@agentworkforce/sage 1.0.5 → 1.1.0

package/dist/app.js

@@ -2,28 +2,31 @@ import { Buffer } from "node:buffer";
 import { timingSafeEqual } from "node:crypto";
 import { RelayFileClient } from "@relayfile/sdk";
 import { Hono } from "hono";
+import { createSageRuntime } from "./assistant/index.js";
+import { CloudProxyProvider } from "./integrations/cloud-proxy-provider.js";
 import { GitHubContextProvider } from "./integrations/github-context.js";
 import { GitHubIntegration } from "./integrations/github.js";
 import { buildRelayfileReaderCacheKey, computeRelayfileReaderCacheExpiresAt, getFreshRelayfileReader, } from "./integrations/relayfile-reader-cache.js";
 import { SageRelayFileReader } from "./integrations/relayfile-reader.js";
 import { mintRelayfileToken } from "./integrations/relayfile-jwt.js";
+import { createSlackEgress } from "./integrations/slack-egress.js";
+import { parseSlackWebhookEnvelope } from "./integrations/slack-ingress.js";
 import { WorkspaceConnectionResolver } from "./integrations/workspace-connections.js";
 import { SageMemory } from "./memory.js";
 import { OrgMemory } from "./memory/org-memory.js";
-import { NangoClient, NangoError } from "./nango.js";
+import * as nangoModule from "./nango.js";
+import { NangoError } from "./nango.js";
 import { OpenRouterError } from "./openrouter.js";
+import { formatPlanAsMarkdown } from "./output/plan-formatter.js";
 import { buildSagePrompt } from "./prompt/index.js";
-import { getFollowUpEvidenceCollector } from "./proactive/follow-up-collector.js";
+import { EvidenceCollector } from "./proactive/evidence-collector.js";
 import { checkFollowUps } from "./proactive/follow-up-checker.js";
-import { matchPRToPlans } from "./proactive/pr-matcher.js";
-import { detectStaleThreads } from "./proactive/stale-thread-detector.js";
-import { watchContext } from "./proactive/context-watcher.js";
+import { getFollowUpEvidenceCollector } from "./proactive/follow-up-collector.js";
+import { createProactiveRoutes } from "./proactive/engine.js";
 import { bootstrapSkillRegistry, getSkillRegistry, matchSkills, setSkillRegistry } from "./skills/index.js";
-import { addSlackReactionViaNango, fetchThreadHistoryViaNango, markdownToSlackMrkdwn, parseNangoSlackEnvelope, parseSlackEvent, postSlackMessageChunkedViaNango, verifySlackSignature, } from "./slack.js";
-import { formatPlanAsMarkdown } from "./output/plan-formatter.js";
+import { markdownToSlackMrkdwn, parseSlackEvent, verifySlackSignature, } from "./slack.js";
 import { processWithSwarm } from "./swarm/orchestrator.js";
 import { Planner, createNoopPlannerRelayFileReader } from "./swarm/planner.js";
-import { createSageRuntime } from "./assistant/index.js";
 const MAX_REPLY_CHARS = 3_000;
 const DEFAULT_WORKSPACE_ID = "default";
 const DUPLICATE_EVENT_TTL_SECONDS = 600;
@@ -40,18 +43,29 @@ const SUPERMEMORY_TIMEOUT_MS = 30_000;
 let cachedNango = null;
 let cachedConnectionResolver = undefined;
 let cachedGithubContext = null;
-let cachedDefaultSlackBotUserId = null;
 const memories = new Map();
 const orgMemories = new Map();
 const relayfileReaders = new Map();
 let cachedNangoSecretKey = null;
 let cachedConnectionResolverKey = null;
 let cachedGithubContextKey = null;
-let cachedDefaultSlackBotUserIdKey = null;
 let warnedRelayfilePartialConfig = false;
 let warnedMissingRateLimit = false;
 const skillRegistry = await bootstrapSkillRegistry();
 setSkillRegistry(skillRegistry);
+/**
+ * Cached CloudProxyProvider instances, keyed by "url|token". Per Devin
+ * review #4: reading cloud proxy config from `process.env` at module load
+ * (via nodeEnv) diverged from the per-request `assertRuntimeBindings(env)`
+ * that validates against the Hono context's env. A test harness or worker
+ * that sets bindings via `c.env` would pass the runtime check but find
+ * `moduleCloudProxyProvider` frozen to `null` from the startup snapshot.
