-        token: 'run-token',
-        platformApiUrl: 'https://platform.example.com',
-      },
-      {
-        runId: 1,
-        text: 'This envelope is missing the requested-follow-up block so it will not fully parse.',
-        userName: 'Ada Lovelace',
-      },
-    );
-  });
-
   it('clears the latest user message through the API when the task run has Slack thread context', async () => {
     await clearLatestUserMessageForSlackThreadQuote({
       runId: 1,
diff --git a/apps/worker/src/sandbox-server/procedures/__tests__/steerTask.test.ts b/apps/worker/src/sandbox-server/procedures/__tests__/steerTask.test.ts
index 3faad0132..c0b3a8d62 100644
--- a/apps/worker/src/sandbox-server/procedures/__tests__/steerTask.test.ts
+++ b/apps/worker/src/sandbox-server/procedures/__tests__/steerTask.test.ts
@@ -156,6 +156,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: 'Switch to fixing tests first',
+      quoteText: 'Switch to fixing tests first',
       images: ['data:image/png;base64,abc'],
     });
 
@@ -204,6 +205,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: 'Steer this into the current turn',
+      quoteText: 'Steer this into the current turn',
       images: ['data:image/png;base64,abc'],
     });
 
@@ -227,6 +229,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: '/review-code inspect the latest diff',
+      quoteText: '/review-code inspect the latest diff',
     });
 
     expect(result).toEqual({ success: true });
@@ -243,7 +246,10 @@ describe('steerTask procedure', () => {
     const { caller } = createCaller({ harnessManagerAvailable: false });
 
     await expect(
-      caller.commands.steerTask({ prompt: 'Switch directions' }),
+      caller.commands.steerTask({
+        prompt: 'Switch directions',
+        quoteText: 'Switch directions',
+      }),
     ).rejects.toMatchObject({
       code: 'PRECONDITION_FAILED',
     });
@@ -255,6 +261,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: '   ',
+      quoteText: '   ',
       images: ['data:image/png;base64,abc'],
     });
 
@@ -283,6 +290,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: 'Continue from the queued follow-up',
+      quoteText: 'Continue from the queued follow-up',
     });
 
     expect(result).toEqual({ success: true });
@@ -310,6 +318,7 @@ describe('steerTask procedure', () => {
 
     const result = await caller.commands.steerTask({
       prompt: 'Switch directions',
+      quoteText: 'Switch directions',
     });
 
     expect(result).toEqual({ success: true });
@@ -328,7 +337,10 @@ describe('steerTask procedure', () => {
       });
 
     await expect(
-      caller.commands.steerTask({ prompt: 'Switch directions' }),
+      caller.commands.steerTask({
+        prompt: 'Switch directions',
+        quoteText: 'Switch directions',
+      }),
     ).rejects.toMatchObject({
       code: 'INTERNAL_SERVER_ERROR',
     });
@@ -358,7 +370,10 @@ describe('steerTask procedure', () => {
     });
 
     await expect(
-      caller.commands.steerTask({ prompt: 'Switch directions' }),
+      caller.commands.steerTask({
+        prompt: 'Switch directions',
+        quoteText: 'Switch directions',
+      }),
     ).rejects.toMatchObject({
       code: 'PRECONDITION_FAILED',
     });
@@ -371,7 +386,7 @@ describe('steerTask procedure', () => {
     const { caller } = createCaller();
 
     await expect(
-      caller.commands.steerTask({ prompt: '   ' }),
+      caller.commands.steerTask({ prompt: '   ', quoteText: '   ' }),
     ).rejects.toMatchObject({
       code: 'BAD_REQUEST',
     });
@@ -382,7 +397,10 @@ describe('steerTask procedure', () => {
     const { caller, sendFollowUpPrompt } = createCaller();
 
     await expect(
-      caller.commands.steerTask({ prompt: 'Switch directions' }),
+      caller.commands.steerTask({
+        prompt: 'Switch directions',
+        quoteText: 'Switch directions',
+      }),
     ).rejects.toMatchObject({
       code: 'PRECONDITION_FAILED',
     });
diff --git a/apps/worker/src/sandbox-server/procedures/sendPrompt.ts b/apps/worker/src/sandbox-server/procedures/sendPrompt.ts
index aed4feeb5..4fae9422c 100644
--- a/apps/worker/src/sandbox-server/procedures/sendPrompt.ts
+++ b/apps/worker/src/sandbox-server/procedures/sendPrompt.ts
@@ -19,6 +19,8 @@ import { getFollowUpWorkflowPhase } from '../../run-task/workflow-phase';
 const sendPromptInputSchema = z
   .object({
     prompt: z.string().optional(),
+    /** Original user text before trusted platform context is prepended. */
+    quoteText: z.string().optional(),
     taskTool: taskToolDispatchPayloadSchema.optional(),
     images: z.array(z.string()).optional(),
     /** Where this prompt originated from (e.g., 'web', 'slack'). */
@@ -64,6 +66,18 @@ const sendPromptInputSchema = z
         path: ['prompt'],
       });
     }
+
+    if (
+      data.source === 'web' &&
+      !data.taskTool &&
+      typeof data.quoteText !== 'string'
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'Web prompts must include the original text for reply quotes',
+        path: ['quoteText'],
+      });
+    }
   });
 
 /**
@@ -86,6 +100,7 @@ export const sendPrompt = publicProcedure
     const resolvedPrompt = input.taskTool
       ? getTaskToolInvocation(input.taskTool.actionId, ctx.codingHarness)
       : (input.prompt ?? '');
+    const resolvedQuoteText = input.quoteText ?? resolvedPrompt;
     const workflowPhase = input.taskTool
       ? input.taskTool.actionId
       : getFollowUpWorkflowPhase(resolvedPrompt);
@@ -121,7 +136,7 @@ export const sendPrompt = publicProcedure
         if (input.source === 'web') {
           trackedSlackQuote = await trackLatestUserMessageForSlackThreadQuote({
             runId: ctx.runId,
-            text: resolvedPrompt,
+            text: resolvedQuoteText,
             userName: input.userName,
             logPrefix: 'sendPrompt',
             warn: (message) => ctx.harnessLogger?.warn(message),
@@ -180,7 +195,7 @@ export const sendPrompt = publicProcedure
       if (input.source === 'web') {
         trackedSlackQuote = await trackLatestUserMessageForSlackThreadQuote({
           runId: ctx.runId,
-          text: resolvedPrompt,
+          text: resolvedQuoteText,
           userName: input.userName,
           logPrefix: 'sendPrompt',
           warn: (message) => ctx.harnessLogger?.warn(message),
diff --git a/apps/worker/src/sandbox-server/procedures/slackQuoteTracking.ts b/apps/worker/src/sandbox-server/procedures/slackQuoteTracking.ts
index 6805d7500..ca4aeef37 100644
--- a/apps/worker/src/sandbox-server/procedures/slackQuoteTracking.ts
+++ b/apps/worker/src/sandbox-server/procedures/slackQuoteTracking.ts
@@ -1,7 +1,4 @@
-import {
-  getSlackThreadTsFromTaskPayload,
-  normalizeTranscriptUserText,
-} from '@roomote/types';
+import { getSlackThreadTsFromTaskPayload } from '@roomote/types';
 import { sdk } from '@roomote/sdk/client';
 import { hasSlackThreadReplyContext } from '@roomote/slack/client';
 import { getRoomoteConfig } from '../../mcp/roomote-mcp-server/config';
@@ -10,30 +7,6 @@ import {
   trackSlackReplyQuote,
 } from '../../mcp/roomote-mcp-server/slack-api-client';
 
-/**
- * Extract the user-visible comment body when the tracked text is wrapped in a
- * GitHub PR follow-up envelope so the `<github-pr-follow-up>` routing marker
- * never leaks into the stored Slack reply quote.
- */
-function normalizeSlackQuoteText(text: string): string {
-  const trimmed = text.trim();
-
-  if (!trimmed.startsWith('<github-pr-follow-up>')) {
-    return text;
-  }
-
-  const normalized = normalizeTranscriptUserText(trimmed);
-
-  if (normalized && normalized !== trimmed) {
-    return normalized;
-  }
-
-  // Malformed envelope: the full extraction did not match. Strip the leading
-  // marker so it never leaks into the stored quote. The canonical builder
-  // always emits a well-formed envelope, so this branch is purely defensive.
-  return trimmed.replace(/^<github-pr-follow-up>\s*/, '');
-}
-
 async function getSlackQuoteTrackingConfig(params: {
   runId: number;
   logPrefix: string;
@@ -93,7 +66,7 @@ export async function trackLatestUserMessageForSlackThreadQuote(params: {
 
     await trackSlackReplyQuote(roomoteConfig, {
       runId,
-      text: normalizeSlackQuoteText(text),
+      text,
       userName: userName?.trim() || 'Someone',
     });
     return true;
diff --git a/apps/worker/src/sandbox-server/procedures/steerTask.ts b/apps/worker/src/sandbox-server/procedures/steerTask.ts
index 2d6892b65..8ba84b52e 100644
--- a/apps/worker/src/sandbox-server/procedures/steerTask.ts
+++ b/apps/worker/src/sandbox-server/procedures/steerTask.ts
@@ -18,6 +18,7 @@ export const steerTask = publicProcedure
     z
       .object({
         prompt: z.string(),
+        quoteText: z.string(),
         images: z.array(z.string()).optional(),
         userName: z.string().optional(),
       })
@@ -70,7 +71,7 @@ export const steerTask = publicProcedure
       try {
         trackedSlackQuote = await trackLatestUserMessageForSlackThreadQuote({
           runId: ctx.runId,
-          text: input.prompt,
+          text: input.quoteText,
           userName: input.userName,
           logPrefix: 'steerTask',
           warn: (message) => ctx.harnessLogger?.warn(message),
@@ -126,7 +127,7 @@ export const steerTask = publicProcedure
       try {
         trackedSlackQuote = await trackLatestUserMessageForSlackThreadQuote({
           runId: ctx.runId,
-          text: input.prompt,
+          text: input.quoteText,
           userName: input.userName,
           logPrefix: 'steerTask',
           warn: (message) => ctx.harnessLogger?.warn(message),
@@ -195,7 +196,7 @@ export const steerTask = publicProcedure
     try {
       trackedSlackQuote = await trackLatestUserMessageForSlackThreadQuote({
         runId: ctx.runId,
-        text: input.prompt,
+        text: input.quoteText,
         userName: input.userName,
         logPrefix: 'steerTask',
         warn: (message) => ctx.harnessLogger?.warn(message),
diff --git a/apps/worker/src/workspace/__tests__/workspace-manager-sync.test.ts b/apps/worker/src/workspace/__tests__/workspace-manager-sync.test.ts
index 575a693a3..b9a59c258 100644
--- a/apps/worker/src/workspace/__tests__/workspace-manager-sync.test.ts
+++ b/apps/worker/src/workspace/__tests__/workspace-manager-sync.test.ts
@@ -47,6 +47,51 @@ const GIT_RESOLVE_REMOTE_HEAD_COMMAND = {
   continue_on_error: true,
 } as const;
 
+const GIT_CHECK_REMOTE_BRANCHES_COMMAND = {
+  name: 'Git check remote branches',
+  run: 'git ls-remote --heads origin',
+  timeout: 60,
+  retries: 1,
+  continue_on_error: true,
+} as const;
+
+const GIT_CHECK_LOCAL_COMMITS_COMMAND = {
+  name: 'Git check local commits',
+  run: 'git rev-parse --verify --quiet HEAD',
+  timeout: 60,
+  continue_on_error: true,
+} as const;
+
+function buildPointUnbornHeadCommand(branch: string) {
+  return {
+    name: 'Git point unborn HEAD at default branch',
+    run: `git symbolic-ref HEAD 'refs/heads/${branch}'`,
+    timeout: 60,
+    continue_on_error: false,
+  };
+}
+
+/**
+ * Mock sequence for an empty remote reached through the stored-default-branch
+ * path: fetch succeeds, every origin/HEAD resolution fails, the stored branch
+ * does not exist remotely, and the empty check confirms zero remote heads.
+ */
+function mockEmptyRemoteResolution(executeMock: ReturnType<typeof vi.fn>) {
+  executeMock
+    .mockResolvedValueOnce({ success: true, stdout: '', stderr: '' })
+    .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+    .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+    .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+    .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+    .mockResolvedValueOnce({
+      command: GIT_CHECK_REMOTE_BRANCHES_COMMAND,
+      success: true,
+      duration: 5,
+      stdout: '',
+      stderr: '',
+    });
+}
+
 function buildVerifyRemoteBranchCommand(branch: string) {
   return {
     name: 'Git verify remote branch',
@@ -543,7 +588,17 @@ describe('WorkspaceManager git synchronization', () => {
       .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
       .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
       .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
-      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' });
+      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+      // The remote has branches, so this is a real error and not an
+      // empty-repository bootstrap case.
+      .mockResolvedValueOnce({
+        command: GIT_CHECK_REMOTE_BRANCHES_COMMAND,
+        success: true,
+        duration: 5,
+        stdout:
+          '0123456789abcdef0123456789abcdef01234567\trefs/heads/develop\n',
+        stderr: '',
+      });
 
     await expect(
       syncRepositoryGitState({
@@ -561,6 +616,153 @@ describe('WorkspaceManager git synchronization', () => {
     expect(executor.executeAll).not.toHaveBeenCalled();
   });
 
