@agent-native/dispatch 0.13.12 → 0.14.0

package/src/hooks/use-navigation-state.ts

@@ -62,7 +62,6 @@ export function useNavigationState(extensions?: DispatchExtensionConfig) {
       }
       return null;
     },
-    refetchInterval: 2_000,
     structuralSharing: false,
   });
 
@@ -275,7 +274,7 @@ function resolvePath(
     case "threads":
       return "/thread-debug";
     case "team":
-      return "/settings#team";
+      return "/settings#organization";
     case "extensions":
       return command?.extensionId
         ? `/extensions/${encodeURIComponent(command.extensionId)}`

package/src/routes/pages/$appId.tsx

@@ -96,11 +96,9 @@ export async function clientLoader({
 export default function WorkspaceAppCatchAllRoute() {
   const t = useT();
   const { appId } = useParams();
-  const { data: apps = [], isLoading } = useActionQuery(
-    "list-workspace-apps",
-    { includeAgentCards: false },
-    { refetchInterval: 2_000 },
-  );
+  const { data: apps = [], isLoading } = useActionQuery("list-workspace-apps", {
+    includeAgentCards: false,
+  });
   const app = useMemo(
     () =>
       (apps as WorkspaceAppSummary[]).find((item) => item.id === appId) ?? null,

package/src/routes/pages/apps.$appId.tsx

@@ -23,13 +23,9 @@ export function meta() {
 export default function WorkspaceAppRoute() {
   const t = useT();
   const { appId } = useParams();
-  const { data: apps = [], isLoading } = useActionQuery(
-    "list-workspace-apps",
-    { includeAgentCards: false },
-    {
-      refetchInterval: 2_000,
-    },
-  );
+  const { data: apps = [], isLoading } = useActionQuery("list-workspace-apps", {
+    includeAgentCards: false,
+  });
   const app = useMemo(
     () =>
       (apps as WorkspaceAppSummary[]).find((item) => item.id === appId) ?? null,

package/src/routes/pages/apps.tsx

@@ -78,9 +78,6 @@ export default function AppsRoute() {
   const { data: apps = [], isLoading: appsLoading } = useActionQuery(
     "list-workspace-apps",
     { includeAgentCards: false, includeArchived: true },
-    {
-      refetchInterval: 2_000,
-    },
   );
   const { data: workspace } = useActionQuery(
     "get-workspace-info",

package/src/routes/pages/messaging.tsx

@@ -9,7 +9,7 @@ export default function MessagingRoute() {
   return (
     <DispatchShell
       title="Messaging"
-      description="Connect Slack and Telegram directly in dispatch so inbound conversations come through one place."
+      description="Connect Slack, Microsoft Teams, Discord interactions, Telegram, WhatsApp Cloud API, or provider-webhook email so supported inbound conversations reach one Dispatch inbox."
     >
       <MessagingSetupPanel />
     </DispatchShell>

package/src/routes/pages/team.tsx

@@ -5,5 +5,5 @@ export function meta() {
 }
 
 export default function TeamRoute() {
-  return <Navigate to="/settings#team" replace />;
+  return <Navigate to="/settings#organization" replace />;
 }

package/src/server/lib/dispatch-integrations.spec.ts

@@ -4,6 +4,7 @@ const mocks = vi.hoisted(() => ({
   consumeLinkToken: vi.fn(),
   resolveLinkedOwner: vi.fn(),
   resolveOrgIdForEmail: vi.fn(),
+  resolveSecret: vi.fn(),
 }));
 
 vi.mock("./dispatch-store.js", () => ({
@@ -15,6 +16,16 @@ vi.mock("@agent-native/core/org", () => ({
   resolveOrgIdForEmail: mocks.resolveOrgIdForEmail,
 }));
 