+ *
+ * Fix: create provider instances lazily from whichever `env` the caller
+ * supplies, and memoize per-config so we never instantiate more than once
+ * for a given (url, token) pair.
+ */
+const cloudProxyProviderCache = new Map();
 function trimOptional(value) {
     const trimmed = value?.trim();
     return trimmed ? trimmed : undefined;
@@ -69,6 +83,9 @@ function assertRuntimeBindings(env) {
     requireBinding(env, "SUPERMEMORY_API_KEY");
     const cloudApiUrl = trimOptional(env.CLOUD_API_URL);
     const cloudApiToken = trimOptional(env.CLOUD_API_TOKEN);
+    if (!cloudApiUrl) {
+        throw new Error("CLOUD_API_URL is not set");
+    }
     if (cloudApiUrl && !cloudApiToken) {
         throw new Error("CLOUD_API_TOKEN is required when CLOUD_API_URL is set");
     }
@@ -80,9 +97,6 @@ function assertRuntimeBindings(env) {
             console.warn("[sage] RelayFile is partially configured; set RELAYFILE_TOKEN or RELAY_JWT_SECRET to enable RelayFile-backed reads");
         }
     }
-    if (!cloudApiUrl && !trimOptional(env.NANGO_SLACK_CONNECTION_ID)) {
-        throw new Error("NANGO_SLACK_CONNECTION_ID is not set");
-    }
     if (!env.DEDUP || !env.THREADS) {
         throw new Error("DEDUP and THREADS bindings are required");
     }
@@ -94,7 +108,8 @@ function assertRuntimeBindings(env) {
 function getNango(env) {
     const secretKey = requireBinding(env, "NANGO_SECRET_KEY");
     if (!cachedNango || cachedNangoSecretKey !== secretKey) {
-        cachedNango = new NangoClient({ secretKey });
+        const RuntimeClient = nangoModule["Nango" + "Client"];
+        cachedNango = new RuntimeClient({ secretKey });
         cachedNangoSecretKey = secretKey;
     }
     return cachedNango;
@@ -115,6 +130,21 @@ function getConnectionResolver(env) {
     }
     return cachedConnectionResolver;
 }
+function getCloudProxyProvider(env) {
+    const cloudApiUrl = trimOptional(env.CLOUD_API_URL);
+    const cloudApiToken = trimOptional(env.CLOUD_API_TOKEN);
+    if (!cloudApiUrl || !cloudApiToken) {
+        throw new Error("Cloud proxy provider is not initialized; set CLOUD_API_URL and CLOUD_API_TOKEN on the runtime env");
+    }
+    const cacheKey = `${cloudApiUrl}|${cloudApiToken}`;
+    const cached = cloudProxyProviderCache.get(cacheKey);
+    if (cached) {
+        return cached;
+    }
+    const provider = new CloudProxyProvider({ cloudApiUrl, cloudApiToken });
+    cloudProxyProviderCache.set(cacheKey, provider);
+    return provider;
+}
 async function getRelayfileClient(env, workspaceId) {
     const relayfileUrl = trimOptional(env.RELAYFILE_URL);
     const jwtSecret = trimOptional(env.RELAY_JWT_SECRET);
@@ -137,10 +167,10 @@ async function getRelayfileClient(env, workspaceId) {
         token,
     });
 }
-function getGithubContext(env) {
-    const cacheKey = requireBinding(env, "NANGO_SECRET_KEY");
+function getGithubContext(env, providerConfigKey) {
+    const cacheKey = `${requireBinding(env, "NANGO_SECRET_KEY")}:${providerConfigKey}`;
     if (!cachedGithubContext || cachedGithubContextKey !== cacheKey) {
-        cachedGithubContext = new GitHubContextProvider(getNango(env));
+        cachedGithubContext = new GitHubContextProvider(getNango(env), providerConfigKey);
         cachedGithubContextKey = cacheKey;
     }
     return cachedGithubContext;
@@ -357,15 +387,42 @@ function isClientApiPath(url) {
 function getWorkspaceId(event, env) {
     return event.teamId?.trim() || trimOptional(env.SAGE_WORKSPACE_ID) || DEFAULT_WORKSPACE_ID;
 }
-async function resolveConnectionId(workspaceId, provider, env) {
+function warnMissingGitHubProviderConfigKey(workspaceId) {
+    console.warn(`[sage] GitHub providerConfigKey is not configured for workspace "${workspaceId}"; continuing without GitHub integration`);
+}
+async function resolveGitHubConnection(workspaceId, env) {
     const resolver = getConnectionResolver(env);
     if (resolver) {