+  it('bootstraps an unborn branch instead of failing when the remote has no commits', async () => {
+    mockEmptyRemoteResolution(executor.execute);
+    executor.execute
+      // No local commits either: the workspace is a fresh clone.
+      .mockResolvedValueOnce({
+        command: GIT_CHECK_LOCAL_COMMITS_COMMAND,
+        success: false,
+        duration: 5,
+        stdout: '',
+        stderr: '',
+      })
+      .mockResolvedValueOnce({ success: true, stdout: '', stderr: '' });
+
+    await syncRepositoryGitState({
+      executor,
+      repoFullName: 'acme/new-repo',
+      targetBranch: 'main',
+      repositoryId: 'repo-1',
+      allowRemoteHeadFallback: true,
+      setDefaultRemote: false,
+    });
+
+    expect(executor.execute).toHaveBeenNthCalledWith(
+      6,
+      GIT_CHECK_REMOTE_BRANCHES_COMMAND,
+    );
+    expect(executor.execute).toHaveBeenNthCalledWith(
+      7,
+      GIT_CHECK_LOCAL_COMMITS_COMMAND,
+    );
+    expect(executor.execute).toHaveBeenNthCalledWith(
+      8,
+      buildPointUnbornHeadCommand('main'),
+    );
+    expect(executor.executeAll).not.toHaveBeenCalled();
+  });
+
+  it('still sets the default remote repo when bootstrapping an empty repository', async () => {
+    mockEmptyRemoteResolution(executor.execute);
+    executor.execute
+      .mockResolvedValueOnce({
+        command: GIT_CHECK_LOCAL_COMMITS_COMMAND,
+        success: false,
+        duration: 5,
+        stdout: '',
+        stderr: '',
+      })
+      .mockResolvedValueOnce({ success: true, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({ success: true, stdout: '', stderr: '' });
+
+    await syncRepositoryGitState({
+      executor,
+      repoFullName: 'acme/new-repo',
+      targetBranch: 'main',
+      repositoryId: 'repo-1',
+      allowRemoteHeadFallback: true,
+      setDefaultRemote: true,
+    });
+
+    expect(executor.execute).toHaveBeenLastCalledWith({
+      name: 'Set default remote repo.',
+      run: "gh repo set-default 'acme/new-repo'",
+      timeout: 60,
+      continue_on_error: true,
+    });
+  });
+
+  it('preserves local commits when the remote is empty in a reused workspace', async () => {
+    mockEmptyRemoteResolution(executor.execute);
+    executor.execute
+      // Local commits exist: an earlier bootstrap attempt committed work
+      // that has not been pushed yet.
+      .mockResolvedValueOnce({
+        command: GIT_CHECK_LOCAL_COMMITS_COMMAND,
+        success: true,
+        duration: 5,
+        stdout: '0123456789abcdef0123456789abcdef01234567\n',
+        stderr: '',
+      });
+
+    await syncRepositoryGitState({
+      executor,
+      repoFullName: 'acme/new-repo',
+      targetBranch: 'main',
+      repositoryId: 'repo-1',
+      allowRemoteHeadFallback: true,
+      setDefaultRemote: false,
+    });
+
+    expect(executor.execute).toHaveBeenCalledTimes(7);
+    expect(executor.execute).not.toHaveBeenCalledWith(
+      buildPointUnbornHeadCommand('main'),
+    );
+    expect(executor.executeAll).not.toHaveBeenCalled();
+  });
+
+  it('rejects sha pins against an empty remote with a clear error', async () => {
+    mockEmptyRemoteResolution(executor.execute);
+
+    await expect(
+      syncRepositoryGitState({
+        executor,
+        repoFullName: 'acme/new-repo',
+        targetBranch: 'main',
+        sha: '0123456789abcdef0123456789abcdef01234567',
+        repositoryId: 'repo-1',
+        allowRemoteHeadFallback: true,
+        setDefaultRemote: false,
+      }),
+    ).rejects.toThrow(
+      'Cannot pin acme/new-repo to 0123456789abcdef0123456789abcdef01234567: the remote repository has no commits.',
+    );
+
+    expect(executor.executeAll).not.toHaveBeenCalled();
+  });
+
+  it('rethrows the branch resolution error when the empty-remote check itself fails', async () => {
+    executor.execute
+      .mockResolvedValueOnce({ success: true, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({ success: false, stdout: '', stderr: '' })
+      .mockResolvedValueOnce({
+        command: GIT_CHECK_REMOTE_BRANCHES_COMMAND,
+        success: false,
+        duration: 5,
+        stdout: '',
+        stderr: 'fatal: could not query remote',
+      });
+
+    await expect(
+      syncRepositoryGitState({
+        executor,
+        repoFullName: 'acme/backend',
+        targetBranch: 'main',
+        repositoryId: 'repo-1',
+        allowRemoteHeadFallback: true,
+        setDefaultRemote: false,
+      }),
+    ).rejects.toThrow(
+      'Could not determine the default branch for acme/backend',
+    );
+
+    expect(executor.executeAll).not.toHaveBeenCalled();
+  });
+
   it('keeps the longer sync timeout while still pinning repositories to an exact sha', async () => {
     await syncRepositoryGitState({
       executor,
diff --git a/apps/worker/src/workspace/workspace-manager.ts b/apps/worker/src/workspace/workspace-manager.ts
index 1a019145f..c7df19615 100644
--- a/apps/worker/src/workspace/workspace-manager.ts
+++ b/apps/worker/src/workspace/workspace-manager.ts
@@ -862,12 +862,33 @@ export class WorkspaceManager {
       }),
     );
 
-    const checkoutBranch = await this.resolveCheckoutBranch({
-      executor,
-      repoFullName,
-      targetBranch,
-      allowRemoteHeadFallback,
-    });
+    let checkoutBranch: string;
+
+    try {
+      checkoutBranch = await this.resolveCheckoutBranch({
+        executor,
+        repoFullName,
+        targetBranch,
+        allowRemoteHeadFallback,
+      });
+    } catch (error) {
+      // A branch that cannot be resolved is usually a real error, but a
+      // brand-new repository legitimately has no branches yet (for example
+      // one just created through github.com/new without a README). Only that
+      // confirmed-empty case is handled specially; anything else rethrows.
+      if (await this.remoteHasNoBranches(executor)) {
+        await this.prepareEmptyRepositoryWorktree({
+          executor,
+          repoFullName,
+          targetBranch,
+          sha,
+          setDefaultRemote,
+        });
+        return;
+      }
+
+      throw error;
+    }
 
     if (
       allowRemoteHeadFallback &&
@@ -947,6 +968,85 @@ export class WorkspaceManager {
     );
   }
 
+  /**
+   * A brand-new repository can have no branches at all (for example one just
+   * created through github.com/new without a README). An errorless
+   * `git ls-remote --heads` with no output is the ground truth for that
+   * state; a failed lookup is treated as non-empty so real errors surface
+   * through the normal checkout path.
+   */
+  private async remoteHasNoBranches(
+    executor: CommandExecutor,
+  ): Promise<boolean> {
+    const result = await executor.execute({
+      name: 'Git check remote branches',
+      run: 'git ls-remote --heads origin',
+      timeout: 60,
+      retries: 1,
+      continue_on_error: true,
+    });
+
+    return result.success && (result.stdout ?? '').trim() === '';
+  }
+
+  /**
+   * Prepare a worktree for a repository whose remote has no commits. The
+   * checkout/reset command block requires `origin/<branch>` refs that do not
+   * exist yet, so it is skipped entirely; the unborn local branch is instead
+   * pointed at the stored default branch (GitHub reports `default_branch`
+   * even for empty repositories) so the first commit lands where the remote
+   * expects it. Local commits are preserved: a reused workspace mid-bootstrap
+   * may hold work that has not been pushed yet.
+   */
+  private async prepareEmptyRepositoryWorktree({
+    executor,
+    repoFullName,
+    targetBranch,
+    sha,
+    setDefaultRemote,
+  }: {
+    executor: CommandExecutor;
+    repoFullName: string;
+    targetBranch: string;
+    sha?: string;
+    setDefaultRemote: boolean;
+  }): Promise<void> {
+    if (sha) {
+      throw new Error(
+        `Cannot pin ${repoFullName} to ${sha}: the remote repository has no commits.`,
+      );
+    }
+
+    const localHead = await executor.execute({
+      name: 'Git check local commits',
+      run: 'git rev-parse --verify --quiet HEAD',
+      timeout: 60,
+      continue_on_error: true,
+    });
+
+    if (!localHead.success) {
+      await executor.execute({
+        name: 'Git point unborn HEAD at default branch',
+        run: `git symbolic-ref HEAD 'refs/heads/${shellEscape(targetBranch)}'`,
+        timeout: 60,
+        continue_on_error: false,
+      });
+    }
+
+    if (setDefaultRemote) {
+      await executor.execute({
+        name: 'Set default remote repo.',
+        run: `gh repo set-default '${shellEscape(repoFullName)}'`,
+        timeout: 60,
+        continue_on_error: true,
+      });
+    }
+
+    console.log(
+      `Remote for ${repoFullName} has no commits yet; prepared an empty-repository worktree on branch ${targetBranch}.`,
+    );
+  }
+
   private async resolveCheckoutBranch({
     executor,
     repoFullName,
diff --git a/package.json b/package.json
index ea732b64a..f5dbc9018 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "roomote",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "license": "FCL-1.0-ALv2",
   "packageManager": "pnpm@10.29.3",
   "engines": {
diff --git a/packages/cloud-agents/src/packaged-skill-invocations.ts b/packages/cloud-agents/src/packaged-skill-invocations.ts
index 858d5721c..1f3501eee 100644
--- a/packages/cloud-agents/src/packaged-skill-invocations.ts
+++ b/packages/cloud-agents/src/packaged-skill-invocations.ts
@@ -21,6 +21,7 @@ const CORE_PACKAGED_SKILL_INVOCATIONS = [
   'environment-setup',
   'explain-repo-code',
   'fix-pr',
+  'github-management',
   'implement-repo-change',
   'implement-changes',
   'merge-resolution-review',
diff --git a/packages/cloud-agents/src/server/workflows/__tests__/environmentSetupSkill.test.ts b/packages/cloud-agents/src/server/workflows/__tests__/environmentSetupSkill.test.ts
index 753b820bf..121b4a20d 100644
--- a/packages/cloud-agents/src/server/workflows/__tests__/environmentSetupSkill.test.ts
+++ b/packages/cloud-agents/src/server/workflows/__tests__/environmentSetupSkill.test.ts
@@ -34,6 +34,30 @@ describe('environment-setup guidance', () => {
     );
   });
 
+  it('bootstraps empty repositories with a minimal initial commit only', () => {
+    const skillContent = readSkillContent();
+
+    expect(skillContent).toContain(
+      'Bootstrap an empty repository before analysis',
+    );
+    expect(skillContent).toContain(
+      'create exactly one bootstrap commit containing only a `README.md`',
+    );
+    expect(skillContent).toContain(
+      'Do not scaffold application code, frameworks, package manifests, CI config, or anything beyond those two files',
+    );
+    expect(skillContent).toContain('Never force-push.');
+    expect(skillContent).toContain(
+      'If the repository has any commits, skip this step entirely and continue with normal analysis.',
+    );
+    expect(skillContent).toContain(
+      'Do not invent install, dev, or test commands for code that does not exist.',
+    );
+    expect(skillContent).toContain(
+      'it should confirm the workspace clones and environment setup completes cleanly, not expect a running service, test suite, or localhost surface',
+    );
+  });
+
   it('allows revising an existing environment instead of always creating a new one', () => {
     const skillContent = readSkillContent();
 
diff --git a/packages/cloud-agents/src/server/workflows/__tests__/githubManagementSkill.test.ts b/packages/cloud-agents/src/server/workflows/__tests__/githubManagementSkill.test.ts
new file mode 100644
index 000000000..c00dbe278
--- /dev/null
+++ b/packages/cloud-agents/src/server/workflows/__tests__/githubManagementSkill.test.ts
@@ -0,0 +1,35 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const thisDirPath = path.dirname(fileURLToPath(import.meta.url));
+
+function readGitHubManagementSkill(): string {
+  return fs.readFileSync(
+    path.resolve(thisDirPath, '../skills/standard/github-management/SKILL.md'),
+    'utf8',
+  );
+}
+
+describe('github-management skill', () => {
+  it('requires confirmation for destructive GitHub mutations and reads back every write', () => {
+    const skill = readGitHubManagementSkill();
+
+    expect(skill).toContain('Creations and additive actions run directly');
+    expect(skill).toContain('Before a destructive change');
+    expect(skill).toContain('use `request_user_input`');
+    expect(skill).toContain('After a write, read back');
+    expect(skill).toContain(
+      'Before deletion, show the exact resource name and URL',
+    );
+  });
+
+  it('uses the scoped GitHub CLI contract and gates native saved views', () => {
+    const skill = readGitHubManagementSkill();
+
+    expect(skill).toContain('use `gh api` only');
+    expect(skill).toContain('`gh api graphql`');
+    expect(skill).toContain('Native GitHub saved views are not supported');
+    expect(skill).toContain('do not inject a linked user');
+  });
+});
diff --git a/packages/cloud-agents/src/server/workflows/__tests__/linearAgentSession.test.ts b/packages/cloud-agents/src/server/workflows/__tests__/linearAgentSession.test.ts
new file mode 100644
index 000000000..d0d56b93d
--- /dev/null
+++ b/packages/cloud-agents/src/server/workflows/__tests__/linearAgentSession.test.ts
@@ -0,0 +1,25 @@
+import { formatLinearIssueContext } from '../linearAgentSession';
+
+describe('formatLinearIssueContext', () => {
+  it('excludes Linear agent-system comments from the prompt context', () => {
+    const context = formatLinearIssueContext({
+      previousComments: [
+        {
+          id: 'agent-session-comment',
+          body: 'This thread is for an agent session with bruno.',
+          userId: 'bot:agent-session-comment',
+          username: 'Linear',
+        },
+        {
+          id: 'human-comment',
+          body: 'Please make the background red.',
+          userId: 'linear-user-1',
+          username: 'Bruno',
+        },
+      ],
+    });
+
+    expect(context).toContain('Please make the background red.');
+    expect(context).not.toContain('This thread is for an agent session');
+  });
+});
diff --git a/packages/cloud-agents/src/server/workflows/__tests__/standardTaskExplicitInvocationRouting.test.ts b/packages/cloud-agents/src/server/workflows/__tests__/standardTaskExplicitInvocationRouting.test.ts
index 89ae86183..d5d1fce03 100644
--- a/packages/cloud-agents/src/server/workflows/__tests__/standardTaskExplicitInvocationRouting.test.ts
+++ b/packages/cloud-agents/src/server/workflows/__tests__/standardTaskExplicitInvocationRouting.test.ts
@@ -113,6 +113,16 @@ describe('Standard Task explicit invocation routing', () => {
     expect(prompt.startsWith('$agent-browser\n<request>')).toBe(true);
   });
 
+  it('treats GitHub management invocations as packaged-skill entry', () => {
+    const { prompt } = standardTask({
+      description: '$github-management\n\nCreate a priority label.',
+      repo: 'Roomote/example-app',
+      requestFormat: 'structured',
+    });
+
+    expect(prompt.startsWith('$github-management\n<request>')).toBe(true);
+  });
+
   it('treats productized Sentry triage invocations as packaged-skill entry in customer repos', () => {
     const { prompt } = standardTask({
       description:
diff --git a/packages/cloud-agents/src/server/workflows/linearAgentSession.ts b/packages/cloud-agents/src/server/workflows/linearAgentSession.ts
index 8d47ef6a8..2d74fbbca 100644
--- a/packages/cloud-agents/src/server/workflows/linearAgentSession.ts
+++ b/packages/cloud-agents/src/server/workflows/linearAgentSession.ts
@@ -10,7 +10,7 @@ import { standardTask } from './standardTask';
 /**
  * Format Linear issue and comments into context string
  */
-function formatLinearIssueContext({
+export function formatLinearIssueContext({
   issueDescription,
   commentBody,
   previousComments,
@@ -21,6 +21,7 @@ function formatLinearIssueContext({
     id: string;
     body: string;
     username?: string;
+    userId?: string;
     createdAt?: string;
   }>;
 }): string {
@@ -32,9 +33,13 @@ function formatLinearIssueContext({
   }
 
   // Add previous comments for context
-  if (previousComments && previousComments.length > 0) {
+  const humanComments = previousComments?.filter(
+    (comment) => !comment.userId?.startsWith('bot:'),
+  );
+
+  if (humanComments && humanComments.length > 0) {
     context += '\n\n## Previous Comments\n\n';
-    for (const comment of previousComments) {
+    for (const comment of humanComments) {
       const author = comment.username || 'User';
       const date = comment.createdAt
         ? new Date(comment.createdAt).toLocaleString()
diff --git a/packages/cloud-agents/src/server/workflows/skills/standard/environment-setup/SKILL.md b/packages/cloud-agents/src/server/workflows/skills/standard/environment-setup/SKILL.md
index e85b798e2..39849c5e0 100644
--- a/packages/cloud-agents/src/server/workflows/skills/standard/environment-setup/SKILL.md
+++ b/packages/cloud-agents/src/server/workflows/skills/standard/environment-setup/SKILL.md
@@ -31,6 +31,22 @@ You are an expert Roomote environment analyst. Analyze the already-checked-out r
         <validation>The repository target and branch baseline are explicit before config drafting starts.</validation>
       </step>
 
