@agent-native/dispatch 0.0.0-beta-20260819155526

package/src/server/lib/curated-workspace-templates.ts

@@ -0,0 +1,187 @@
+import { listWorkspaceApps } from "./app-creation-store.js";
+
+export interface CuratedWorkspaceTemplate {
+  id: string;
+  name: string;
+  description: string;
+  icon: string;
+  color: string;
+  template: string;
+  liveUrl: string;
+  category: string;
+  setupNote: string;
+}
+
+export interface CuratedWorkspaceTemplateStatus extends CuratedWorkspaceTemplate {
+  installed: boolean;
+}
+
+/**
+ * Stable first-party template metadata for the initial app-creation catalog.
+ * `liveUrl` identifies the product URL; it is not a public-demo claim.
+ */
+export const CURATED_WORKSPACE_TEMPLATES: readonly CuratedWorkspaceTemplate[] =
+  [
+    {
+      id: "mail",
+      name: "Mail",
+      description:
+        "Agent-native email client with keyboard shortcuts and AI triage.",
+      icon: "Mail",
+      color: "#3B82F6",
+      template: "mail",
+      liveUrl: "https://mail.agent-native.com",
+      category: "communication",
+      setupNote:
+        "Connect the workspace email integration before working with live mail.",
+    },
+    {
+      id: "calendar",
+      name: "Calendar",
+      description:
+        "Manage events, synchronization, and public booking with an agent-native calendar.",
+      icon: "CalendarDays",
+      color: "#00B5FF",
+      template: "calendar",
+      liveUrl: "https://calendar.agent-native.com",
+      category: "productivity",
+      setupNote:
+        "Connect the workspace calendar integration before working with live events.",
+    },
+    {
+      id: "analytics",
+      name: "Analytics",
+      description:
+        "Connect data sources and prompt for charts, reports, and product insights.",
+      icon: "BarChart2",
+      color: "#F59E0B",
+      template: "analytics",
+      liveUrl: "https://analytics.agent-native.com",
+      category: "insights",
+      setupNote:
+        "Connect a data source or import a representative dataset before analysis.",
+    },
+    {
+      id: "slides",
+      name: "Slides",
+      description:
+        "Generate and edit React presentations with agent assistance.",
+      icon: "GalleryHorizontal",
+      color: "#EC4899",
+      template: "slides",
+      liveUrl: "https://slides.agent-native.com",
+      category: "creative",
+      setupNote:
+        "Start with a blank deck or connect the workspace presentation integration.",
+    },
+    {
+      id: "content",
+      name: "Content",
+      description:
+        "Write and organize local MDX content with agent assistance.",
+      icon: "FileText",
+      color: "#10B981",
+      template: "content",
+      liveUrl: "https://content.agent-native.com",
+      category: "content",
+      setupNote:
+        "Choose a content folder or create a first document for the private app.",
+    },
+    {
+      id: "clips",
+      name: "Clips",
+      description:
+        "Record screens, capture meeting notes, and use voice dictation with AI.",
+      icon: "ScreenShare",
+      color: "#0EA5E9",
+      template: "clips",
+      liveUrl: "https://clips.agent-native.com",
+      category: "media",
+      setupNote:
+        "Grant screen and audio permissions only when the workspace needs recording.",
+    },
+    {
+      id: "brain",
+      name: "Brain",
+      description:
+        "Search cited company knowledge from conversations, meetings, and decisions.",
+      icon: "Brain",
+      color: "#8B5CF6",
+      template: "brain",
+      liveUrl: "https://brain.agent-native.com",
+      category: "knowledge",
+      setupNote:
+        "Connect approved knowledge sources before indexing workspace information.",
+    },
+    {
+      id: "assets",
+      name: "Assets",
+      description:
+        "Upload, organize, search, and generate on-brand images and videos.",