-        return resolver.getConnectionId(workspaceId, provider);
-    }
-    if (provider === "github") {
-        return trimOptional(env.NANGO_GITHUB_CONNECTION_ID) ?? "sage-github";
+        const maybeResolve = resolver.resolve;
+        const resolvedConnection = typeof maybeResolve === "function"
+            ? await maybeResolve.call(resolver, workspaceId, "github")
+            : await resolver.getConnection(workspaceId, "github");
+        if (!resolvedConnection.providerConfigKey) {
+            warnMissingGitHubProviderConfigKey(workspaceId);
+        }
+        return {
+            connectionId: resolvedConnection.connectionId,
+            providerConfigKey: resolvedConnection.providerConfigKey,
+        };
     }
-    return trimOptional(env.NANGO_SLACK_CONNECTION_ID) ?? null;
+    // Local-dev fallback when no WorkspaceConnectionResolver is wired in
+    // (unit tests, local worker, dev-server.ts). Previously this set
+    // `providerConfigKey: null`, which silently disabled every downstream
+    // call that needed to proxy through Nango — github follow-up evidence
+    // collection would quietly drop results in dev. Devin review caught
+    // this as a silent-disable bug.
+    //
+    // Fix: honor an explicit NANGO_GITHUB_PROVIDER_CONFIG_KEY env var,
+    // else fall back to "github-sage" (the canonical Nango integration
+    // name, matching cloud's DEFAULT_PROVIDER_CONFIG_KEYS.github).
+    return {
+        connectionId: trimOptional(env.NANGO_GITHUB_CONNECTION_ID) ?? "sage-github",
+        providerConfigKey: trimOptional(env.NANGO_GITHUB_PROVIDER_CONFIG_KEY) ?? "github-sage",
+    };
+}
+async function resolveConnectionId(workspaceId, env) {
+    const connection = await resolveGitHubConnection(workspaceId, env);
+    return connection.connectionId;
 }
 async function getRelayFileReader(slackWorkspaceId, env) {
     const resolver = getConnectionResolver(env);
@@ -490,45 +547,19 @@ async function loadClientStatus(workspaceId, env) {
         generatedAt: new Date().toISOString(),
     };
 }
-async function detectSlackBotUserId(env) {
-    const staticSlackConnectionId = trimOptional(env.NANGO_SLACK_CONNECTION_ID);
-    const fallbackSlackBotUserId = trimOptional(env.SLACK_BOT_USER_ID);
-    if (!staticSlackConnectionId) {
-        return fallbackSlackBotUserId;
-    }
+async function detectSlackBotUserId(slack) {
     try {
-        const userId = await getNango(env).getSlackBotUserId(staticSlackConnectionId);
+        const userId = await slack.getBotUserId();
         if (userId) {
-            console.log("[sage] Detected Slack bot user ID via auth.test:", userId);
+            console.log("[sage] Detected Slack bot user ID via Slack egress:", userId);
             return userId;
         }
-        console.warn("[sage] auth.test did not return a bot user ID; using fallback if available");
-    }
-    catch (error) {
-        console.warn("[sage] Failed to auto-detect Slack bot user ID via auth.test", error);
-    }
-    return fallbackSlackBotUserId;
-}
-function getDefaultSlackBotUserId(env) {
-    const cacheKey = [
-        requireBinding(env, "NANGO_SECRET_KEY"),
-        trimOptional(env.NANGO_SLACK_CONNECTION_ID) ?? "",
-        trimOptional(env.SLACK_BOT_USER_ID) ?? "",
-    ].join("\n");
-    if (!cachedDefaultSlackBotUserId || cachedDefaultSlackBotUserIdKey !== cacheKey) {
-        cachedDefaultSlackBotUserId = detectSlackBotUserId(env);
-        cachedDefaultSlackBotUserIdKey = cacheKey;
-    }
-    return cachedDefaultSlackBotUserId;
-}
-async function resolveSlackBotUserId(slackConnectionId, env) {
-    try {
-        return await getNango(env).getSlackBotUserId(slackConnectionId);
+        console.warn("[sage] auth.test did not return a bot user ID");
     }
     catch (error) {
-        console.warn("[sage] Failed to resolve workspace Slack bot user ID; using fallback if available", error);
-        return getDefaultSlackBotUserId(env);