+      <step number="1a">
+        <title>Bootstrap an empty repository before analysis</title>
+        <description>A brand-new repository with no commits (for example one just created on github.com) cannot be analyzed or validated until it has an initial commit. Give it the smallest possible bootstrap, then continue normally.</description>
+        <actions>
+          <action>Detect emptiness from the checked-out workspace: `git log --oneline -1` failing (unborn HEAD) together with an effectively empty worktree means the repository has no commits yet. If the repository has any commits, skip this step entirely and continue with normal analysis.</action>
+          <action>When the repository is empty, create exactly one bootstrap commit containing only a `README.md` (the repository name as a title plus a line noting that Roomote initialized the repository) and a minimal general-purpose `.gitignore`. Do not scaffold application code, frameworks, package manifests, CI config, or anything beyond those two files; building the actual project is the user's next task, not part of environment setup.</action>
+          <action>Commit directly to the branch the workspace is already on (the unborn branch was already pointed at the repository's stored default branch) and push it with `git push -u origin <default-branch>`. Never force-push.</action>
+          <action>If the push is rejected because commits appeared on the remote in the meantime, discard the bootstrap commit, fetch, check out the remote default branch, and continue as a normal non-empty repository.</action>
+          <action>After the bootstrap push succeeds, continue the normal workflow against the now-initialized repository and expect the resulting environment definition to be minimal: typically the repository mapping alone with no commands, services, docker projects, or ports, because there is no application to install, test, or start yet. Do not invent install, dev, or test commands for code that does not exist.</action>
+          <action>When launching the follow-up verification task for such a minimal environment, adapt the verification prompt to what actually exists: it should confirm the workspace clones and environment setup completes cleanly, not expect a running service, test suite, or localhost surface.</action>
+          <action>In `agentInstructions`, note that the repository was newly initialized by Roomote and contains no application code yet.</action>
+          <action>In the final handoff, say that the repository was brand new, that Roomote pushed the initial commit, and that the user's next task can start building the actual project.</action>
+        </actions>
+        <validation>An empty repository receives exactly one README plus .gitignore bootstrap commit on its default branch; a repository with any existing commits is untouched by this step.</validation>
+      </step>
+
       <step number="2">
         <title>Inspect static repository evidence</title>
         <description>Collect only evidence that supports concrete environment fields.</description>
@@ -304,6 +320,8 @@ You are an expert Roomote environment analyst. Analyze the already-checked-out r
 <rule>Use `repositories[].commands` only for executing commands and setting configuration needed to validate the environment.</rule>
 <rule>If setup requires configuration or runtime file creation or modification, represent it with `repositories[].commands` entries instead of asking the user to edit files directly.</rule>
 <rule>Do not use `repositories[].commands` to write, generate, or patch application or source code; if source changes are required, report that as a blocker or separate follow-up work.</rule>
+<rule>When the target repository has no commits at all, bootstrap it with exactly one commit containing only `README.md` and `.gitignore` pushed to its default branch; never force-push, and never scaffold application code, frameworks, package manifests, or CI config during environment setup.</rule>
+<rule>For a just-bootstrapped repository, keep the environment definition minimal (typically the repository mapping with no commands, services, or ports) instead of inventing commands for application code that does not exist yet.</rule>
 <rule>Treat each `run` field as newline-split before execution. Do not rely on YAML multiline blocks to preserve shell control flow across lines.</rule>
 <rule>Do not emit YAML `run: |` blocks for `if ... fi`, `case`, loops, heredocs, or multiline shell functions unless the entire block is wrapped inside one explicit shell command such as `bash -lc '...'`.</rule>
 <rule>When setup logic needs conditional or multiline behavior, prefer multiple simple command entries or one explicit shell wrapper command over raw multiline shell fragments.</rule>
diff --git a/packages/cloud-agents/src/server/workflows/skills/standard/github-management/SKILL.md b/packages/cloud-agents/src/server/workflows/skills/standard/github-management/SKILL.md
new file mode 100644
index 000000000..a3d6c4a8e
--- /dev/null
+++ b/packages/cloud-agents/src/server/workflows/skills/standard/github-management/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: github-management
+description: Manage repository labels, milestones, and GitHub Projects V2 safely through the scoped GitHub App credential. Use for requests to list, create, edit, delete, assign, or move GitHub management resources.
+---
+
+# GitHub Management
+
+<role>
+You manage routine GitHub repository operations with the task's scoped GitHub App credential. Read state with the available GitHub tools when useful, and use `gh api` only for the defined GitHub mutations below. Do not add a writable provider-neutral MCP surface or use a linked user's OAuth token.
+</role>
+
+<scope>
+- Default to the repository mapped to the task. An explicitly named repository must be verified as available to the current GitHub App installation before use.
+- Support labels, milestones, and organization GitHub Projects V2 that the installation can access.
+- Native GitHub saved views are not supported until the capability check below confirms an installation-token-compatible API. Do not describe a generated issue-search URL as a saved view.
+- Do not add an issue to a project, change non-single-select fields, or operate on a user-owned project without a separate capability and product decision.
+</scope>
+
+<mutation_policy>
+- Read-only requests run without confirmation.
+- Creations and additive actions run directly. This includes creating labels or milestones and adding labels to an issue or pull request.
+- Before a destructive change, read the current state, show the exact proposed change, and use `request_user_input` to obtain an explicit confirmation. Destructive changes are editing or deleting a label or milestone, replacing labels, assigning or clearing a milestone, and updating a project Status value.
+- Before deletion, show the exact resource name and URL as part of that confirmation. Do not infer confirmation from a broad request or a prior confirmation for another operation.
+- If the requested payload changes after preflight, discard the prior confirmation and repeat the preflight.
+- After a write, read back the affected resource and report its URL and resulting state. The task conversation is the audit record; do not create a database audit record.
+- Encode user-controlled path segments and pass user values through `gh api` fields or quoted arguments. Never interpolate them into executable shell fragments.
+</mutation_policy>
+
+<labels>
+- List and inspect labels through `/repos/{owner}/{repo}/labels`.
+- Create labels with `POST /repos/{owner}/{repo}/labels`; edit with `PATCH /repos/{owner}/{repo}/labels/{name}`; delete with `DELETE /repos/{owner}/{repo}/labels/{name}`.
+- Apply labels to an issue or pull request through `/repos/{owner}/{repo}/issues/{number}/labels`. Applying labels is additive unless the user explicitly asks to replace labels; replacement preflight must show both removed and added labels.
+- Validate the issue or pull request number, label existence, duplicate names, and GitHub label-color format before confirmation.
+</labels>
+
+<milestones>
+- List and inspect milestones through `/repos/{owner}/{repo}/milestones`.
+- Create with `POST /repos/{owner}/{repo}/milestones`, edit with `PATCH /repos/{owner}/{repo}/milestones/{number}`, and delete with `DELETE /repos/{owner}/{repo}/milestones/{number}`.
+- Assign or clear a milestone through `PATCH /repos/{owner}/{repo}/issues/{number}` with the resolved milestone number or `null`.
+- Report progress from the milestone's open and closed issue counts. Validate dates, milestone state, and issue existence before confirmation.
+</milestones>
+
+<projects_v2>
+- Use `gh api graphql` to discover organization projects, project fields, project items, and single-select option IDs. Do not assume a board schema or column position.
+- Resolve the requested project and field by name. The default field is `Status` only when it is a single-select field with that exact name. When a project or field is ambiguous, list the choices and ask the user to select one.
+- Locate the issue or pull request's existing item. If it is not in the project, report that fact instead of adding it.
+- Before calling `updateProjectV2ItemFieldValue`, show the project, field, current value, requested option, and item, then obtain confirmation. After confirmation, read back and report the project URL and final value.
+- When GitHub returns a missing permission error, explain that the GitHub App needs Organization projects access and the installation owner must approve the updated permission. Do not report the project as missing.
+</projects_v2>
+
+<saved_views_capability_check>
+Before adding any native saved-view command, verify the exact GitHub endpoint, resource ownership, response URL, and whether an installation token can list, create, and delete the resource. Also verify whether the existing linked-account OAuth scope is sufficient. Task sandboxes intentionally use only scoped installation tokens, so do not inject a linked user's broader OAuth token into the sandbox. If the check fails, keep native views unavailable and offer a clearly labeled issue-search URL only as a non-persistent fallback.
+</saved_views_capability_check>
+
+<completion_criteria>
+- Every destructive mutation had the appropriate preflight and explicit confirmation; every write had a read-back.
+- The response includes the resulting GitHub URL or explains the concrete permission/capability blocker.
+- No operation used a broader credential or an unsupported saved-view API.
+</completion_criteria>
diff --git a/packages/communication/package.json b/packages/communication/package.json
index 78b704264..5825e6a7b 100644
--- a/packages/communication/package.json
+++ b/packages/communication/package.json
@@ -17,6 +17,7 @@
     "./task-thread-title": "./src/task-thread-title.ts",
     "./teams-activity": "./src/teams-activity.ts",
     "./teams-bot-framework-client": "./src/teams-bot-framework-client.ts",
+    "./teams-credential-validation": "./src/teams-credential-validation.ts",
     "./teams-graph-client": "./src/teams-graph-client.ts",
     "./teams-provider": "./src/teams-provider.ts",
     "./telegram-provider": "./src/telegram-provider.ts",
diff --git a/packages/communication/src/__tests__/messages.test.ts b/packages/communication/src/__tests__/messages.test.ts
index d7b0d930a..4ce72ddc4 100644
--- a/packages/communication/src/__tests__/messages.test.ts
+++ b/packages/communication/src/__tests__/messages.test.ts
@@ -51,8 +51,10 @@ vi.mock('@roomote/redis', () => ({
 }));
 
 import {
+  claimLatestUserMessageForReplyQuote,
   clearLatestUserMessageForReplyQuote,
   clearLatestUserMessageForReplyQuoteIfId,
+  completeClaimedLatestUserMessageForReplyQuote,
   getCommunicationMessages,
   getLatestInboundMessageId,
   getLatestUserMessageForReplyQuote,
@@ -62,6 +64,7 @@ import {
   setLatestInboundMessageId,
   setLatestUserMessageForReplyQuote,
   trackLatestUserMessageForReplyQuote,
+  restoreClaimedLatestUserMessageForReplyQuote,
 } from '../messages';
 
 describe('communication message queues', () => {
@@ -314,6 +317,24 @@ describe('communication message queues', () => {
       );
     });
 
+    it('supports GitHub reply quotes without adding GitHub as a chat provider', async () => {
+      await setLatestUserMessageForReplyQuote('github', 44, {
+        text: 'ship it',
+        userName: 'Ada',
+      });
+
+      expect(setMock).toHaveBeenCalledWith(
+        'github:latest_user_message:44',
+        JSON.stringify({
+          id: 'quote-id-fixed',
+          text: 'ship it',
+          userName: 'Ada',
+        }),
+        'EX',
+        30 * 24 * 60 * 60,
+      );
+    });
+
     it('reads the latest user message', async () => {
       getMock.mockResolvedValueOnce(
         JSON.stringify({
@@ -344,6 +365,78 @@ describe('communication message queues', () => {
       ).resolves.toBeNull();
     });
 
+    it('claims a message with a replay-safe attempt token', async () => {
+      const message = {
+        id: 'quote-1',
+        text: 'hello',
+        userName: 'Bob',
+      };
+      evalMock.mockResolvedValueOnce(JSON.stringify(message));
+
+      await expect(
+        claimLatestUserMessageForReplyQuote('github', 44),
+      ).resolves.toEqual({
+        claimToken: 'quote-id-fixed',
+        message,
+      });
+
+      expect(evalMock).toHaveBeenCalledWith(
+        expect.stringMatching(
+          /claimed\.claimToken == ARGV\[1\][\s\S]*return claimed\.message/,
+        ),
+        2,
+        'github:latest_user_message:44',
+        'github:latest_user_message_claim:44',
+        'quote-id-fixed',
+        30 * 24 * 60 * 60,
+      );
+    });
+
+    it('restores only the matching claim token', async () => {
+      const claim = {
+        claimToken: 'claim-1',
+        message: {
+          id: 'quote-1',
+          text: 'hello',
+          userName: 'Bob',
+        },
+      };
+
+      await restoreClaimedLatestUserMessageForReplyQuote('github', 44, claim);
+
+      expect(evalMock).toHaveBeenCalledWith(
+        expect.stringContaining('claimed.claimToken ~= ARGV[1]'),
+        2,
+        'github:latest_user_message:44',
+        'github:latest_user_message_claim:44',
+        'claim-1',
+        JSON.stringify(claim.message),
+        30 * 24 * 60 * 60,
+      );
+    });
+
+    it('completes only the matching claim token', async () => {
+      const claim = {
+        claimToken: 'claim-1',
+        message: {
+          id: 'quote-1',
+          text: 'hello',
+          userName: 'Bob',
+        },
+      };
+
+      await expect(
+        completeClaimedLatestUserMessageForReplyQuote('github', 44, claim),
+      ).resolves.toBe(true);
+
+      expect(evalMock).toHaveBeenCalledWith(
+        expect.stringContaining('claimed.claimToken ~= ARGV[1]'),
+        1,
+        'github:latest_user_message_claim:44',
+        'claim-1',
+      );
+    });
+
     it('clears the latest user message', async () => {
       delMock.mockResolvedValueOnce(1);
 