+      icon: "Photo",
+      color: "#0F766E",
+      template: "assets",
+      liveUrl: "https://assets.agent-native.com",
+      category: "content",
+      setupNote:
+        "Upload a representative asset or connect approved asset storage to begin.",
+    },
+    {
+      id: "forms",
+      name: "Forms",
+      description: "Create, edit, and manage forms with agent assistance.",
+      icon: "ClipboardList",
+      color: "#06B6D4",
+      template: "forms",
+      liveUrl: "https://forms.agent-native.com",
+      category: "operations",
+      setupNote:
+        "Create a form and choose its submission destination before inviting respondents.",
+    },
+    {
+      id: "design",
+      name: "Design",
+      description:
+        "Create and edit visual designs with agent-assisted exploration.",
+      icon: "Brush",
+      color: "#F472B6",
+      template: "design",
+      liveUrl: "https://design.agent-native.com",
+      category: "creative",
+      setupNote:
+        "Create a private project and optionally connect approved asset sources.",
+    },
+  ] as const;
+
+const curatedTemplateById = new Map(
+  CURATED_WORKSPACE_TEMPLATES.map((template) => [template.id, template]),
+);
+
+export function getCuratedWorkspaceTemplate(
+  templateId: string,
+): CuratedWorkspaceTemplate {
+  const normalized = templateId.trim().toLowerCase();
+  const template = curatedTemplateById.get(normalized);
+  if (!template) {
+    throw new Error(`Unknown curated workspace template "${templateId}".`);
+  }
+  return template;
+}
+
+export async function listCuratedWorkspaceTemplates(): Promise<
+  CuratedWorkspaceTemplateStatus[]
+> {
+  const installedIds = new Set(
+    (
+      await listWorkspaceApps({
+        includeAgentCards: false,
+        includeArchived: true,
+      })
+    ).map((app) => app.id.trim().toLowerCase()),
+  );
+
+  return CURATED_WORKSPACE_TEMPLATES.map((template) => ({
+    ...template,
+    installed: installedIds.has(template.id),
+  }));
+}

package/src/server/lib/dispatch-integrations.spec.ts

@@ -0,0 +1,428 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  consumeLinkToken: vi.fn(),
+  resolveLinkedOwner: vi.fn(),
+  resolveOrgIdForEmail: vi.fn(),
+  resolveSecret: vi.fn(),
+  resolveSlackBotTokenForIncoming: vi.fn(),
+}));
+
+vi.mock("./dispatch-store.js", () => ({
+  consumeLinkToken: mocks.consumeLinkToken,
+  resolveLinkedOwner: mocks.resolveLinkedOwner,
+}));
+
+vi.mock("@agent-native/core/integrations", async () => {
+  const actual = await vi.importActual<
+    typeof import("@agent-native/core/integrations")
+  >("@agent-native/core/integrations");
+  return {
+    ...actual,
+    resolveSlackBotTokenForIncoming: mocks.resolveSlackBotTokenForIncoming,
+  };
+});
+
+vi.mock("@agent-native/core/org", () => ({
+  resolveOrgIdForEmail: mocks.resolveOrgIdForEmail,
+}));
+
+vi.mock("@agent-native/core/server", async () => {
+  const actual = await vi.importActual<
+    typeof import("@agent-native/core/server")
+  >("@agent-native/core/server");
+  return {
+    ...actual,
+    resolveSecret: mocks.resolveSecret,
+  };
+});
+
+import type {
+  IncomingMessage,
+  PlatformAdapter,
+} from "@agent-native/core/server";
+
+import {
+  beforeDispatchProcess,
+  identityKeyForIncoming,
+  resolveDispatchOwner,
+  resolveDispatchExecutionContext,
+} from "./dispatch-integrations.js";
+
+const originalFetch = globalThis.fetch;
+
+function slackIncoming(
+  overrides: Partial<IncomingMessage> = {},
+): IncomingMessage {
+  return {
+    platform: "slack",
+    externalThreadId: "C1:123.456",
+    text: "make a deck",
+    senderId: "U123",
+    senderName: "U123",
+    platformContext: { teamId: "T123", channelId: "C1" },
+    timestamp: 1,
+    ...overrides,
+  };
+}
+
+function emailIncoming(
+  overrides: Partial<IncomingMessage> = {},
+): IncomingMessage {
+  return {