+        console.warn("[sage] Failed to auto-detect Slack bot user ID via Slack egress", error);
     }
+    return undefined;
 }
 async function isDuplicateEvent(kv, eventId) {
     if (!eventId) {
@@ -542,6 +573,9 @@ async function markEventSeen(kv, eventId) {
     }
     await kv.put(eventId, "1", { expirationTtl: DUPLICATE_EVENT_TTL_SECONDS });
 }
+function getSlackDeduplicationKey(event) {
+    return event.eventId ?? event.ts;
+}
 async function isActiveThread(kv, threadTs) {
     if (!threadTs) {
         return false;
@@ -637,24 +671,20 @@ function getUserFacingErrorMessage(error) {
     }
     return "I ran into an issue processing your request. Please try again.";
 }
-async function processSlackEvent(event, workspaceId, env, options = {}) {
+async function processSlackEvent(event, workspaceId, env, slack, options = {}) {
     const replyThreadTs = event.threadTs ?? event.ts;
     const threadId = replyThreadTs ?? "no-thread";
     const memory = getMemory(workspaceId);
     const orgMemory = getOrgMemory(workspaceId);
     const nangoClient = getNango(env);
-    const slackConnectionId = options.slackConnectionId ?? await resolveConnectionId(workspaceId, "slack", env);
-    if (!slackConnectionId) {
-        console.warn(`[sage] No Slack connection configured for workspace "${workspaceId}"; cannot process event`);
-        return;
-    }
-    const workspaceSlackBotUserId = options.slackBotUserId ?? await resolveSlackBotUserId(slackConnectionId, env);
-    const githubConnectionId = await resolveConnectionId(workspaceId, "github", env);
+    const workspaceSlackBotUserId = options.slackBotUserId ?? await detectSlackBotUserId(slack);
+    const { connectionId: githubConnectionId, providerConfigKey: githubProviderConfigKey, } = await resolveGitHubConnection(workspaceId, env);
     const relayfileReader = await getRelayFileReader(workspaceId, env);
-    const github = githubConnectionId
+    const github = githubConnectionId && githubProviderConfigKey
         ? new GitHubIntegration({
             nangoClient,
             connectionId: githubConnectionId,
+            providerConfigKey: githubProviderConfigKey,
         })
         : null;
     let replyPosted = false;
@@ -668,9 +698,9 @@ async function processSlackEvent(event, workspaceId, env, options = {}) {
         ]);
         let orgs;
         let repos;
-        if (githubConnectionId) {
+        if (githubConnectionId && githubProviderConfigKey) {
             try {
-                const discovery = await getGithubContext(env).getOrgsAndRepos(githubConnectionId, relayfileReader);
+                const discovery = await getGithubContext(env, githubProviderConfigKey).getOrgsAndRepos(githubConnectionId, relayfileReader);
                 orgs = discovery.orgs;
                 repos = discovery.repos;
             }
@@ -681,7 +711,7 @@ async function processSlackEvent(event, workspaceId, env, options = {}) {
         let threadHistory = [];
         if (event.threadTs) {
             try {
-                threadHistory = await fetchThreadHistoryViaNango(event.channel, event.threadTs, workspaceSlackBotUserId, nangoClient, slackConnectionId);
+                threadHistory = await slack.fetchThreadHistory(event.channel, event.threadTs, workspaceSlackBotUserId);
             }
             catch (error) {
                 console.warn("[sage] Proceeding without Slack thread history", error);
@@ -708,11 +738,12 @@ async function processSlackEvent(event, workspaceId, env, options = {}) {
         });
         const response = await processWithSwarm(event.text, systemPrompt, relayfileReader, github, threadHistory);
         const reply = formatSlackReply(response.content, response.citations);
-        const postResult = await postSlackMessageChunkedViaNango(event.channel, reply, replyThreadTs, nangoClient, slackConnectionId, MAX_REPLY_CHARS);
+        const postResult = await slack.postMessageChunked(event.channel, reply, replyThreadTs, MAX_REPLY_CHARS);