diff --git a/packages/communication/src/__tests__/teams-credential-validation.test.ts b/packages/communication/src/__tests__/teams-credential-validation.test.ts
new file mode 100644
index 000000000..16f98f66f
--- /dev/null
+++ b/packages/communication/src/__tests__/teams-credential-validation.test.ts
@@ -0,0 +1,210 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  TeamsBotCredentialValidationError,
+  validateTeamsBotCredentials,
+} from '../teams-credential-validation';
+
+function buildTokenErrorResponse(body: unknown, status = 401) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+async function expectValidationError(
+  promise: Promise<void>,
+): Promise<TeamsBotCredentialValidationError> {
+  try {
+    await promise;
+  } catch (error) {
+    expect(error).toBeInstanceOf(TeamsBotCredentialValidationError);
+    return error as TeamsBotCredentialValidationError;
+  }
+
+  throw new Error('Expected validateTeamsBotCredentials to reject.');
+}
+
+describe('validateTeamsBotCredentials', () => {
+  it('resolves when Microsoft issues a token for the credentials', async () => {
+    const fetchMock = vi.fn(async () =>
+      Response.json({ access_token: 'token', expires_in: 3600 }),
+    );
+
+    await expect(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'app-password',
+        tenantId: 'tenant-id',
+        fetch: fetchMock as unknown as typeof fetch,
+      }),
+    ).resolves.toBeUndefined();
+
+    const [url, init] = fetchMock.mock.calls[0] as unknown as [
+      string,
+      RequestInit,
+    ];
+    expect(url).toBe(
+      'https://login.microsoftonline.com/tenant-id/oauth2/v2.0/token',
+    );
+    expect(String(init.body)).toContain('grant_type=client_credentials');
+  });
+
+  it('blames the client secret for AADSTS7000215', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'wrong-secret',
+        fetch: (async () =>
+          buildTokenErrorResponse({
+            error: 'invalid_client',
+            error_description:
+              'AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID.\r\nTrace ID: abc\r\nCorrelation ID: def',
+            error_codes: [7000215],
+          })) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('invalid_app_password');
+    expect(error.field).toBe('app_password');
+    // Entra's advice sentence is dropped; the field guidance layered on top by
+    // the web save path restates it.
+    expect(error.detail).toBe('AADSTS7000215: Invalid client secret provided.');
+  });
+
+  it('blames the app id for AADSTS700016', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: '00000000-0000-0000-0000-000000000001',
+        appPassword: 'app-password',
+        tenantId: '00000000-0000-0000-0000-000000000002',
+        fetch: (async () =>
+          buildTokenErrorResponse({
+            error: 'unauthorized_client',
+            error_description:
+              "AADSTS700016: Application with identifier '00000000-0000-0000-0000-000000000001' was not found in the directory 'contoso'.\r\nTrace ID: abc",
+            error_codes: [700016],
+          })) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('invalid_app_id');
+    expect(error.field).toBe('app_id');
+  });
+
+  it('strips inline trace ids from the detail (live AADSTS90002 shape)', async () => {
+    // Real Entra responses sometimes carry the diagnostics tail on the same
+    // line as the message instead of after \r\n.
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'app-password',
+        tenantId: '00000000-0000-0000-0000-000000000002',
+        fetch: (async () =>
+          buildTokenErrorResponse(
+            {
+              error: 'invalid_request',
+              error_description:
+                "AADSTS90002: Tenant '00000000-0000-0000-0000-000000000002' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant. Trace ID: bcea6d9d-1541-483f-a604-cc63ae9e6300 Correlation ID: 01af5574-834a-4b0d-8e1c-f7a3019567f1 Timestamp: 2026-07-29 16:22:35Z",
+              error_codes: [90002],
+            },
+            400,
+          )) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('invalid_tenant_id');
+    expect(error.detail).toBe(
+      "AADSTS90002: Tenant '00000000-0000-0000-0000-000000000002' not found.",
+    );
+    expect(error.detail).not.toMatch(/Trace ID|Correlation ID|Timestamp/);
+  });
+
+  it('blames the tenant for AADSTS90002', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'app-password',
+        tenantId: 'not-a-tenant',
+        fetch: (async () =>
+          buildTokenErrorResponse(
+            {
+              error: 'invalid_request',
+              error_description:
+                "AADSTS90002: Tenant 'not-a-tenant' not found.",
+              error_codes: [90002],
+            },
+            400,
+          )) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('invalid_tenant_id');
+    expect(error.field).toBe('tenant_id');
+  });
+
+  it('reads AADSTS codes out of the description when error_codes is absent', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'expired-secret',
+        fetch: (async () =>
+          buildTokenErrorResponse({
+            error: 'invalid_client',
+            error_description:
+              "AADSTS7000222: The provided client secret keys for app 'app-id' are expired.",
+          })) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('expired_app_password');
+    expect(error.field).toBe('app_password');
+  });
+
+  it('reports an unnamed rejection for unrecognized failures', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'app-password',
+        fetch: (async () =>
+          new Response('<html>gateway error</html>', {
+            status: 502,
+          })) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('rejected');
+    expect(error.field).toBeNull();
+    expect(error.message).toContain('HTTP 502');
+  });
+
+  it('separates an unreachable token endpoint from rejected credentials', async () => {
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: 'app-id',
+        appPassword: 'app-password',
+        fetch: (async () => {
+          throw new TypeError('fetch failed');
+        }) as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('unreachable');
+    expect(error.field).toBeNull();
+  });
+
+  it('rejects empty credentials without calling Microsoft', async () => {
+    const fetchMock = vi.fn();
+
+    const error = await expectValidationError(
+      validateTeamsBotCredentials({
+        appId: '  ',
+        appPassword: 'app-password',
+        fetch: fetchMock as unknown as typeof fetch,
+      }),
+    );
+
+    expect(error.code).toBe('missing_credentials');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/communication/src/index.ts b/packages/communication/src/index.ts
index 22569eac2..b7a7d6a11 100644
--- a/packages/communication/src/index.ts
+++ b/packages/communication/src/index.ts
@@ -8,6 +8,7 @@ export * from './request-user-input';
 export * from './task-thread-title';
 export * from './teams-activity';
 export * from './teams-bot-framework-client';
+export * from './teams-credential-validation';
 export * from './teams-graph-client';
 export * from './teams-provider';
 export * from './telegram-provider';
diff --git a/packages/communication/src/messages.ts b/packages/communication/src/messages.ts
index f7e746bfe..087ea3271 100644
--- a/packages/communication/src/messages.ts
+++ b/packages/communication/src/messages.ts
@@ -7,6 +7,8 @@ import {
   queuedCommunicationMessageSchema,
 } from '@roomote/types';
 
+type ReplyQuoteProvider = CommunicationProvider | 'github';
+
 const COMMUNICATION_MESSAGE_TTL_SECONDS = 60 * 60;
 const COMMUNICATION_MESSAGE_DEDUPE_TTL_SECONDS = 24 * 60 * 60;
 const LATEST_INBOUND_MESSAGE_ID_TTL_SECONDS = 60 * 60 * 24;
@@ -19,8 +21,13 @@ export interface LatestUserMessageForReplyQuote {
   userName: string;
 }
 
+export interface ClaimedLatestUserMessageForReplyQuote {
+  claimToken: string;
+  message: LatestUserMessageForReplyQuote;
+}
+
 type TrackLatestUserMessageForReplyQuoteParams = {
-  provider: CommunicationProvider;
+  provider: ReplyQuoteProvider;
   runId: number;
   text: string;
   userName: string;
@@ -46,6 +53,40 @@ if data.id ~= ARGV[1] then
 end
 return redis.call('DEL', KEYS[1])
 `;
+const CLAIM_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT = `
+local claimedRaw = redis.call('GET', KEYS[2])
+if claimedRaw then
+  local claimedOk, claimed = pcall(cjson.decode, claimedRaw)
+  if claimedOk and type(claimed) == 'table' and claimed.claimToken == ARGV[1] and type(claimed.message) == 'string' then
+    return claimed.message
+  end
+end
+local raw = redis.call('GET', KEYS[1])
+if not raw then return nil end
+local ok, data = pcall(cjson.decode, raw)
+if not ok or type(data) ~= 'table' or type(data.id) ~= 'string' then return nil end
+redis.call('SET', KEYS[2], cjson.encode({ claimToken = ARGV[1], message = raw }), 'EX', ARGV[2])
+redis.call('DEL', KEYS[1])
+return raw
+`;
+const RESTORE_CLAIMED_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT = `
+if redis.call('EXISTS', KEYS[1]) == 1 then return 0 end
+local claimedRaw = redis.call('GET', KEYS[2])
+if not claimedRaw then return 0 end
+local ok, claimed = pcall(cjson.decode, claimedRaw)
+if not ok or type(claimed) ~= 'table' or claimed.claimToken ~= ARGV[1] then return 0 end
+local restored = redis.call('SET', KEYS[1], ARGV[2], 'EX', ARGV[3], 'NX')
+if not restored then return 0 end
+redis.call('DEL', KEYS[2])
+return 1
+`;
+const COMPLETE_CLAIMED_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT = `
+local claimedRaw = redis.call('GET', KEYS[1])
+if not claimedRaw then return 0 end
+local ok, claimed = pcall(cjson.decode, claimedRaw)
+if not ok or type(claimed) ~= 'table' or claimed.claimToken ~= ARGV[1] then return 0 end
+return redis.call('DEL', KEYS[1])
+`;
 
 const QUEUE_COMMUNICATION_MESSAGE_ONCE_SCRIPT = `
 if redis.call('EXISTS', KEYS[2]) == 1 then
@@ -72,12 +113,19 @@ function getLatestInboundMessageIdKey(
 }
 
 function getLatestUserMessageForReplyQuoteKey(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
 ): string {
   return `${provider}:latest_user_message:${runId}`;
 }
 
+function getLatestUserMessageClaimKey(
+  provider: ReplyQuoteProvider,
+  runId: number,
+): string {
+  return `${provider}:latest_user_message_claim:${runId}`;
+}
+
 function parseLatestUserMessageForReplyQuote(
   raw: string | null,
 ): LatestUserMessageForReplyQuote | null {
@@ -108,7 +156,7 @@ function parseLatestUserMessageForReplyQuote(
 }
 
 function getCommunicationMessageDedupeKey(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
   messageId: string,
 ): string {
@@ -350,7 +398,7 @@ export async function getLatestInboundMessageId(
  * quote it back into the originating chat thread (Discord parity with Slack).
  */
 export async function setLatestUserMessageForReplyQuote(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
   message: Omit<LatestUserMessageForReplyQuote, 'id'> & { id?: string },
 ): Promise<LatestUserMessageForReplyQuote> {
@@ -399,7 +447,7 @@ export async function trackLatestUserMessageForReplyQuote({
 }
 
 export async function getLatestUserMessageForReplyQuote(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
 ): Promise<LatestUserMessageForReplyQuote | null> {
   const redis = getRedis();
@@ -409,8 +457,67 @@ export async function getLatestUserMessageForReplyQuote(
   return parseLatestUserMessageForReplyQuote(raw);
 }
 
+export async function claimLatestUserMessageForReplyQuote(
+  provider: ReplyQuoteProvider,
+  runId: number,
+): Promise<ClaimedLatestUserMessageForReplyQuote | null> {
+  const claimToken = randomUUID();
+  const raw = await getRedis().eval(
+    CLAIM_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT,
+    2,
+    getLatestUserMessageForReplyQuoteKey(provider, runId),
+    getLatestUserMessageClaimKey(provider, runId),
+    claimToken,
+    LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_TTL_SECONDS,
+  );
+  const message = parseLatestUserMessageForReplyQuote(
+    typeof raw === 'string' ? raw : null,
+  );
+
+  return message ? { claimToken, message } : null;
+}
+
+export async function restoreClaimedLatestUserMessageForReplyQuote(
+  provider: ReplyQuoteProvider,
+  runId: number,
+  claim: ClaimedLatestUserMessageForReplyQuote,
+): Promise<void> {
+  await getRedis().eval(
+    RESTORE_CLAIMED_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT,
+    2,
+    getLatestUserMessageForReplyQuoteKey(provider, runId),
+    getLatestUserMessageClaimKey(provider, runId),
+    claim.claimToken,
+    JSON.stringify(claim.message),
+    LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_TTL_SECONDS,
+  );
+}
+
+export async function completeClaimedLatestUserMessageForReplyQuote(
+  provider: ReplyQuoteProvider,
+  runId: number,
+  claim: ClaimedLatestUserMessageForReplyQuote,
+): Promise<boolean> {
+  try {
+    const result = await getRedis().eval(
+      COMPLETE_CLAIMED_LATEST_USER_MESSAGE_FOR_REPLY_QUOTE_SCRIPT,
+      1,
+      getLatestUserMessageClaimKey(provider, runId),
+      claim.claimToken,
+    );
+    return typeof result === 'number' ? result > 0 : Number(result) > 0;
+  } catch (error) {
+    console.error(
+      `[completeClaimedLatestUserMessageForReplyQuote] Failed to complete latest user message claim for ${provider} task run ${runId}: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+    return false;
+  }
+}
+
 export async function clearLatestUserMessageForReplyQuote(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
 ): Promise<void> {
   try {
@@ -430,7 +537,7 @@ export async function clearLatestUserMessageForReplyQuote(
  * was quoted on this delivery. Prevents clearing a newer same-text follow-up.
  */
 export async function clearLatestUserMessageForReplyQuoteIfId(
-  provider: CommunicationProvider,
+  provider: ReplyQuoteProvider,
   runId: number,
   id: string,
 ): Promise<boolean> {
diff --git a/packages/communication/src/teams-bot-framework-client.ts b/packages/communication/src/teams-bot-framework-client.ts
index 9428df745..0ab6aa7e2 100644
--- a/packages/communication/src/teams-bot-framework-client.ts
+++ b/packages/communication/src/teams-bot-framework-client.ts
@@ -151,6 +151,22 @@ async function readResponseText(response: Response): Promise<string> {
   }
 }
 
+/**
+ * Raised when the client-credentials token request itself fails. Carries the
+ * raw status and body so callers can turn Entra's `AADSTS…` codes into copy
+ * that names the field an operator got wrong.
+ */
+export class TeamsOAuthTokenError extends Error {
+  constructor(
+    message: string,
+    readonly status: number | null,
+    readonly responseBody: string | null,
+  ) {
+    super(message);
+    this.name = 'TeamsOAuthTokenError';
+  }
+}
+
 export class TeamsBotFrameworkClient {
   private readonly fetchImpl: FetchLike;
   private cachedToken: CachedToken | undefined;
@@ -394,6 +410,15 @@ export class TeamsBotFrameworkClient {
     };
   }
 
+  /**
+   * Runs the client-credentials token request and discards the token. Callers
+   * use it to prove the configured app id / secret / tenant actually
+   * authenticate instead of assuming that non-empty values are working ones.
+   */
+  async verifyCredentials(): Promise<void> {
+    await this.getAccessToken();
+  }
+
   private async getAccessToken(): Promise<string> {
     const now = Date.now();
 
@@ -420,23 +445,31 @@ export class TeamsBotFrameworkClient {
 
     if (!response.ok) {
       const responseBody = await readResponseText(response);
-      throw new Error(
+      throw new TeamsOAuthTokenError(
         `Teams OAuth token request failed with ${response.status}: ${responseBody}`,
+        response.status,
+        responseBody,
       );
     }
 
     const tokenResponse = (await response.json()) as unknown;
 
     if (!tokenResponse || typeof tokenResponse !== 'object') {
-      throw new Error('Teams OAuth token request returned a non-object body.');
+      throw new TeamsOAuthTokenError(
+        'Teams OAuth token request returned a non-object body.',
+        null,
+        null,
+      );
     }
 
     const tokenData = tokenResponse as Record<string, unknown>;
     const accessToken = readStringProperty(tokenData, 'access_token');
 
     if (!accessToken) {
-      throw new Error(
+      throw new TeamsOAuthTokenError(
         'Teams OAuth token response did not include access_token.',
+        null,
+        null,
       );
     }
 