+vi.mock("@agent-native/core/server", async () => {
+  const actual = await vi.importActual<
+    typeof import("@agent-native/core/server")
+  >("@agent-native/core/server");
+  return {
+    ...actual,
+    resolveSecret: mocks.resolveSecret,
+  };
+});
+
 import type {
   IncomingMessage,
   PlatformAdapter,
@@ -24,6 +35,7 @@ import {
   beforeDispatchProcess,
   identityKeyForIncoming,
   resolveDispatchOwner,
+  resolveDispatchExecutionContext,
 } from "./dispatch-integrations.js";
 
 const originalFetch = globalThis.fetch;
@@ -94,6 +106,9 @@ beforeEach(() => {
   mocks.resolveLinkedOwner.mockResolvedValue(null);
   mocks.consumeLinkToken.mockResolvedValue("owner@example.test");
   mocks.resolveOrgIdForEmail.mockResolvedValue(null);
+  mocks.resolveSecret.mockImplementation(
+    async (key: string) => process.env[key] ?? null,
+  );
   vi.stubGlobal(
     "fetch",
     vi.fn(async () => new Response(JSON.stringify({ ok: false }))),
@@ -130,6 +145,7 @@ describe("resolveDispatchOwner", () => {
 
   it("uses the verified Slack email for org members", async () => {
     vi.stubEnv("SLACK_BOT_TOKEN", "xoxb-token");
+    mocks.resolveSecret.mockResolvedValueOnce(null);
     mocks.resolveOrgIdForEmail.mockResolvedValueOnce("org_123");
     vi.mocked(globalThis.fetch).mockResolvedValueOnce(
       new Response(
@@ -153,6 +169,37 @@ describe("resolveDispatchOwner", () => {
     expect(incoming.platformContext.senderEmail).toBe("user@example.test");
   });
 
+  it("uses the request-scoped Slack token when no env token exists", async () => {
+    mocks.resolveSecret.mockResolvedValueOnce("configured-slack-token");
+    mocks.resolveOrgIdForEmail.mockResolvedValueOnce("org_123");
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          ok: true,
+          user: {
+            profile: { email: "member@example.test", display_name: "Member" },
+          },
+        }),
+      ),
+    );
+
+    await expect(
+      resolveDispatchOwner(
+        slackIncoming({
+          senderId: "U999",
+          platformContext: { teamId: "T999", channelId: "C1" },
+        }),
+      ),
+    ).resolves.toBe("member@example.test");
+    expect(mocks.resolveSecret).toHaveBeenCalledWith("SLACK_BOT_TOKEN");
+    expect(globalThis.fetch).toHaveBeenCalledWith(
+      "https://slack.com/api/users.info?user=U999",
+      {
+        headers: { Authorization: "Bearer configured-slack-token" },
+      },
+    );
+  });
+
   it("falls back to the configured Slack owner when the sender is not an org member", async () => {
     vi.stubEnv("SLACK_BOT_TOKEN", "xoxb-token");
     vi.stubEnv("DISPATCH_DEFAULT_OWNER_EMAIL", "default@example.test");
@@ -226,6 +273,20 @@ describe("resolveDispatchOwner", () => {
 });
 
 describe("beforeDispatchProcess", () => {
+  it("attaches capability-based guidance for structured intake", async () => {
+    const incoming = slackIncoming({
+      text: "File this review request using our intake form",
+    });
+
+    await expect(beforeDispatchProcess(incoming, noopAdapter)).resolves.toEqual(
+      { handled: false },
+    );
+    expect((incoming as any).routingHint.targetAgent).toBeUndefined();
+    expect((incoming as any).routingHint.instruction).toContain(
+      "workspace instructions/resources",
+    );
+  });
+
   it("asks unlinked Telegram users to link before using org context", async () => {
     vi.stubEnv("APP_URL", "https://dispatch.agent-native.test");
 