+    platform: "email",
+    externalThreadId: "victim@member.test::<root@member.test>",
+    text: "transfer everything",
+    senderId: "victim@member.test",
+    senderName: "Victim",
+    platformContext: { from: "victim@member.test" },
+    timestamp: 1,
+    ...overrides,
+  };
+}
+
+function telegramIncoming(
+  overrides: Partial<IncomingMessage> = {},
+): IncomingMessage {
+  return {
+    platform: "telegram",
+    externalThreadId: "12345",
+    text: "ask analytics about traffic",
+    senderId: "777",
+    senderName: "Steve",
+    platformContext: { chatId: 12345, fromId: 777, rawText: "hello" },
+    timestamp: 1,
+    ...overrides,
+  };
+}
+
+const noopAdapter: PlatformAdapter = {
+  platform: "telegram",
+  label: "Telegram",
+  getRequiredEnvKeys: () => [],
+  handleVerification: async () => ({ handled: false }),
+  verifyWebhook: async () => true,
+  parseIncomingMessage: async () => null,
+  sendResponse: async () => {},
+  formatAgentResponse: (text: string) => ({ text, platformContext: {} }),
+  getStatus: async () => ({
+    platform: "telegram",
+    label: "Telegram",
+    enabled: true,
+    configured: true,
+  }),
+};
+
+beforeEach(() => {
+  mocks.resolveLinkedOwner.mockResolvedValue(null);
+  mocks.consumeLinkToken.mockResolvedValue("owner@example.test");
+  mocks.resolveOrgIdForEmail.mockResolvedValue(null);
+  mocks.resolveSlackBotTokenForIncoming.mockResolvedValue(null);
+  mocks.resolveSecret.mockImplementation(
+    async (key: string) => process.env[key] ?? null,
+  );
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => new Response(JSON.stringify({ ok: false }))),
+  );
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  vi.unstubAllGlobals();
+  globalThis.fetch = originalFetch;
+  vi.clearAllMocks();
+});
+
+describe("identityKeyForIncoming", () => {
+  it("scopes Slack identities by team", () => {
+    expect(identityKeyForIncoming(slackIncoming())).toBe("T123:U123");
+  });
+
+  it("uses Telegram sender ids as link identities", () => {
+    expect(identityKeyForIncoming(telegramIncoming())).toBe("777");
+  });
+});
+
+describe("resolveDispatchOwner", () => {
+  it("uses a linked identity before Slack email lookup", async () => {
+    mocks.resolveLinkedOwner.mockResolvedValueOnce("linked@example.test");
+    vi.stubEnv("SLACK_BOT_TOKEN", "xoxb-token");
+
+    await expect(resolveDispatchOwner(slackIncoming())).resolves.toBe(
+      "linked@example.test",
+    );
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("uses the verified Slack email for org members", async () => {
+    vi.stubEnv("SLACK_BOT_TOKEN", "xoxb-token");
+    mocks.resolveSlackBotTokenForIncoming.mockResolvedValueOnce("xoxb-token");
+    mocks.resolveSecret.mockResolvedValueOnce(null);
+    mocks.resolveOrgIdForEmail.mockResolvedValueOnce("org_123");
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          ok: true,
+          user: {
+            real_name: "Slack User",
+            profile: { email: "USER@EXAMPLE.TEST", display_name: "User" },
+          },
+        }),
+      ),
+    );
+
+    const incoming = slackIncoming();
+
+    await expect(resolveDispatchOwner(incoming)).resolves.toBe(
+      "user@example.test",
+    );
+    expect(incoming.senderEmail).toBe("user@example.test");
+    expect(incoming.senderName).toBe("User");
+    expect(incoming.platformContext.senderEmail).toBe("user@example.test");
+  });
+
+  it("uses the request-scoped Slack token when no env token exists", async () => {
+    mocks.resolveSlackBotTokenForIncoming.mockResolvedValueOnce(
+      "configured-slack-token",
+    );
+    mocks.resolveSecret.mockResolvedValueOnce("configured-slack-token");
+    mocks.resolveOrgIdForEmail.mockResolvedValueOnce("org_123");
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          ok: true,
+          user: {
+            profile: { email: "member@example.test", display_name: "Member" },