diff --git a/packages/communication/src/teams-credential-validation.ts b/packages/communication/src/teams-credential-validation.ts
new file mode 100644
index 000000000..19e3695ac
--- /dev/null
+++ b/packages/communication/src/teams-credential-validation.ts
@@ -0,0 +1,248 @@
+import {
+  TeamsBotFrameworkClient,
+  TeamsOAuthTokenError,
+  type FetchLike,
+} from './teams-bot-framework-client';
+
+export type TeamsBotCredentialField = 'app_id' | 'app_password' | 'tenant_id';
+
+export type TeamsBotCredentialValidationCode =
+  | 'missing_credentials'
+  | 'invalid_app_id'
+  | 'invalid_app_password'
+  | 'expired_app_password'
+  | 'invalid_tenant_id'
+  | 'rejected'
+  | 'unreachable';
+
+export class TeamsBotCredentialValidationError extends Error {
+  constructor(
+    readonly code: TeamsBotCredentialValidationCode,
+    message: string,
+    /** Which configured value Microsoft blamed, when it is unambiguous. */
+    readonly field: TeamsBotCredentialField | null = null,
+    /**
+     * Microsoft's own explanation, stripped of trace/correlation diagnostics
+     * and, when the field is identified, trimmed to its first sentence.
+     */
+    readonly detail: string | null = null,
+  ) {
+    super(message);
+    this.name = 'TeamsBotCredentialValidationError';
+  }
+}
+
+const DEFAULT_VALIDATION_TIMEOUT_MS = 8_000;
+
+/**
+ * Entra failures specific enough to name a field for. Anything else falls back
+ * to a generic rejection that still carries Microsoft's description.
+ */
+const AADSTS_FAILURES: Record<
+  number,
+  { code: TeamsBotCredentialValidationCode; field: TeamsBotCredentialField }
+> = {
+  // Application with identifier '<app id>' was not found in the directory.
+  700016: { code: 'invalid_app_id', field: 'app_id' },
+  // Invalid client secret provided (commonly the secret id, not its value).
+  7000215: { code: 'invalid_app_password', field: 'app_password' },
+  // The provided client secret keys for app '<app id>' are expired.
+  7000222: { code: 'expired_app_password', field: 'app_password' },
+  // Tenant '<tenant>' not found.
+  90002: { code: 'invalid_tenant_id', field: 'tenant_id' },
+  // Specified tenant identifier is neither a valid DNS name nor an external domain.
+  900023: { code: 'invalid_tenant_id', field: 'tenant_id' },
+};
+
+const FIELD_LABELS: Record<TeamsBotCredentialField, string> = {
+  app_id: 'app (client) id',
+  app_password: 'client secret',
+  tenant_id: 'directory (tenant) id',
+};
+
+function parseTokenErrorBody(responseBody: string | null): {
+  error: string | null;
+  description: string | null;
+  codes: number[];
+} {
+  let error: string | null = null;
+  let description: string | null = null;
+  const codes: number[] = [];
+
+  if (!responseBody) {
+    return { error, description, codes };
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(responseBody);
+
+    if (parsed && typeof parsed === 'object') {
+      const body = parsed as Record<string, unknown>;
+
+      if (typeof body.error === 'string') {
+        error = body.error;
+      }
+
+      if (typeof body.error_description === 'string') {
+        description = body.error_description;
+      }
+
+      if (Array.isArray(body.error_codes)) {
+        for (const code of body.error_codes) {
+          if (typeof code === 'number' && Number.isFinite(code)) {
+            codes.push(code);
+          }
+        }
+      }
+    }
+  } catch {
+    // Proxies and gateways can answer with HTML; the raw body still gets
+    // surfaced as the detail below.
+  }
+
+  for (const match of (description ?? responseBody).matchAll(/AADSTS(\d+)/gu)) {
+    const code = Number.parseInt(match[1] ?? '', 10);
+
+    if (Number.isFinite(code) && !codes.includes(code)) {
+      codes.push(code);
+    }
+  }
+
+  return { error, description, codes };
+}
+
+/**
+ * Entra descriptions append trace/correlation ids and a timestamp — sometimes
+ * on later lines, sometimes inline on the same line. Keep the human-facing
+ * message and drop the diagnostics tail; server logs still carry the full
+ * response body when needed.
+ */
+function trimEntraDetail(value: string | null): string | null {
+  if (!value) {
+    return null;
+  }
+
+  const line = value.split(/\r?\n/u)[0]?.trim() ?? '';
+
+  return (
+    line
+      .replace(/\s*\b(?:Trace ID|Correlation ID|Timestamp):.*$/isu, '')
+      .trim() || null
+  );
+}
+
+/**
+ * When the field is identified, our own guidance carries the fix, so keep only
+ * Entra's core fact ("AADSTSxxxxx: Tenant 'x' not found.") and drop its
+ * generic advice sentences.
+ */
+function firstSentence(value: string): string {
+  return value.match(/^.*?[.!?](?=\s|$)/su)?.[0] ?? value;
+}
+
+function classifyTokenError(
+  error: TeamsOAuthTokenError,
+): TeamsBotCredentialValidationError {
+  const parsed = parseTokenErrorBody(error.responseBody);
+  const detail =
+    trimEntraDetail(parsed.description) ??
+    trimEntraDetail(error.responseBody) ??
+    trimEntraDetail(error.message);
+  const fieldDetail = detail === null ? null : firstSentence(detail);
+
+  for (const code of parsed.codes) {
+    const failure = AADSTS_FAILURES[code];
+
+    if (failure) {
+      return new TeamsBotCredentialValidationError(
+        failure.code,
+        `Microsoft rejected the ${FIELD_LABELS[failure.field]}.`,
+        failure.field,
+        fieldDetail,
+      );
+    }
+  }
+
+  if (parsed.error === 'invalid_client') {
+    return new TeamsBotCredentialValidationError(
+      'invalid_app_password',
+      `Microsoft rejected the ${FIELD_LABELS.app_password}.`,
+      'app_password',
+      fieldDetail,
+    );
+  }
+
+  return new TeamsBotCredentialValidationError(
+    'rejected',
+    error.status === null
+      ? 'Microsoft returned an unusable token response.'
+      : `Microsoft rejected the Teams bot credentials (HTTP ${error.status}).`,
+    null,
+    detail,
+  );
+}
+
+function isTimeout(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    (error.name === 'TimeoutError' || error.name === 'AbortError')
+  );
+}
+
+/**
+ * Proves a Teams bot credential set authenticates by running the same
+ * client-credentials flow the bot uses at runtime. Throws a
+ * {@link TeamsBotCredentialValidationError} describing which value Microsoft
+ * rejected; resolves when the credentials are usable.
+ */
+export async function validateTeamsBotCredentials(input: {
+  appId: string | null | undefined;
+  appPassword: string | null | undefined;
+  tenantId?: string | null;
+  tokenEndpoint?: string | null;
+  oauthScope?: string | null;
+  fetch?: FetchLike;
+  timeoutMs?: number;
+}): Promise<void> {
+  const appId = input.appId?.trim();
+  const appPassword = input.appPassword?.trim();
+
+  if (!appId || !appPassword) {
+    throw new TeamsBotCredentialValidationError(
+      'missing_credentials',
+      'A Teams bot app id and client secret are required.',
+    );
+  }
+
+  const timeoutMs = input.timeoutMs ?? DEFAULT_VALIDATION_TIMEOUT_MS;
+  const fetchImpl = input.fetch ?? fetch;
+  const tenantId = input.tenantId?.trim();
+  const tokenEndpoint = input.tokenEndpoint?.trim();
+  const oauthScope = input.oauthScope?.trim();
+  const client = new TeamsBotFrameworkClient({
+    appId,
+    appPassword,
+    ...(tenantId ? { tenantId } : {}),
+    ...(tokenEndpoint ? { tokenEndpoint } : {}),
+    ...(oauthScope ? { oauthScope } : {}),
+    fetch: (url, init) =>
+      fetchImpl(url, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+  });
+
+  try {
+    await client.verifyCredentials();
+  } catch (error) {
+    if (error instanceof TeamsOAuthTokenError) {
+      throw classifyTokenError(error);
+    }
+
+    throw new TeamsBotCredentialValidationError(
+      'unreachable',
+      isTimeout(error)
+        ? 'Could not reach Microsoft to verify the Teams bot credentials (timed out).'
+        : 'Could not reach Microsoft to verify the Teams bot credentials.',
+      null,
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+}
diff --git a/packages/compute-providers/src/adapters/roomote-broker.test.ts b/packages/compute-providers/src/adapters/roomote-broker.test.ts
index ce3670085..e51726469 100644
--- a/packages/compute-providers/src/adapters/roomote-broker.test.ts
+++ b/packages/compute-providers/src/adapters/roomote-broker.test.ts
@@ -395,6 +395,73 @@ describe('RoomoteBrokerClient', () => {
     });
   });
 
+  it('retries transient file upload failures', async () => {
+    let attempts = 0;
+    const { client, requests } = harness(() => {
+      attempts += 1;
+      return attempts < 3 ? jsonResponse({}, 502) : jsonResponse({});
+    });
+
+    vi.useFakeTimers();
+    try {
+      const pending = client.writeFiles({
+        instanceId: 'sb-1',
+        files: [
+          { path: '/sandbox/install.sh', content: Buffer.from('echo hi') },
+        ],
+      });
+
+      await vi.advanceTimersByTimeAsync(3_000);
+      await expect(pending).resolves.toBeUndefined();
+      expect(requests).toHaveLength(3);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does not retry deterministic file upload failures', async () => {
+    const { client, requests } = harness(() =>
+      jsonResponse({ error: 'invalid file path' }, 400),
+    );
+
+    await expect(
+      client.writeFiles({
+        instanceId: 'sb-1',
+        files: [
+          { path: '/sandbox/install.sh', content: Buffer.from('echo hi') },
+        ],
+      }),
+    ).rejects.toMatchObject({ status: 400 });
+    expect(requests).toHaveLength(1);
+  });
+
+  it('stops retrying file uploads when aborted during backoff', async () => {
+    const { client, requests } = harness(() => jsonResponse({}, 502));
+    const controller = new AbortController();
+
+    vi.useFakeTimers();
+    try {
+      const pending = client.writeFiles({
+        instanceId: 'sb-1',
+        files: [
+          { path: '/sandbox/install.sh', content: Buffer.from('echo hi') },
+        ],
+        signal: controller.signal,
+      });
+      const assertion = expect(pending).rejects.toMatchObject({
+        name: 'AbortError',
+      });
+
+      await vi.advanceTimersByTimeAsync(0);
+      controller.abort();
+
+      await assertion;
+      expect(requests).toHaveLength(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('polls snapshot operations to completion', async () => {
     let polls = 0;
     const { client } = harness((request) => {
diff --git a/packages/compute-providers/src/adapters/roomote-broker.ts b/packages/compute-providers/src/adapters/roomote-broker.ts
index 4805ad443..72ea81a8d 100644
--- a/packages/compute-providers/src/adapters/roomote-broker.ts
+++ b/packages/compute-providers/src/adapters/roomote-broker.ts
@@ -27,7 +27,7 @@ import type {
   WriteFileInput,
 } from '../types';
 import { unsupported } from '../errors';
-import { throwIfAborted, toAbortError } from '../modal/abort';
+import { sleepWithSignal, throwIfAborted, toAbortError } from '../modal/abort';
 import { RoomoteBrokerExec } from './roomote-broker-exec';
 import {
   BrokerRequestError,
@@ -40,6 +40,8 @@ const SNAPSHOT_POLL_INTERVAL_MS = 5_000;
 const SNAPSHOT_POLL_TIMEOUT_MS = 25 * 60_000;
 // Keep each request's decoded file payload under the broker's 24 MiB cap.
 const FILE_BATCH_MAX_BYTES = 16 * 1024 * 1024;
+const FILE_WRITE_MAX_ATTEMPTS = 3;
+const FILE_WRITE_RETRY_DELAY_MS = 1_000;
 
 /**
  * Broker-backed engine for the deployment-managed `roomote` provider. The
@@ -196,12 +198,34 @@ export class RoomoteBrokerClient implements ComputeProviderClient {
     }
 
     for (const files of batches) {
-      await this.requestJson({
-        method: 'PUT',
-        path: `/v1/sandboxes/${encodeURIComponent(input.instanceId)}/files`,
-        body: JSON.stringify({ files }),
-        signal: input.signal,
-      });
+      const path = `/v1/sandboxes/${encodeURIComponent(input.instanceId)}/files`;
+      const body = JSON.stringify({ files });
+
+      for (let attempt = 1; attempt <= FILE_WRITE_MAX_ATTEMPTS; attempt++) {
+        try {
+          await this.requestJson({
+            method: 'PUT',
+            path,
+            body,
+            signal: input.signal,
+          });
+          break;
+        } catch (error) {
+          if (
+            !(error instanceof BrokerRequestError) ||
+            error.status < 500 ||
+            attempt === FILE_WRITE_MAX_ATTEMPTS
+          ) {
+            throw error;
+          }
+
+          const delayMs = FILE_WRITE_RETRY_DELAY_MS * 2 ** (attempt - 1);
+          console.warn(
+            `[RoomoteBrokerClient] File upload attempt ${attempt}/${FILE_WRITE_MAX_ATTEMPTS} failed with HTTP ${error.status}; retrying in ${delayMs}ms`,
+          );
+          await sleepWithSignal(delayMs, input.signal);
+        }
+      }
     }
   }
 
diff --git a/packages/db/src/lib/__tests__/instance-report.test.ts b/packages/db/src/lib/__tests__/instance-report.test.ts
index 17d75a10b..9dcb147c3 100644
--- a/packages/db/src/lib/__tests__/instance-report.test.ts
+++ b/packages/db/src/lib/__tests__/instance-report.test.ts
@@ -20,6 +20,8 @@ import {
 } from '../../server';
 import {
   bucketPullRequestStatus,
+  collectConfiguredInferenceProviders,
+  collectConfiguredRuntimeEnvVarNames,
   collectInstanceReportStats,
   dedupeAuthoredPullRequests,
   median,
@@ -27,6 +29,27 @@ import {
 } from '../instance-report';
 
 describe('instance-report pure helpers', () => {
+  it('reports configured inference providers without reading secret values', () => {
+    expect(
+      collectConfiguredInferenceProviders({
+        persistedEnvVarNames: ['ANTHROPIC_API_KEY'],
+        runtimeEnvVarNames: ['OPENAI_API_KEY'],
+        chatgptConnected: true,
+        githubCopilotConnected: false,
+        xaiSubscriptionConnected: true,
+      }),
+    ).toEqual(['anthropic', 'chatgpt', 'openai', 'xai', 'xai-subscription']);
+  });
+
+  it('only includes runtime configuration names with non-blank values', () => {
+    expect(
+      collectConfiguredRuntimeEnvVarNames({
+        ANTHROPIC_API_KEY: 'secret-value',
+        OPENAI_API_KEY: ' ',
+      }),
+    ).toEqual(['ANTHROPIC_API_KEY']);
+  });
+
   it('buckets draft and null into open, closed and merged distinctly', () => {
     expect(bucketPullRequestStatus('draft')).toBe('open');
     expect(bucketPullRequestStatus('open')).toBe('open');
@@ -439,6 +462,7 @@ describe('collectInstanceReportStats pullRequests7d isolation', () => {
 
     // Smoke: full collector still returns the new field shape under suite load.
     const report = await collectInstanceReportStats(now);
+    expect(report.providers.computeConfigured).toContain('docker');
     expect(report.pullRequests7d).toEqual(
       expect.objectContaining({
         opened: expect.any(Number),
diff --git a/packages/db/src/lib/instance-report.ts b/packages/db/src/lib/instance-report.ts
index dfa945da4..501b39b1c 100644
--- a/packages/db/src/lib/instance-report.ts
+++ b/packages/db/src/lib/instance-report.ts
@@ -16,7 +16,9 @@ import {
 import {
   RunStatus,
   SOURCE_CONTROL_AUTOMATION_WORKFLOWS,
+  buildSetupModelStatus,
   getMcpIntegration,
+  isConfiguredEnvValue,
   type PullRequestStatus,
 } from '@roomote/types';
 
@@ -25,6 +27,7 @@ import {
   taskRuns,
   deploymentMcpEnablements,
   deploymentSettings,
+  environmentVariables,
   environments,
   mcpConnections,
   pullRequestFacts,
@@ -35,15 +38,63 @@ import {
   tasks,
   teamsInstallations,
   telegramUserMappings,
-  userApiKeys,
   users,
 } from '../schema';
+import { isChatGptSubscriptionConnected } from './chatgpt-subscription';
+import { listConfiguredComputeProviders } from './compute-runtime-config';
+import { isGitHubCopilotSubscriptionConnected } from './github-copilot-subscription';
+import { isXaiSubscriptionConnected } from './xai-subscription';
 
 const DEFAULT_DEPLOYMENT_ID = 'default';
 
 const REPORT_WINDOW_MS = 24 * 60 * 60 * 1000;
 const PR_REPORT_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
 