@@ -274,4 +335,56 @@ describe("beforeDispatchProcess", () => {
       externalUserName: "Steve",
     });
   });
+
+  it("replies with linking guidance instead of silently dropping an unlinked Slack DM", async () => {
+    vi.stubEnv("APP_URL", "https://dispatch.agent-native.test");
+    const incoming = slackIncoming({
+      triggerKind: "dm",
+      conversationType: "dm",
+      platformContext: {
+        teamId: "T123",
+        channelId: "D123",
+        channelType: "im",
+      },
+    });
+
+    const execution = await resolveDispatchExecutionContext(incoming);
+    const result = await beforeDispatchProcess(incoming, noopAdapter);
+
+    expect(execution.ownerEmail).toMatch(/@integration\.local$/);
+    expect(incoming.platformContext.identityLinkRequired).toBe(true);
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. Open https://dispatch.agent-native.test/identities, create a Slack link token, then send `/link <token>` in this DM.",
+    });
+  });
+
+  it("lets an unlinked Slack DM consume a link token before the agent gate", async () => {
+    const incoming = slackIncoming({
+      text: "/link token-123",
+      triggerKind: "dm",
+      conversationType: "dm",
+      platformContext: {
+        teamId: "T123",
+        channelId: "D123",
+        channelType: "im",
+      },
+    });
+
+    await resolveDispatchExecutionContext(incoming);
+    const result = await beforeDispatchProcess(incoming, noopAdapter);
+
+    expect(result).toEqual({
+      handled: true,
+      responseText:
+        "Linked successfully. Future slack messages will use owner@example.test's personal dispatch context.",
+    });
+    expect(mocks.consumeLinkToken).toHaveBeenCalledWith({
+      platform: "slack",
+      token: "token-123",
+      externalUserId: "T123:U123",
+      externalUserName: "U123",
+    });
+  });
 });

package/src/server/lib/dispatch-integrations.ts

@@ -1,18 +1,36 @@
 import crypto from "node:crypto";
 
+import {
+  evaluateIntegrationScopePolicy,
+  getActiveIntegrationInstallationByKey,
+  getIntegrationScope,
+  resolveIntegrationTokenBundle,
+  saveIntegrationScope,
+  slackInstallationKey,
+} from "@agent-native/core/integrations";
 import { resolveOrgIdForEmail } from "@agent-native/core/org";
-import { withConfiguredAppBasePath } from "@agent-native/core/server";
+import {
+  readDeployCredentialEnv,
+  resolveSecret,
+  withConfiguredAppBasePath,
+} from "@agent-native/core/server";
 import type {
   IncomingMessage,
+  IntegrationExecutionContext,
   PlatformAdapter,
 } from "@agent-native/core/server";
 
 import { handleRemoteCodeCommand } from "./dispatch-remote-commands.js";
+import {
+  dispatchIntegrationRoutingHint,
+  type DispatchIntegrationRoutingHint,
+} from "./dispatch-routing.js";
 import { consumeLinkToken, resolveLinkedOwner } from "./dispatch-store.js";
 
 type SlackSenderProfile = {
   email: string | null;
   name: string | null;
+  trust: "trusted" | "guest" | "external_shared" | "unknown";
 };
 
 const slackProfileCache = new Map<
@@ -104,6 +122,33 @@ function configuredDispatchIdentitiesUrl(): string | null {
   }
 }
 
+async function resolveManagedSlackInstallation(incoming: IncomingMessage) {
+  if (incoming.platform !== "slack") return null;
+  const teamId = contextString(incoming.platformContext.teamId);
+  const apiAppId = contextString(incoming.platformContext.apiAppId);
+  if (!teamId) return null;
+  try {
+    return await getActiveIntegrationInstallationByKey(
+      "slack",
+      slackInstallationKey({ teamId, apiAppId }),
+    );
+  } catch {
+    return null;
+  }
+}
+
+async function resolveManagedSlackToken(
+  incoming: IncomingMessage,
+): Promise<string | null> {
+  const installation = await resolveManagedSlackInstallation(incoming);
+  if (!installation) return null;
+  const bundle = await resolveIntegrationTokenBundle(
+    "slack",
+    installation.installationKey,
+  );
+  return bundle?.accessToken ?? null;
+}
+
 function formatTelegramLinkRequiredMessage(): string {
   const identitiesUrl = configuredDispatchIdentitiesUrl();
   const linkStep = identitiesUrl
@@ -112,14 +157,30 @@ function formatTelegramLinkRequiredMessage(): string {
   return `Telegram is connected, but this Telegram account is not linked to an Agent-Native user yet. ${linkStep} After that I can use your Builder.io org and connected apps.`;
 }
 