+          },
+        }),
+      ),
+    );
+
+    await expect(
+      resolveDispatchOwner(
+        slackIncoming({
+          senderId: "U999",
+          platformContext: { teamId: "T999", channelId: "C1" },
+        }),
+      ),
+    ).resolves.toBe("member@example.test");
+    expect(mocks.resolveSlackBotTokenForIncoming).toHaveBeenCalledWith(
+      expect.objectContaining({ senderId: "U999" }),
+    );
+    expect(globalThis.fetch).toHaveBeenCalledWith(
+      "https://slack.com/api/users.info?user=U999",
+      {
+        headers: { Authorization: "Bearer configured-slack-token" },
+      },
+    );
+  });
+
+  it("does not resolve a sender with a legacy token from another Slack app", async () => {
+    mocks.resolveSlackBotTokenForIncoming.mockResolvedValueOnce(null);
+
+    const incoming = slackIncoming({
+      platformContext: {
+        teamId: "T123",
+        apiAppId: "A123",
+        channelId: "C1",
+      },
+    });
+
+    const owner = await resolveDispatchOwner(incoming);
+
+    expect(owner).toMatch(/@integration\.local$/);
+    expect(globalThis.fetch).not.toHaveBeenCalledWith(
+      "https://slack.com/api/users.info?user=U123",
+      expect.anything(),
+    );
+  });
+
+  it("falls back to the configured Slack owner when the sender is not an org member", async () => {
+    vi.stubEnv("SLACK_BOT_TOKEN", "xoxb-token");
+    vi.stubEnv("DISPATCH_DEFAULT_OWNER_EMAIL", "default@example.test");
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          ok: true,
+          user: { profile: { email: "guest@example.test" } },
+        }),
+      ),
+    );
+
+    await expect(resolveDispatchOwner(slackIncoming())).resolves.toBe(
+      "default@example.test",
+    );
+  });
+
+  it("does NOT impersonate an org member from an unverified (spoofed) email From", async () => {
+    // Attacker spoofs From: victim@member.test, which IS a real org member —
+    // but the message is unverified (no DKIM/SPF pass). Must fall through to
+    // the synthetic, credential-less owner, NOT the victim's identity.
+    mocks.resolveOrgIdForEmail.mockResolvedValue("org_123");
+
+    const owner = await resolveDispatchOwner(
+      emailIncoming({ senderVerified: false }),
+    );
+
+    expect(owner).not.toBe("victim@member.test");
+    expect(owner).toMatch(/@integration\.local$/);
+  });
+
+  it("does NOT impersonate when sender is verified but not an org member", async () => {
+    mocks.resolveOrgIdForEmail.mockResolvedValue(null);
+
+    const owner = await resolveDispatchOwner(
+      emailIncoming({
+        senderId: "stranger@outside.test",
+        platformContext: { from: "stranger@outside.test" },
+        senderVerified: true,
+      }),
+    );
+
+    expect(owner).not.toBe("stranger@outside.test");
+    expect(owner).toMatch(/@integration\.local$/);
+  });
+
+  it("uses the email sender as owner when verified AND an org member", async () => {
+    mocks.resolveOrgIdForEmail.mockResolvedValue("org_123");
+
+    await expect(
+      resolveDispatchOwner(emailIncoming({ senderVerified: true })),
+    ).resolves.toBe("victim@member.test");
+  });
+
+  it("honors a linked identity for email regardless of verification", async () => {
+    mocks.resolveLinkedOwner.mockResolvedValueOnce("linked@member.test");
+
+    await expect(
+      resolveDispatchOwner(emailIncoming({ senderVerified: false })),
+    ).resolves.toBe("linked@member.test");
+    expect(mocks.resolveOrgIdForEmail).not.toHaveBeenCalled();
+  });
+
+  it("restores legacy trust-From behavior under the escape hatch", async () => {
+    vi.stubEnv("DISPATCH_TRUST_UNVERIFIED_EMAIL_SENDER", "1");
+
+    await expect(
+      resolveDispatchOwner(emailIncoming({ senderVerified: false })),
+    ).resolves.toBe("victim@member.test");
+  });
+});
+
+describe("beforeDispatchProcess", () => {
+  it("attaches capability-based guidance for structured intake", async () => {