+/**
+ * Resolves connected model providers from configuration names only. The report
+ * never includes environment-variable values.
+ */
+export function collectConfiguredInferenceProviders(options: {
+  persistedEnvVarNames: Iterable<string>;
+  runtimeEnvVarNames: Iterable<string>;
+  chatgptConnected: boolean;
+  githubCopilotConnected: boolean;
+  xaiSubscriptionConnected: boolean;
+}): string[] {
+  const runtimeEnv = Object.fromEntries(
+    [...options.runtimeEnvVarNames].map((name) => [name, 'configured']),
+  );
+  const providerStatus = buildSetupModelStatus({
+    runtimeEnv,
+    persistedEnvVarNames: options.persistedEnvVarNames,
+    chatgptConnected: options.chatgptConnected,
+    githubCopilotConnected: options.githubCopilotConnected,
+    xaiSubscriptionConnected: options.xaiSubscriptionConnected,
+  });
+
+  return [
+    ...new Set([
+      ...providerStatus.providers
+        .filter(
+          (provider) =>
+            provider.runtimeApiKeySatisfied || provider.savedApiKeySatisfied,
+        )
+        .map((provider) => provider.id),
+      // Subscription providers also enable their API-compatible model ids.
+      ...(options.chatgptConnected ? ['openai'] : []),
+      ...(options.xaiSubscriptionConnected ? ['xai'] : []),
+    ]),
+  ].sort();
+}
+
+export function collectConfiguredRuntimeEnvVarNames(
+  environment: NodeJS.ProcessEnv,
+): string[] {
+  return Object.entries(environment)
+    .filter(([, value]) => isConfiguredEnvValue(value))
+    .map(([name]) => name);
+}
+
 /**
  * Workflows that attach to an existing PR rather than opening one. Derived from
  * the shared source-control automation vocabulary so new attach-to-PR workflows
@@ -118,6 +169,7 @@ export type InstanceReportStats = {
     comms: string[];
     sourceControl: string[];
     compute: string | null;
+    computeConfigured: string[];
     inference: string[];
   };
   mcp: {
@@ -592,7 +644,11 @@ export async function collectInstanceReportStats(
     slackActive,
     teamsActive,
     telegramMappings,
-    inferenceProviders,
+    configuredComputeProviders,
+    persistedEnvVars,
+    chatgptConnected,
+    githubCopilotConnected,
+    xaiSubscriptionConnected,
     mcpEnablements,
     mcpConnectionIds,
     pullRequests7d,
@@ -697,7 +753,11 @@ export async function collectInstanceReportStats(
       .from(teamsInstallations)
       .where(eq(teamsInstallations.isActive, true)),
     db.select({ total: count() }).from(telegramUserMappings),
-    db.selectDistinct({ provider: userApiKeys.provider }).from(userApiKeys),
+    listConfiguredComputeProviders(),
+    db.select({ name: environmentVariables.name }).from(environmentVariables),
+    isChatGptSubscriptionConnected(),
+    isGitHubCopilotSubscriptionConnected(),
+    isXaiSubscriptionConnected(),
     db
       .select({ mcpId: deploymentMcpEnablements.mcpId })
       .from(deploymentMcpEnablements)
@@ -781,7 +841,14 @@ export async function collectInstanceReportStats(
       comms,
       sourceControl: Object.keys(repositoriesByProviderRecord).sort(),
       compute: settingsRow?.runtimeComputeConfig?.defaultProvider ?? null,
-      inference: inferenceProviders.map((row) => row.provider).sort(),
+      computeConfigured: configuredComputeProviders,
+      inference: collectConfiguredInferenceProviders({
+        persistedEnvVarNames: persistedEnvVars.map((row) => row.name),
+        runtimeEnvVarNames: collectConfiguredRuntimeEnvVarNames(process.env),
+        chatgptConnected,
+        githubCopilotConnected,
+        xaiSubscriptionConnected,
+      }),
     },
     mcp: {
       enabled: mcpEnabled,
diff --git a/packages/linear/src/index.ts b/packages/linear/src/index.ts
index f9749cda9..407b22e34 100644
--- a/packages/linear/src/index.ts
+++ b/packages/linear/src/index.ts
@@ -117,3 +117,11 @@ export {
 
 // Session comment enrichment (fetches all comments including external ones)
 export { enrichSessionComments } from './enrich-session-comments';
+
+// Shared routing for both webhook intake and post-OAuth replay.
+export type {
+  LinearWorkspaceSelection,
+  ResolvedLinearTaskDestination,
+  ResolveLinearTaskDestinationResult,
+} from './resolve-task-destination';
+export { resolveLinearTaskDestination } from './resolve-task-destination';
diff --git a/packages/linear/src/resolve-task-destination.test.ts b/packages/linear/src/resolve-task-destination.test.ts
new file mode 100644
index 000000000..f7cf06c13
--- /dev/null
+++ b/packages/linear/src/resolve-task-destination.test.ts
@@ -0,0 +1,173 @@
+import { ALL_REPOSITORIES } from '@roomote/types';
+
+const {
+  buildLinearRoutingContextMock,
+  routeTaskMock,
+  deletePendingSelectionMock,
+  startElicitationFallbackMock,
+} = vi.hoisted(() => ({
+  buildLinearRoutingContextMock: vi.fn(),
+  routeTaskMock: vi.fn(),
+  deletePendingSelectionMock: vi.fn(),
+  startElicitationFallbackMock: vi.fn(),
+}));
+
+vi.mock('@roomote/cloud-agents/server', () => ({
+  buildLinearRoutingContext: buildLinearRoutingContextMock,
+  routeTask: routeTaskMock,
+}));
+
+vi.mock('./elicitation-fallback', () => ({
+  deletePendingSelection: deletePendingSelectionMock,
+  startElicitationFallback: startElicitationFallbackMock,
+  stripEmojiPrefix: (value: string) => value.replace(/^\p{Emoji}\s*/u, ''),
+}));
+
+import type { LinearClient } from './linear-client';
+import { resolveLinearTaskDestination } from './resolve-task-destination';
+import type { AgentSessionEventPayload } from './types';
+
+function makePayload(): AgentSessionEventPayload {
+  return {
+    type: 'AgentSessionEvent',
+    action: 'created',
+    organizationId: 'linear-org-1',
+    appUserId: 'linear-app-user-1',
+    webhookTimestamp: Date.now(),
+    webhookId: 'webhook-1',
+    agentSession: {
+      id: 'session-1',
+      issue: {
+        id: 'issue-1',
+        identifier: 'ENG-123',
+        title: 'Fix API retries',
+        description: 'Retry failed requests from the API',
+        url: 'https://linear.example/ENG-123',
+        project: { id: 'project-1', name: 'Reliability' },
+        team: { id: 'team-1', key: 'ENG', name: 'Engineering' },
+      },
+      comment: {
+        id: 'comment-2',
+        body: 'Please fix the retry behavior',
+        user: { id: 'linear-user-1', name: 'Daniel' },
+      },
+      previousComments: [
+        {
+          id: 'comment-1',
+          body: 'This belongs in the API service',
+          user: { id: 'linear-user-2', name: 'Matt' },
+        },
+      ],
+      createdAt: '2026-07-29T00:00:00.000Z',
+      updatedAt: '2026-07-29T00:00:00.000Z',
+    },
+  };
+}
+
+describe('resolveLinearTaskDestination', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    buildLinearRoutingContextMock.mockResolvedValue({ source: 'linear' });
+  });
+
+  it('returns the environment selected by the router', async () => {
+    routeTaskMock.mockResolvedValue({
+      status: 'routed',
+      result: {
+        workspace: { type: 'environment', id: 'env-api', name: 'API' },
+        kickoffMessage: 'I will inspect the retry path.',
+        reasoning: 'The issue explicitly refers to the API service.',
+        debug: { stages: [] },
+      },
+    });
+    const payload = makePayload();
+
+    const result = await resolveLinearTaskDestination({
+      payload,
+      agentSession: payload.agentSession,
+      userId: 'roomote-user-1',
+      linearClient: {} as LinearClient,
+      apiBaseUrl: 'https://api.roomote.example',
+    });
+
+    expect(buildLinearRoutingContextMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: 'roomote-user-1',
+        taskDescription: 'Please fix the retry behavior',
+        issueIdentifier: 'ENG-123',
+        projectName: 'Reliability',
+        teamName: 'Engineering',
+        previousComments: [
+          {
+            body: 'This belongs in the API service',
+            username: 'Matt',
+          },
+        ],
+        apiBaseUrl: 'https://api.roomote.example',
+      }),
+    );
+    expect(result).toMatchObject({
+      status: 'routed',
+      destination: {
+        workspaceSelection: { environmentId: 'env-api' },
+        workspaceDisplayName: 'API',
+        workspaceType: 'environment',
+        kickoffMessage: 'I will inspect the retry path.',
+        reasoning: 'The issue explicitly refers to the API service.',
+      },
+    });
+    expect(startElicitationFallbackMock).not.toHaveBeenCalled();
+  });
+
+  it('waits for a workspace choice when routing cannot decide', async () => {
+    routeTaskMock.mockResolvedValue({
+      status: 'fallback',
+      reason: 'No confident workspace match',
+    });
+    startElicitationFallbackMock.mockResolvedValue({
+      status: 'ok',
+      pendingSelection: { step: 'awaiting_workspace' },
+    });
+    const payload = makePayload();
+    const linearClient = {} as LinearClient;
+
+    const result = await resolveLinearTaskDestination({
+      payload,
+      agentSession: payload.agentSession,
+      userId: 'roomote-user-1',
+      linearClient,
+      apiBaseUrl: 'https://api.roomote.example',
+    });
+
+    expect(result).toEqual({ status: 'awaiting_selection' });
+    expect(startElicitationFallbackMock).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      linearOrganizationId: 'linear-org-1',
+      userId: 'roomote-user-1',
+      payload,
+      linearClient,
+    });
+  });
+
+  it('uses all repositories for an automation when routing is unavailable', async () => {
+    routeTaskMock.mockRejectedValue(new Error('router unavailable'));
+    const payload = makePayload();
+
+    const result = await resolveLinearTaskDestination({
+      payload,
+      agentSession: payload.agentSession,
+      linearClient: {} as LinearClient,
+      apiBaseUrl: 'https://api.roomote.example',
+    });
+
+    expect(result).toEqual({
+      status: 'routed',
+      destination: {
+        workspaceSelection: { repo: ALL_REPOSITORIES },
+        workspaceDisplayName: 'all repos',
+        workspaceType: 'all_repositories',
+      },
+    });
+    expect(startElicitationFallbackMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/linear/src/resolve-task-destination.ts b/packages/linear/src/resolve-task-destination.ts
new file mode 100644
index 000000000..6bdb33bb2
--- /dev/null
+++ b/packages/linear/src/resolve-task-destination.ts
@@ -0,0 +1,191 @@
+import {
+  buildLinearRoutingContext,
+  routeTask,
+  type RoutingDebugInfo,
+} from '@roomote/cloud-agents/server';
+import { ALL_REPOSITORIES } from '@roomote/types';
+
+import {
+  deletePendingSelection,
+  startElicitationFallback,
+  stripEmojiPrefix,
+} from './elicitation-fallback';
+import type { LinearClient } from './linear-client';
+import type { AgentSessionEventPayload } from './types';
+
+export type LinearWorkspaceSelection = {
+  repo?: string;
+  environmentId?: string;
+};
+
+export type ResolvedLinearTaskDestination = {
+  workspaceSelection: LinearWorkspaceSelection;
+  workspaceDisplayName: string;
+  workspaceType: 'environment' | 'all_repositories';
+  kickoffMessage?: string;
+  reasoning?: string;
+  routingDebug?: RoutingDebugInfo;
+  routingDurationMs?: number;
+  userRoute?: string;
+};
+
+export type ResolveLinearTaskDestinationResult =
+  | { status: 'routed'; destination: ResolvedLinearTaskDestination }
+  | { status: 'platform_answer'; answer: string }
+  | { status: 'awaiting_selection' }
+  | { status: 'error'; message: string };
+
+export async function resolveLinearTaskDestination({
+  payload,
+  agentSession,
+  userId,
+  linearClient,
+  apiBaseUrl,
+}: {
+  payload: AgentSessionEventPayload;
+  agentSession: AgentSessionEventPayload['agentSession'];
+  userId?: string;
+  linearClient: LinearClient;
+  apiBaseUrl: string;
+}): Promise<ResolveLinearTaskDestinationResult> {
+  try {
+    const taskDescription =
+      agentSession.comment?.body ||
+      agentSession.issue.description ||
+      agentSession.issue.title;
+    const routingContext = await buildLinearRoutingContext({
+      userId,
+      taskDescription,
+      issueIdentifier: agentSession.issue.identifier,
+      issueTitle: agentSession.issue.title,
+      issueDescription: agentSession.issue.description,
+      projectName: agentSession.issue.project?.name,
+      teamName: agentSession.issue.team?.name,
+      guidance: agentSession.guidance,
+      previousComments: agentSession.previousComments?.map((comment) => ({
+        body: comment.body,
+        username: comment.user?.name,
+      })),
+      apiBaseUrl,
+    });
+    const routingStart = Date.now();
+    const routingDecision = await routeTask(routingContext);
+    const routingDurationMs = Date.now() - routingStart;
+
+    if (routingDecision.status === 'platform_answer') {
+      return {
+        status: 'platform_answer',
+        answer: routingDecision.result.answer,
+      };
+    }
+
+    if (routingDecision.status === 'routed') {
+      const { result } = routingDecision;
+
+      if (result.workspace.type === 'environment') {
+        return {
+          status: 'routed',
+          destination: {
+            workspaceSelection: { environmentId: result.workspace.id },
+            workspaceDisplayName: result.workspace.name,
+            workspaceType: 'environment',
+            ...(result.kickoffMessage
+              ? { kickoffMessage: result.kickoffMessage }
+              : {}),
+            reasoning: result.reasoning,
+            routingDebug: result.debug,
+            routingDurationMs,
+          },
+        };
+      }
+
+      return {
+        status: 'routed',
+        destination: {
+          workspaceSelection: { repo: ALL_REPOSITORIES },
+          workspaceDisplayName: 'all repos',
+          workspaceType: 'all_repositories',
+          ...(result.kickoffMessage
+            ? { kickoffMessage: result.kickoffMessage }
+            : {}),
+          reasoning: result.reasoning,
+          routingDebug: result.debug,
+          routingDurationMs,
+        },
+      };
+    }
+
+    console.log(
+      `[LinearRouting] LLM routing fell back: ${routingDecision.reason}`,
+    );
+  } catch (error) {
+    console.error(
+      '[LinearRouting] LLM routing error, falling back to workspace selection:',
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+
+  if (!userId) {
+    return {
+      status: 'routed',
+      destination: {
+        workspaceSelection: { repo: ALL_REPOSITORIES },
+        workspaceDisplayName: 'all repos',
+        workspaceType: 'all_repositories',
+      },
+    };
+  }
+
+  const sessionId = payload.agentSession.id;
+  const fallbackResult = await startElicitationFallback({
+    sessionId,
+    linearOrganizationId: payload.organizationId,
+    userId,
+    payload,
+    linearClient,
+  });
+
+  if (fallbackResult.status === 'error') {
+    return fallbackResult;
+  }
+
+  if (fallbackResult.pendingSelection.step !== 'completed') {
+    return { status: 'awaiting_selection' };
+  }
+
+  const selectedWorkspaceId =
+    fallbackResult.pendingSelection.selectedRepo ?? ALL_REPOSITORIES;
+  const workspaceOptions = fallbackResult.pendingSelection
+    .workspaceOptions as Array<{
+    type: 'all' | 'environment';
+    id: string;
+    name: string;
+  }> | null;
+  const selectedWorkspace = workspaceOptions?.find(
+    (workspace) => workspace.id === selectedWorkspaceId,
+  );
+
+  await deletePendingSelection(sessionId);
+
+  if (selectedWorkspace?.type === 'environment') {
+    return {
+      status: 'routed',
+      destination: {
+        workspaceSelection: { environmentId: selectedWorkspace.id },
+        workspaceDisplayName: stripEmojiPrefix(selectedWorkspace.name),
+        workspaceType: 'environment',
+        userRoute: selectedWorkspace.name,
+      },
+    };
+  }
+
+  return {
+    status: 'routed',
+    destination: {
+      workspaceSelection: { repo: ALL_REPOSITORIES },
+      workspaceDisplayName: 'all repos',
+      workspaceType: 'all_repositories',
+      userRoute: selectedWorkspace?.name,
+    },
+  };
+}
diff --git a/packages/sdk/src/sandbox-router.ts b/packages/sdk/src/sandbox-router.ts
index 36cf1b91a..1279b52e6 100644
--- a/packages/sdk/src/sandbox-router.ts
+++ b/packages/sdk/src/sandbox-router.ts
@@ -119,6 +119,8 @@ export interface SandboxSetupStatusResult {
 