+function formatSlackLinkRequiredMessage(): string {
+  const identitiesUrl = configuredDispatchIdentitiesUrl();
+  const linkStep = identitiesUrl
+    ? `Open ${identitiesUrl}, create a Slack link token, then send \`/link <token>\` in this DM.`
+    : "Open Dispatch while signed in, create a Slack link token, then send `/link <token>` in this DM.";
+  return `Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. ${linkStep}`;
+}
+
 async function resolveSlackSenderProfile(
   incoming: IncomingMessage,
 ): Promise<SlackSenderProfile> {
-  if (incoming.platform !== "slack") return { email: null, name: null };
-  const token = process.env.SLACK_BOT_TOKEN;
+  if (incoming.platform !== "slack") {
+    return { email: null, name: null, trust: "unknown" };
+  }
+  const managedToken = await resolveManagedSlackToken(incoming);
+  const token =
+    managedToken ??
+    (await resolveSecret("SLACK_BOT_TOKEN")) ??
+    readDeployCredentialEnv("SLACK_BOT_TOKEN");
   const userId = contextString(incoming.senderId);
   const teamId = contextString(incoming.platformContext.teamId);
-  if (!token || !userId) return { email: null, name: null };
+  if (!token || !userId) {
+    return { email: null, name: null, trust: "unknown" };
+  }
 
   // Slack user IDs are scoped per workspace, so without a teamId we can't
   // safely cache: two installs of the bot in different workspaces could
@@ -146,6 +207,8 @@ async function resolveSlackSenderProfile(
           real_name?: string;
           display_name?: string;
         };
+        is_restricted?: boolean;
+        is_ultra_restricted?: boolean;
       };
     };
     const profile = data.ok
@@ -157,8 +220,14 @@ async function resolveSlackSenderProfile(
             data.user?.real_name?.trim() ||
             data.user?.name?.trim() ||
             null,
+          trust:
+            data.user?.is_ultra_restricted === true
+              ? ("external_shared" as const)
+              : data.user?.is_restricted === true
+                ? ("guest" as const)
+                : ("trusted" as const),
         }
-      : { email: null, name: null };
+      : { email: null, name: null, trust: "unknown" as const };
     if (cacheKey) {
       slackProfileCache.set(cacheKey, {
         profile,
@@ -167,7 +236,7 @@ async function resolveSlackSenderProfile(
     }
     return profile;
   } catch {
-    return { email: null, name: null };
+    return { email: null, name: null, trust: "unknown" };
   }
 }
 
@@ -188,6 +257,51 @@ async function resolveSlackOwnerFromVerifiedEmail(
   return orgId ? profile.email : null;
 }
 
+async function resolveSlackConversationTrust(
+  incoming: IncomingMessage,
+  actorTrust: SlackSenderProfile["trust"],
+): Promise<{
+  trust: SlackSenderProfile["trust"];
+  conversationType: "channel" | "direct_message" | "group_direct_message";
+}> {
+  if (incoming.triggerKind === "dm") {
+    return { trust: actorTrust, conversationType: "direct_message" };
+  }
+  const token = await resolveManagedSlackToken(incoming);
+  const channel = contextString(incoming.platformContext.channelId);
+  if (!token || !channel) {
+    return { trust: "unknown", conversationType: "channel" };
+  }
+  try {
+    const params = new URLSearchParams({ channel });
+    const response = await fetch(
+      `https://slack.com/api/conversations.info?${params}`,
+      { headers: { Authorization: `Bearer ${token}` } },
+    );
+    const data = (await response.json()) as {
+      ok?: boolean;
+      channel?: {
+        is_ext_shared?: boolean;
+        is_im?: boolean;
+        is_mpim?: boolean;
+      };
+    };
+    if (!data.ok) {
+      return { trust: "unknown", conversationType: "channel" };
+    }
+    return {
+      trust: data.channel?.is_ext_shared ? "external_shared" : actorTrust,
+      conversationType: data.channel?.is_im
+        ? "direct_message"
+        : data.channel?.is_mpim
+          ? "group_direct_message"
+          : "channel",
+    };
+  } catch {
+    return { trust: "unknown", conversationType: "channel" };
+  }
+}
+
 export async function resolveDispatchOwner(
   incoming: IncomingMessage,
 ): Promise<string> {
@@ -254,6 +368,111 @@ export async function resolveDispatchOwner(
   }
 }
 