+    const incoming = slackIncoming({
+      text: "File this review request using our intake form",
+    });
+
+    await expect(beforeDispatchProcess(incoming, noopAdapter)).resolves.toEqual(
+      { handled: false },
+    );
+    expect((incoming as any).routingHint.targetAgent).toBeUndefined();
+    expect((incoming as any).routingHint.instruction).toContain(
+      "workspace instructions/resources",
+    );
+  });
+
+  it("asks unlinked Telegram users to link before using org context", async () => {
+    vi.stubEnv("APP_URL", "https://dispatch.agent-native.test");
+
+    const result = await beforeDispatchProcess(telegramIncoming(), noopAdapter);
+
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Telegram is connected, but this Telegram account is not linked to an Agent-Native user yet. Tap https://dispatch.agent-native.test/identities, create a Telegram link token, then send `/link <token>` here. After that I can use your Builder.io org and connected apps.",
+    });
+    expect(mocks.resolveLinkedOwner).toHaveBeenCalledWith("telegram", "777", {
+      allowAnyOrgFallback: true,
+    });
+  });
+
+  it("lets linked Telegram users proceed to normal agent processing", async () => {
+    mocks.resolveLinkedOwner.mockResolvedValueOnce("steve@builder.io");
+
+    await expect(
+      beforeDispatchProcess(telegramIncoming(), noopAdapter),
+    ).resolves.toEqual({ handled: false });
+  });
+
+  it("still consumes Telegram link commands before enforcing the link gate", async () => {
+    const result = await beforeDispatchProcess(
+      telegramIncoming({
+        text: "token-123",
+        platformContext: {
+          chatId: 12345,
+          fromId: 777,
+          rawText: "/link token-123",
+        },
+      }),
+      noopAdapter,
+    );
+
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Linked successfully. Future telegram messages will use owner@example.test's personal dispatch context.",
+    });
+    expect(mocks.consumeLinkToken).toHaveBeenCalledWith({
+      platform: "telegram",
+      token: "token-123",
+      externalUserId: "777",
+      externalUserName: "Steve",
+    });
+  });
+
+  it("replies with linking guidance instead of silently dropping an unlinked Slack DM", async () => {
+    vi.stubEnv("APP_URL", "https://dispatch.agent-native.test");
+    const incoming = slackIncoming({
+      triggerKind: "dm",
+      conversationType: "dm",
+      platformContext: {
+        teamId: "T123",
+        channelId: "D123",
+        channelType: "im",
+      },
+    });
+
+    const execution = await resolveDispatchExecutionContext(incoming);
+    const result = await beforeDispatchProcess(incoming, noopAdapter);
+
+    expect(execution.ownerEmail).toMatch(/@integration\.local$/);
+    expect(incoming.platformContext.identityLinkRequired).toBe(true);
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. Open https://dispatch.agent-native.test/identities, create a Slack link token, then send `/link <token>` in this DM.",
+    });
+  });
+
+  it("lets an unlinked Slack DM consume a link token before the agent gate", async () => {
+    const incoming = slackIncoming({
+      text: "/link token-123",
+      triggerKind: "dm",
+      conversationType: "dm",
+      platformContext: {
+        teamId: "T123",
+        channelId: "D123",
+        channelType: "im",
+      },
+    });
+
+    await resolveDispatchExecutionContext(incoming);
+    const result = await beforeDispatchProcess(incoming, noopAdapter);
+
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Linked successfully. Future slack messages will use owner@example.test's personal dispatch context.",
+    });
+    expect(mocks.consumeLinkToken).toHaveBeenCalledWith({
+      platform: "slack",
+      token: "token-123",
+      externalUserId: "T123:U123",
+      externalUserName: "U123",
+    });
+  });
+});