 export interface SandboxSendPromptInput {
   prompt?: string;
+  /** Original user text before trusted platform context is prepended. */
+  quoteText?: string;
   taskTool?: TaskToolDispatchPayload;
   images?: string[];
   source?: string;
@@ -132,6 +134,7 @@ export interface SandboxSendPromptInput {
 
 export interface SandboxSteerTaskInput {
   prompt: string;
+  quoteText: string;
   images?: string[];
   userName?: string;
 }
diff --git a/packages/sdk/src/server/lib/mcp/data.test.ts b/packages/sdk/src/server/lib/mcp/data.test.ts
index 262e5d59d..b1da46131 100644
--- a/packages/sdk/src/server/lib/mcp/data.test.ts
+++ b/packages/sdk/src/server/lib/mcp/data.test.ts
@@ -1,5 +1,7 @@
-const { findFirstMock } = vi.hoisted(() => ({
+const { findFirstMock, updateMock, updateWhereMock } = vi.hoisted(() => ({
   findFirstMock: vi.fn(),
+  updateMock: vi.fn(),
+  updateWhereMock: vi.fn(),
 }));
 
 vi.mock('@roomote/db/server', () => ({
@@ -9,6 +11,7 @@ vi.mock('@roomote/db/server', () => ({
         findFirst: findFirstMock,
       },
     },
+    update: updateMock,
   },
   mcpConnections: { id: 'mcp_connections.id' },
   eq: vi.fn((column: string, value: string) => ({ column, value })),
@@ -20,11 +23,19 @@ vi.mock('@roomote/db/encryption', () => ({
   decryptText: vi.fn((value: string) => value),
 }));
 
-import { getClientInformation } from './data';
+import { getClientInformation, getValidAccessToken } from './data';
 
 describe('getClientInformation', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    updateWhereMock.mockResolvedValue(undefined);
+    updateMock.mockReturnValue({
+      set: vi.fn(() => ({ where: updateWhereMock })),
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
   });
 
   it('returns stored oauth_client credentials when redirect URIs match', async () => {
@@ -87,4 +98,42 @@ describe('getClientInformation', () => {
       expect.objectContaining({ client_id: 'loopback-client' }),
     );
   });
+
+  it('refreshes Linear API tokens through the Linear API token endpoint', async () => {
+    findFirstMock.mockResolvedValue({
+      id: 'conn-1',
+      mcpId: 'linear',
+      accessToken: 'expired-access-token',
+      refreshToken: 'refresh-token',
+      tokenExpiresAt: new Date(0),
+      scopes: ['read', 'write'],
+      authConfig: {
+        type: 'oauth_client',
+        client_id: 'linear-client',
+        client_secret: 'enc:linear-secret',
+        registered_redirect_uri:
+          'https://customer.example/api/mcp-oauth/callback',
+        token_endpoint_auth_method: 'client_secret_post',
+      },
+    });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: vi.fn().mockResolvedValue({
+        access_token: 'fresh-access-token',
+        refresh_token: 'fresh-refresh-token',
+        expires_in: 86_400,
+        scope: 'read,write',
+      }),
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      getValidAccessToken('conn-1', 'https://mcp.linear.app/mcp'),
+    ).resolves.toBe('fresh-access-token');
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.linear.app/oauth/token',
+      expect.objectContaining({ method: 'POST' }),
+    );
+  });
 });
diff --git a/packages/sdk/src/server/lib/mcp/data.ts b/packages/sdk/src/server/lib/mcp/data.ts
index 43fda2a79..9a87fb9eb 100644
--- a/packages/sdk/src/server/lib/mcp/data.ts
+++ b/packages/sdk/src/server/lib/mcp/data.ts
@@ -19,6 +19,10 @@ import type {
   McpConnectionOAuthConfig,
   McpConnectionRole,
 } from '@roomote/types';
+import {
+  getMcpIntegrationOauthEndpoints,
+  MCP_INTEGRATIONS,
+} from '@roomote/types';
 
 // Minimum base64 length for an AES-256-GCM encrypted value (salt+iv+tag = 64 bytes → 88 base64 chars)
 const MIN_ENCRYPTED_LENGTH = 88;
@@ -192,7 +196,7 @@ export async function storeTokens(
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token || null,
       tokenExpiresAt,
-      scopes: tokens.scope ? tokens.scope.split(' ') : [],
+      scopes: tokens.scope ? tokens.scope.split(/[\s,]+/).filter(Boolean) : [],
       authStatus: 'authenticated',
       enabled: true,
       updatedAt: new Date(),
@@ -373,20 +377,6 @@ export async function getClientInformation(
     };
   }
 
-  if (
-    connection.mcpId === 'linear' &&
-    typeof process.env.R_LINEAR_CLIENT_ID === 'string' &&
-    process.env.R_LINEAR_CLIENT_ID &&
-    typeof process.env.R_LINEAR_CLIENT_SECRET === 'string' &&
-    process.env.R_LINEAR_CLIENT_SECRET
-  ) {
-    return {
-      client_id: process.env.R_LINEAR_CLIENT_ID,
-      client_secret: process.env.R_LINEAR_CLIENT_SECRET,
-      token_endpoint_auth_method: 'client_secret_post',
-    };
-  }
-
   return undefined;
 }
 
@@ -430,9 +420,14 @@ export async function getValidAccessToken(
       try {
         const clientInfo = await getClientInformation(connectionId);
         if (clientInfo) {
-          const serverMetadata = await discoverOAuthEndpoints(mcpUrl);
+          const integration = MCP_INTEGRATIONS.find(
+            (candidate) => candidate.url === mcpUrl,
+          );
+          const tokenEndpoint =
+            getMcpIntegrationOauthEndpoints(integration)?.tokenEndpoint ??
+            (await discoverOAuthEndpoints(mcpUrl)).token_endpoint;
           const newTokens = await refreshOAuthToken(
-            serverMetadata.token_endpoint,
+            tokenEndpoint,
             clientInfo,
             storedTokens.refresh_token,
           );
diff --git a/packages/sdk/src/server/lib/mcp/linear-connections.ts b/packages/sdk/src/server/lib/mcp/linear-connections.ts
index 40d988ea7..9dd992a7c 100644
--- a/packages/sdk/src/server/lib/mcp/linear-connections.ts
+++ b/packages/sdk/src/server/lib/mcp/linear-connections.ts
@@ -70,6 +70,8 @@ export async function findLinearDeploymentMcpConnection() {
       eq(mcpConnections.mcpId, 'linear'),
       eq(mcpConnections.connectionRole, LINEAR_ORG_CONNECTION_ROLE),
       isNull(mcpConnections.userId),
+      eq(mcpConnections.enabled, true),
+      eq(mcpConnections.authStatus, 'authenticated'),
     ),
   });
 }
@@ -82,6 +84,8 @@ export async function findLinearDeploymentMcpConnectionByIdentity(input: {
       eq(mcpConnections.mcpId, 'linear'),
       eq(mcpConnections.connectionRole, LINEAR_ORG_CONNECTION_ROLE),
       isNull(mcpConnections.userId),
+      eq(mcpConnections.enabled, true),
+      eq(mcpConnections.authStatus, 'authenticated'),
     ),
   });
 
diff --git a/packages/sdk/src/server/lib/task-runs/__tests__/dequeue-task-run.test.ts b/packages/sdk/src/server/lib/task-runs/__tests__/dequeue-task-run.test.ts
index a302ecac0..5f8849341 100644
--- a/packages/sdk/src/server/lib/task-runs/__tests__/dequeue-task-run.test.ts
+++ b/packages/sdk/src/server/lib/task-runs/__tests__/dequeue-task-run.test.ts
@@ -174,6 +174,41 @@ function makeSlackAppMentionRun(
   } as RunWithTask;
 }
 
+function makeLinearAgentSessionRun(
+  overrides: Partial<RunWithTask> = {},
+): RunWithTask {
+  return {
+    id: 303,
+    harness: 'opencode-server',
+    status: RunStatus.Dequeued,
+    kind: 'fresh',
+    payloadKind: TaskPayloadKind.LinearAgentSession,
+    taskId: 'task-303',
+    actingUserId: 'user-1',
+    sourceRunId: null,
+    sourceSnapshotId: null,
+    task: makeTaskRow({
+      id: 'task-303',
+      surface: 'linear',
+      linearSessionId: 'linear-session-1',
+      linearIssueId: 'linear-issue-1',
+      linearOrganizationId: 'linear-organization-1',
+    }),
+    payload: {
+      repo: 'owner/repo',
+      sessionId: 'linear-session-1',
+      organizationId: 'linear-organization-1',
+      action: 'created',
+      issueId: 'linear-issue-1',
+      issueIdentifier: 'ROO-37',
+      issueTitle: 'Change the background to red',
+      issueUrl: 'https://linear.app/acme/issue/ROO-37',
+    },
+    result: null,
+    ...overrides,
+  } as RunWithTask;
+}
+
 describe('dequeueTaskRun', () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -617,6 +652,33 @@ describe('dequeueTaskRun', () => {
     );
   });
 
+  it('keeps Linear agent session jobs runnable during dequeue', async () => {
+    const taskRun = makeLinearAgentSessionRun();
+
+    mockTxExecute.mockResolvedValue([{ id: taskRun.id }]);
+    mockTxFindFirstTaskRuns.mockResolvedValue(taskRun);
+
+    await dequeueTaskRun({ orgId: 'org-1' } as never, {
+      runId: taskRun.id,
+    });
+
+    expect(mockGeneratePrompt).toHaveBeenCalledWith(
+      expect.objectContaining({
+        taskSpec: expect.objectContaining({
+          type: TaskPayloadKind.LinearAgentSession,
+          linearSessionId: 'linear-session-1',
+          linearIssueId: 'linear-issue-1',
+          linearOrganizationId: 'linear-organization-1',
+        }),
+      }),
+    );
+    expect(mockCancelTaskRun).not.toHaveBeenCalledWith(
+      expect.anything(),
+      taskRun.id,
+      'Task run is not valid.',
+    );
+  });
+
   it('invokes the bootstrap failure callback before canceling an invalid run', async () => {
     const taskRun = makeStandardTaskRun({
       payloadKind: TaskPayloadKind.GithubPrReview,
diff --git a/packages/sdk/src/server/lib/task-runs/dequeue-task-run.ts b/packages/sdk/src/server/lib/task-runs/dequeue-task-run.ts
index 34cdee422..ac5ea054e 100644
--- a/packages/sdk/src/server/lib/task-runs/dequeue-task-run.ts
+++ b/packages/sdk/src/server/lib/task-runs/dequeue-task-run.ts
@@ -119,13 +119,19 @@ export function shouldInitializeWithoutPrompt(taskSpec: TaskSpec): boolean {
  * discriminated union re-keys on `type`, which is stored as
  * `task_runs.payload_kind`.
  */
-function buildTaskSpecCandidate(run: TaskRun): Record<string, unknown> {
+function buildTaskSpecCandidate(
+  run: TaskRun,
+  task: Task,
+): Record<string, unknown> {
   return {
     type: run.payloadKind,
     harness: run.harness,
     payload: run.payload,
     sourceSnapshotId: run.sourceSnapshotId,
     sourceRunId: run.sourceRunId,
+    linearSessionId: task.linearSessionId,
+    linearIssueId: task.linearIssueId,
+    linearOrganizationId: task.linearOrganizationId,
   };
 }
 
@@ -314,7 +320,9 @@ export const dequeueTaskRun = async (
         },
       });
 
-      const parsed = taskSpecSchema.safeParse(buildTaskSpecCandidate(taskRun));
+      const parsed = taskSpecSchema.safeParse(
+        buildTaskSpecCandidate(taskRun, task),
+      );
 
       if (!parsed.success) {
         console.error(
diff --git a/packages/telemetry/src/index.ts b/packages/telemetry/src/index.ts
index 5812d8aa2..68dd8cd1c 100644
--- a/packages/telemetry/src/index.ts
+++ b/packages/telemetry/src/index.ts
@@ -101,6 +101,7 @@ export interface PingEventsRequest {
 export interface PingInstanceReportRequest {
   instanceId: string;
   appVersion?: string;
+  cloud: boolean;
   sentAt: string;
   report: Record<string, unknown>;
 }
diff --git a/packages/telemetry/src/server/index.ts b/packages/telemetry/src/server/index.ts
index 728c85d37..d289592fd 100644
--- a/packages/telemetry/src/server/index.ts
+++ b/packages/telemetry/src/server/index.ts
@@ -437,6 +437,7 @@ export async function sendInstanceReport(
     const request: PingInstanceReportRequest = {
       instanceId: await getInstanceAnalyticsId(),
       appVersion: getAppVersion(),
+      cloud: isRoomoteCloudEnabled(Env.R_CLOUD_ENABLED),
       sentAt: new Date().toISOString(),
       report,
     };
diff --git a/packages/types/src/__tests__/mcp-oauth.test.ts b/packages/types/src/__tests__/mcp-oauth.test.ts
new file mode 100644
index 000000000..a91814016
--- /dev/null
+++ b/packages/types/src/__tests__/mcp-oauth.test.ts
@@ -0,0 +1,25 @@
+import {
+  getMcpIntegrationAuthorizationParameters,
+  getMcpIntegrationOauthScopes,
+  LINEAR_APP_OAUTH_SCOPES,
+} from '../mcp-oauth';
+
+describe('Linear OAuth scopes', () => {
+  it('makes deployment app actors assignable and mentionable', () => {
+    expect(
+      getMcpIntegrationOauthScopes('linear', 'linear_org_install'),
+    ).toEqual(LINEAR_APP_OAUTH_SCOPES);
+  });
+
+  it('keeps personal account links read-only', () => {
+    expect(getMcpIntegrationOauthScopes('linear', 'linear_user_link')).toEqual([
+      'read',
+    ]);
+  });
+
+  it('uses the OAuth user actor for personal account links', () => {
+    expect(
+      getMcpIntegrationAuthorizationParameters('linear', 'linear_user_link'),
+    ).toEqual([{ name: 'actor', value: 'user' }]);
+  });
+});
diff --git a/packages/types/src/environment-definition-tasks.ts b/packages/types/src/environment-definition-tasks.ts
index ed67f7085..b367f7143 100644
--- a/packages/types/src/environment-definition-tasks.ts
+++ b/packages/types/src/environment-definition-tasks.ts
@@ -50,6 +50,7 @@ export function normalizeRepositorySelection(
 
 export function buildCreateEnvironmentDefinitionPrompt(
   repositoryFullNames: string[],
+  options?: { emptyRepositoryFullNames?: string[] },
 ): string {
   const sortedRepositories = [...repositoryFullNames].sort((left, right) =>
     left.localeCompare(right),
@@ -59,10 +60,25 @@ export function buildCreateEnvironmentDefinitionPrompt(
     .map((repositoryFullName) => `- ${repositoryFullName}`)
     .join('\n');
 