+/**
+ * Resolve a personal DM user or a workspace-qualified channel service
+ * principal. Managed Slack channels never silently inherit one requester's
+ * personal credentials or memory.
+ */
+export async function resolveDispatchExecutionContext(
+  incoming: IncomingMessage,
+): Promise<IntegrationExecutionContext> {
+  if (incoming.platform !== "slack" || incoming.triggerKind === "dm") {
+    const ownerEmail = await resolveDispatchOwner(incoming);
+    if (
+      incoming.platform === "slack" &&
+      ownerEmail.endsWith("@integration.local")
+    ) {
+      // Preserve a credential-less principal long enough for beforeProcess to
+      // deliver linking guidance or consume `/link <token>`. Never run the
+      // agent under this synthetic owner.
+      incoming.platformContext.identityLinkRequired = true;
+    }
+    return {
+      ownerEmail,
+      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,
+      principalType: "user",
+    };
+  }
+
+  const installation = await resolveManagedSlackInstallation(incoming);
+  if (!installation) {
+    // Preserve the legacy manually configured app path while managed installs
+    // roll out. Its behavior remains explicit and visible in Settings.
+    const ownerEmail = await resolveDispatchOwner(incoming);
+    return {
+      ownerEmail,
+      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,
+      principalType: "user",
+    };
+  }
+
+  const teamId = contextString(incoming.platformContext.teamId);
+  const channelId = contextString(incoming.platformContext.channelId);
+  if (!teamId || !channelId) {
+    throw new Error("Slack channel identity is incomplete");
+  }
+  const profile = await resolveSlackSenderProfile(incoming);
+  const conversation = await resolveSlackConversationTrust(
+    incoming,
+    profile.trust,
+  );
+  const access = {
+    ownerEmail: installation.ownerEmail,
+    orgId: installation.orgId,
+  };
+  const key = {
+    platform: "slack",
+    tenantId: teamId,
+    conversationId: channelId,
+  };
+  let scope = await getIntegrationScope(key, access);
+  if (!scope && incoming.triggerKind === "mention") {
+    scope = await saveIntegrationScope(
+      {
+        ...key,
+        conversationType: conversation.conversationType,
+        trust: conversation.trust,
+        orgId: installation.orgId,
+        installationId: installation.id,
+      },
+      access,
+    );
+  }
+  if (!scope) throw new Error("Slack channel is not enabled for Agent Native");
+  const decision = evaluateIntegrationScopePolicy(scope, {
+    // Thread replies reached this point only after the adapter's active-task
+    // gate, so they are continuation steering rather than ambient chatter.
+    mentioned:
+      incoming.triggerKind === "mention" ||
+      incoming.triggerKind === "thread_reply",
+  });
+  if (!decision.allowed) {
+    throw new Error(`Slack channel policy denied: ${decision.reason}`);
+  }
+  incoming.integrationScopeId = scope.id;
+  if (scope.defaultModel) {
+    incoming.platformContext.defaultModel = scope.defaultModel;
+  }
+  incoming.actorTrust = {
+    memberType:
+      conversation.trust === "guest"
+        ? "guest"
+        : conversation.trust === "external_shared"
+          ? "external"
+          : conversation.trust === "trusted"
+            ? "member"
+            : "unknown",
+    verified: conversation.trust !== "unknown",
+  };
+  return {
+    ownerEmail: scope.serviceOwnerEmail,
+    orgId: scope.orgId,
+    principalType: "service",
+    installationId: installation.id,
+    scopeId: scope.id,
+  };
+}
+
 export async function beforeDispatchProcess(
   incoming: IncomingMessage,
   adapter: PlatformAdapter,
@@ -263,6 +482,20 @@ export async function beforeDispatchProcess(
     contextString(incoming.platformContext.rawText) || trimmed;
   const match = commandText.match(/^\/link(?:@\w+)?\s+([a-zA-Z0-9_-]+)$/);
   if (!match) {
+    const routedIncoming = incoming as IncomingMessage & {
+      routingHint?: DispatchIntegrationRoutingHint;
+    };
+    routedIncoming.routingHint ??= dispatchIntegrationRoutingHint(trimmed);
+    if (
+      incoming.platform === "slack" &&
+      incoming.triggerKind === "dm" &&
+      incoming.platformContext.identityLinkRequired === true
+    ) {
+      return {
+        handled: true,
+        responseText: formatSlackLinkRequiredMessage(),
+      };
+    }
     if (platformRequiresExplicitLink(incoming)) {
       const owner = await resolveLinkedOwner(
         incoming.platform,