+  const emptyRepositories = [...(options?.emptyRepositoryFullNames ?? [])]
+    .filter((fullName) => repositoryFullNames.includes(fullName))
+    .sort((left, right) => left.localeCompare(right));
+
+  // Restate the skill's empty-repository bootstrap rules inline so a worker
+  // whose packaged environment-setup skill predates the bootstrap section
+  // still degrades gracefully instead of failing on the empty checkout.
+  const emptyRepositorySection =
+    emptyRepositories.length > 0
+      ? `\n\nThese repositories are brand new and have no commits yet:
+${emptyRepositories.map((fullName) => `- ${fullName}`).join('\n')}
+
+For each empty repository, follow the skill's empty-repository bootstrap: push exactly one initial commit containing only a README.md and a minimal .gitignore to its default branch (never force-push), then define the smallest valid environment for it — typically the repository mapping alone, with no commands, services, or ports. Do not scaffold application code, frameworks, package manifests, or CI config; building the actual project is the user's next task.`
+      : '';
+
   return `$environment-setup
 
 Set up a ${PRODUCT_NAME} environment for this repository set:
-${repositoryLines}
+${repositoryLines}${emptyRepositorySection}
 
 Focus on the smallest correct environment that gets this setup target running locally.
 Use a plain, stable environment name based on the product or repository name. Do not append qualifiers like "Localhost", "Minimal", or similar unless the user explicitly asked for that distinction.
diff --git a/packages/types/src/mcp-oauth.ts b/packages/types/src/mcp-oauth.ts
index bcc277b6c..b019f8bf1 100644
--- a/packages/types/src/mcp-oauth.ts
+++ b/packages/types/src/mcp-oauth.ts
@@ -166,6 +166,13 @@ export type McpConnectionRole =
   | 'linear_org_install'
   | 'linear_user_link';
 
+export const LINEAR_APP_OAUTH_SCOPES = [
+  'read',
+  'write',
+  'app:assignable',
+  'app:mentionable',
+] as const;
+
 /**
  * MCP Server Configuration
  * This is what gets written to .roomote/mcp.json in the workspace
@@ -221,6 +228,11 @@ export type McpIntegrationOAuthClientEnv = {
   tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
 };
 
+export type McpIntegrationOAuthEndpoints = {
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+};
+
 export type McpIntegrationAuthorizationParameter = {
   name: string;
   value: string;
@@ -243,15 +255,12 @@ export type McpIntegration = {
   connectionScope?: 'user' | 'deployment';
   authorizationParameters?: McpIntegrationAuthorizationParameter[];
   oauthClientEnv?: McpIntegrationOAuthClientEnv;
+  oauthEndpoints?: McpIntegrationOAuthEndpoints;
   oauthScopes?: string[];
+  oauthScopeSeparator?: ' ' | ',';
   oauthScopeMode?: McpIntegrationOauthScopeMode;
   connectionMode?: McpIntegrationConnectionMode;
   serverMode?: McpIntegrationServerMode;
-  homepageCard?: {
-    priority: number;
-    label?: string;
-    buttonLabel?: string;
-  };
 };
 
 export const MCP_INTEGRATIONS: McpIntegration[] = [
@@ -261,11 +270,6 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
     url: 'https://mcp.notion.com/mcp',
     description: `Access your Notion pages, databases, and content within ${PRODUCT_NAME} tasks`,
     icon: 'notion',
-    homepageCard: {
-      priority: 200,
-      label: 'Connect Notion so Roomote can access your docs',
-      buttonLabel: 'Connect',
-    },
   },
   {
     id: 'jira',
@@ -291,6 +295,16 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
     connectionScope: 'deployment',
     connectionMode: 'oauth',
     serverMode: 'upstream_proxy',
+    oauthClientEnv: {
+      clientIdEnv: 'R_LINEAR_CLIENT_ID',
+      clientSecretEnv: 'R_LINEAR_CLIENT_SECRET',
+      tokenEndpointAuthMethod: 'client_secret_post',
+    },
+    oauthEndpoints: {
+      authorizationEndpoint: 'https://linear.app/oauth/authorize',
+      tokenEndpoint: 'https://api.linear.app/oauth/token',
+    },
+    oauthScopeSeparator: ',',
   },
   {
     id: 'sentry',
@@ -316,11 +330,6 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
     icon: 'posthog',
     connectionScope: 'deployment',
     oauthScopeMode: 'read-only',
-    homepageCard: {
-      priority: 90,
-      label: 'Connect PostHog to use it with your agents',
-      buttonLabel: 'Connect',
-    },
   },
   {
     id: 'neon',
@@ -362,11 +371,6 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
     connectionScope: 'deployment',
     connectionMode: 'admin_configured',
     serverMode: 'native',
-    homepageCard: {
-      priority: 80,
-      label: 'Connect Vercel so Roomote can inspect deployments and logs',
-      buttonLabel: 'Connect',
-    },
   },
   {
     id: 'grafana',
@@ -393,11 +397,6 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
     icon: 'railway',
     connectionScope: 'deployment',
     serverMode: 'upstream_proxy',
-    homepageCard: {
-      priority: 85,
-      label: 'Connect Railway so Roomote can inspect your projects',
-      buttonLabel: 'Connect',
-    },
   },
   {
     id: 'braintrust',
@@ -446,11 +445,6 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [
       'sessions:create',
       'wallet:spend',
     ],
-    homepageCard: {
-      priority: 70,
-      label: 'Connect Zero so agents can discover paid capabilities',
-      buttonLabel: 'Connect',
-    },
     instructions: [
       'Zero is available because a deployment operator connected it: the `zero` CLI and skill are installed for this task, and the Zero MCP connector handles authentication and funding.',
       '',
@@ -588,11 +582,12 @@ export function getMcpIntegrationAuthorizationParameters(
   }
 
   if (integration.id === 'linear') {
-    if (role === 'linear_user_link') {
-      return [{ name: 'actor', value: 'user' }];
-    }
-
-    return [{ name: 'actor', value: 'app' }];
+    return [
+      {
+        name: 'actor',
+        value: role === 'linear_user_link' ? 'user' : 'app',
+      },
+    ];
   }
 
   return integration.authorizationParameters ?? [];
@@ -616,12 +611,44 @@ export function getMcpIntegrationOauthScopes(
   }
 
   if (integration.id === 'linear') {
-    return role === 'linear_user_link' ? ['read'] : ['read', 'write'];
+    return role === 'linear_user_link'
+      ? ['read']
+      : [...LINEAR_APP_OAUTH_SCOPES];
   }
 
   return integration.oauthScopes;
 }
 
+export function getMcpIntegrationOauthEndpoints(
+  integrationOrId: McpIntegration | string | undefined,
+): McpIntegrationOAuthEndpoints | undefined {
+  if (!integrationOrId) {
+    return undefined;
+  }
+
+  const integration =
+    typeof integrationOrId === 'string'
+      ? getMcpIntegration(integrationOrId)
+      : integrationOrId;
+
+  return integration?.oauthEndpoints;
+}
+
+export function getMcpIntegrationOauthScopeSeparator(
+  integrationOrId: McpIntegration | string | undefined,
+): ' ' | ',' {
+  if (!integrationOrId) {
+    return ' ';
+  }
+
+  const integration =
+    typeof integrationOrId === 'string'
+      ? getMcpIntegration(integrationOrId)
+      : integrationOrId;
+
+  return integration?.oauthScopeSeparator ?? ' ';
+}
+
 export function getMcpIntegrationOauthScopeMode(
   integrationOrId: McpIntegration | string | undefined,
   _role: McpConnectionRole = 'default',
diff --git a/packages/types/src/task-runs.ts b/packages/types/src/task-runs.ts
index d210ac869..49df1eed0 100644
--- a/packages/types/src/task-runs.ts
+++ b/packages/types/src/task-runs.ts
@@ -1446,6 +1446,8 @@ export const snapshotResumeSchema = sharedTaskSchema.extend({
      * resumed worker once the harness session is ready.
      */
     resumePrompt: z.string().optional(),
+    /** Original user text for the deferred prompt's reply quote. */
+    resumeQuoteText: z.string().optional(),
     /**
      * Optional logical source label for the deferred follow-up prompt.
      */
diff --git a/scripts/release/__tests__/discord-release.test.mjs b/scripts/release/__tests__/discord-release.test.mjs
new file mode 100644
index 000000000..799471c12
--- /dev/null
+++ b/scripts/release/__tests__/discord-release.test.mjs
@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { buildDiscordReleasePayload } from '../lib.mjs';
+
+describe('Discord release announcement', () => {
+  it('creates a branded release payload', () => {
+    const payload = buildDiscordReleasePayload({
+      name: 'Roomote v0.24.1',
+      body: '### Highlights\n\n- A useful new capability',
+      url: 'https://github.com/RooCodeInc/Roomote/releases/tag/v0.24.1',
+      publishedAt: '2026-07-29T18:00:00Z',
+      tagName: 'v0.24.1',
+    });
+
+    assert.equal(payload.username, 'Roomote Releases');
+    assert.deepEqual(payload.allowed_mentions, { parse: [] });
+    assert.deepEqual(payload.embeds, [
+      {
+        title: 'Roomote v0.24.1 is now available',
+        url: 'https://github.com/RooCodeInc/Roomote/releases/tag/v0.24.1',
+        description: '### Highlights\n\n- A useful new capability',
+        color: 0xb0cd26,
+        footer: { text: 'RooCodeInc/Roomote • GitHub Release' },
+        timestamp: '2026-07-29T18:00:00Z',
+      },
+    ]);
+  });
+
+  it('truncates long notes with a release link', () => {
+    const url = 'https://github.com/RooCodeInc/Roomote/releases/tag/v0.24.1';
+    const payload = buildDiscordReleasePayload({
+      name: '',
+      body: 'x'.repeat(5000),
+      url,
+      tagName: 'v0.24.1',
+    });
+    const [embed] = payload.embeds;
+
+    assert.equal(embed.title, 'Roomote v0.24.1 is now available');
+    assert.ok(embed.description.length <= 4096);
+    assert.match(
+      embed.description,
+      new RegExp(`…\\n\\n\\[Read the full release notes\\]\\(${url}\\)$`),
+    );
+    assert.equal('timestamp' in embed, false);
+  });
+});
diff --git a/scripts/release/__tests__/workflow.test.mjs b/scripts/release/__tests__/workflow.test.mjs
index 346fca143..3f2a6f1f5 100644
--- a/scripts/release/__tests__/workflow.test.mjs
+++ b/scripts/release/__tests__/workflow.test.mjs
@@ -21,3 +21,29 @@ test('release workflow keeps promotion as the only automated PR gate', () => {
   assert.match(promoteScript, /find-version-commit\.mjs/);
   assert.match(promoteScript, /gh pr create/);
 });
+
+test('GHCR release workflow announces only newly created releases in Discord', () => {
+  const workflow = YAML.parse(
+    readFileSync(join(repoRoot, '.github/workflows/publish-ghcr.yml'), 'utf8'),
+  );
+
+  const steps = workflow.jobs['create-github-release'].steps;
+  const publishRelease = steps.find((step) => step.id === 'publish_release');
+  const announceRelease = steps.find(
+    (step) => step.name === 'Announce GitHub Release in Discord',
+  );
+
+  assert.match(publishRelease.run, /created=true/);
+  assert.match(publishRelease.run, /created=false/);
+  assert.equal(
+    announceRelease.if,
+    "${{ steps.publish_release.outputs.created == 'true' }}",
+  );
+  assert.equal(announceRelease['continue-on-error'], true);
+  assert.equal(
+    announceRelease.env.DISCORD_MAIN_WEBHOOK_URL,
+    '${{ secrets.DISCORD_MAIN_WEBHOOK_URL }}',
+  );
+  assert.match(announceRelease.run, /build-discord-release-payload\.mjs/);
+  assert.match(announceRelease.run, /--retry-all-errors/);
+});
diff --git a/scripts/release/build-discord-release-payload.mjs b/scripts/release/build-discord-release-payload.mjs
new file mode 100644
index 000000000..3115b6b8f
--- /dev/null
+++ b/scripts/release/build-discord-release-payload.mjs
@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * Convert GitHub Release JSON from stdin into a Discord webhook payload.
+ */
+
+import { buildDiscordReleasePayload } from './lib.mjs';
+
+let input = '';
+for await (const chunk of process.stdin) {
+  input += chunk;
+}
+
+if (!input.trim()) {
+  throw new Error('Expected GitHub Release JSON on stdin');
+}
+
+const release = JSON.parse(input);
+process.stdout.write(
+  `${JSON.stringify(buildDiscordReleasePayload(release))}\n`,
+);
diff --git a/scripts/release/lib.mjs b/scripts/release/lib.mjs
index 1708b4d52..c64732def 100644
--- a/scripts/release/lib.mjs
+++ b/scripts/release/lib.mjs
@@ -182,6 +182,77 @@ export function extractChangelogSection(changelogMarkdown, version) {
   return lines.slice(start, end).join('\n').trim();
 }
 
+const DISCORD_EMBED_TITLE_LIMIT = 256;
+const DISCORD_EMBED_DESCRIPTION_LIMIT = 4096;
+const ROOMOTE_BRAND_COLOR = 0xb0cd26;
+
+function truncateDiscordText(value, limit) {
+  if (value.length <= limit) return value;
+  return `${value.slice(0, limit - 1).trimEnd()}…`;
+}
+
+/**
+ * Build the Discord webhook payload for a published GitHub Release.
+ *
+ * @param {{
+ *   name?: string | null,
+ *   body?: string | null,
+ *   url: string,
+ *   publishedAt?: string | null,
+ *   tagName: string
+ * }} release
+ */
+export function buildDiscordReleasePayload(release) {
+  if (!release || typeof release !== 'object') {
+    throw new TypeError('GitHub Release data is required');
+  }
+
+  const tagName =
+    typeof release.tagName === 'string' ? release.tagName.trim() : '';
+  const url = typeof release.url === 'string' ? release.url.trim() : '';
+  if (!tagName || !url) {
+    throw new TypeError('GitHub Release tagName and url are required');
+  }
+
+  const releaseName =
+    typeof release.name === 'string' && release.name.trim()
+      ? release.name.trim()
+      : `Roomote ${tagName}`;
+  const titleSuffix = ' is now available';
+  const title = `${truncateDiscordText(
+    releaseName,
+    DISCORD_EMBED_TITLE_LIMIT - titleSuffix.length,
+  )}${titleSuffix}`;
+
+  let description =
+    typeof release.body === 'string' && release.body.trim()
+      ? release.body.trim()
+      : `Roomote ${tagName} is now available.`;
+  if (description.length > DISCORD_EMBED_DESCRIPTION_LIMIT) {
+    const readMore = `\n\n[Read the full release notes](${url})`;
+    description = `${description
+      .slice(0, DISCORD_EMBED_DESCRIPTION_LIMIT - readMore.length - 1)
+      .trimEnd()}…${readMore}`;
+  }
+
+  const embed = {
+    title,
+    url,
+    description,
+    color: ROOMOTE_BRAND_COLOR,
+    footer: { text: 'RooCodeInc/Roomote • GitHub Release' },
+  };
+  if (typeof release.publishedAt === 'string' && release.publishedAt.trim()) {
+    embed.timestamp = release.publishedAt;
+  }
+
+  return {
+    username: 'Roomote Releases',
+    allowed_mentions: { parse: [] },
+    embeds: [embed],
+  };
+}
+
 /**
  * Find the commit that introduced the given product version on a ref.
  *