package/src/server/lib/dispatch-routing.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+
+import { dispatchIntegrationRoutingHint } from "./dispatch-routing.js";
+
+describe("dispatchIntegrationRoutingHint", () => {
+  it.each([
+    "File a security review request for the platform team",
+    "Add this hiring ask to the intake board",
+    "Create a vendor request form with the required fields",
+    "What is currently in the editorial requests queue?",
+  ])(
+    "resolves structured intake through workspace capabilities: %s",
+    (text) => {
+      const hint = dispatchIntegrationRoutingHint(text);
+      expect(hint?.targetAgent).toBeUndefined();
+      expect(hint?.instruction).toContain("workspace instructions/resources");
+      expect(hint?.instruction).toContain("do not assume a particular app");
+    },
+  );
+
+  it.each([
+    "Design a homepage for the launch",
+    "Create a visual mockup for this settings screen",
+    "Redesign the product UI",
+  ])("routes visual output to Design: %s", (text) => {
+    expect(dispatchIntegrationRoutingHint(text)).toMatchObject({
+      targetAgent: "design",
+    });
+  });
+
+  it("lets unrelated domain questions use normal agent discovery", () => {
+    expect(
+      dispatchIntegrationRoutingHint(
+        "What were the reasons for closed-lost deals this quarter?",
+      ),
+    ).toBeUndefined();
+  });
+
+  it("leaves organization-specific shorthand to learned workspace instructions", () => {
+    expect(dispatchIntegrationRoutingHint("Apoorva queue")).toBeUndefined();
+  });
+});

package/src/server/lib/dispatch-routing.ts

@@ -0,0 +1,42 @@
+const STRUCTURED_INTAKE_PATTERNS = [
+  /\b(?:file|submit|add|log|track|triage|prioriti[sz]e)\b.{0,64}\b(?:asks?|requests?|tickets?|intake)\b/i,
+  /\b(?:asks?|requests?|tickets?|intake)\b.{0,64}\b(?:database|table|board|form|queue|priority|deadline|urgency)\b/i,
+  /\b(?:database|table|board|form|queue)\b.{0,64}\b(?:asks?|requests?|tickets?|intake|priority|deadline|urgency)\b/i,
+];
+
+const VISUAL_DESIGN_PATTERNS = [
+  /\b(?:design|redesign|create|make|generate|mock(?:\s+up)?)\b.{0,64}\b(?:visual|mockup|wireframe|screen|interface|ui|website|landing\s+page|homepage|logo|graphic|illustration)\b/i,
+  /\b(?:visual|ui|website|product|brand)\s+design\b/i,
+];
+
+export interface DispatchIntegrationRoutingHint {
+  targetAgent?: string;
+  instruction: string;
+}
+
+export function dispatchIntegrationRoutingHint(
+  text: string,
+): DispatchIntegrationRoutingHint | undefined {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  if (!normalized) return undefined;
+
+  // Route by the requested artifact type, not organization-specific names.
+  // Exact destinations, schemas, and required fields come from workspace
+  // resources such as shared LEARNINGS.md rather than this classifier.
+  if (STRUCTURED_INTAKE_PATTERNS.some((pattern) => pattern.test(normalized))) {
+    return {
+      instruction:
+        "Resolve this structured-intake request from loaded workspace instructions/resources and discovered app capabilities. Follow any workspace-defined canonical destination and form contract; do not assume a particular app, database, schema, or owner. Preserve the source thread URL, submit once, verify the saved record, and return its exact link.",
+    };
+  }
+
+  if (VISUAL_DESIGN_PATTERNS.some((pattern) => pattern.test(normalized))) {
+    return {
+      targetAgent: "design",
+      instruction:
+        "Delegate to Design because the requested output is a visual design, mockup, or interface rather than an intake record.",
+    };
+  }
+
+  return undefined;
+}