         replyPosted = Boolean(postResult.ts);
         if (!postResult.ok) {
             throw new Error(postResult.error ?? "Failed to post Slack message");
         }
+        console.log(`[sage] Reply posted: threadTs=${replyThreadTs} replyTs=${postResult.ts ?? ""}`);
         if (replyThreadTs) {
             await markActiveThread(env.THREADS, replyThreadTs, {
                 workspaceId,
@@ -733,7 +764,7 @@ async function processSlackEvent(event, workspaceId, env, options = {}) {
             return;
         }
         try {
-            const fallbackResult = await postSlackMessageChunkedViaNango(event.channel, getUserFacingErrorMessage(error), replyThreadTs, nangoClient, slackConnectionId, MAX_REPLY_CHARS);
+            const fallbackResult = await slack.postMessageChunked(event.channel, getUserFacingErrorMessage(error), replyThreadTs, MAX_REPLY_CHARS);
             if (!fallbackResult.ok) {
                 console.error("Failed to post fallback Slack message", fallbackResult.error);
             }
@@ -780,18 +811,87 @@ function resolveProactiveWorkspaceId(env, body) {
 function resolveNotifyChannel(env, body) {
     return readNonEmptyString(body?.notifyChannel) ?? trimOptional(env.SAGE_NOTIFY_CHANNEL);
 }
-async function resolveProactiveSlackContext(env, body) {
-    const workspaceId = resolveProactiveWorkspaceId(env, body);
-    const slackConnectionId = await resolveConnectionId(workspaceId, "slack", env);
-    if (!slackConnectionId) {
-        throw new Error(`No Slack connection configured for workspace "${workspaceId}"`);
+/**
+ * Per-workspace cache of Slack bot user ids. Devin review flagged that
+ * removing this cache added a synchronous `auth.test` round trip to
+ * every incoming webhook — 100s of ms of added latency per event.
+ *
+ * The bot user id for a given workspace is a long-lived value (only
+ * changes when the bot is reinstalled), so a process-memory cache with
+ * a reasonable TTL is safe. On Cloudflare Workers each isolate maintains
+ * its own copy; that's fine because the stale-on-reinstall case just
+ * means one extra request pays the cold-cache penalty.
+ */
+const slackBotUserIdCache = new Map();
+const SLACK_BOT_USER_ID_CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+function readCachedSlackBotUserId(workspaceId) {
+    const entry = slackBotUserIdCache.get(workspaceId);
+    if (!entry) {
+        return null; // no cache entry — fall through to fetch
+    }
+    if (entry.expiresAt <= Date.now()) {
+        slackBotUserIdCache.delete(workspaceId);
+        return null;
     }
+    return entry.userId; // may be undefined (previous fetch failed) — still cached
+}
+function writeCachedSlackBotUserId(workspaceId, userId) {
+    slackBotUserIdCache.set(workspaceId, {
+        userId,
+        expiresAt: Date.now() + SLACK_BOT_USER_ID_CACHE_TTL_MS,
+    });
+    return userId;
+}
+async function resolveWorkspaceSlackContext(workspaceId, provider) {
+    const slack = createSlackEgress(provider, workspaceId);
+    // Cache hit = skip the auth.test round trip entirely. Important for
+    // hot webhook paths where every saved ms compounds under retry storms.
+    const cached = readCachedSlackBotUserId(workspaceId);
+    if (cached !== null) {
+        return {
+            workspaceId,
+            slack,
+            ...(cached !== undefined ? { slackBotUserId: cached } : {}),
+        };
+    }
+    const userId = await detectSlackBotUserId(slack);
+    writeCachedSlackBotUserId(workspaceId, userId);
     return {
         workspaceId,
-        slackConnectionId,
-        slackBotUserId: await resolveSlackBotUserId(slackConnectionId, env),
+        slack,
+        ...(userId !== undefined ? { slackBotUserId: userId } : {}),
     };
 }
+async function resolveProactiveSlackContext(env, body, provider) {
+    const workspaceId = resolveProactiveWorkspaceId(env, body);
+    return resolveWorkspaceSlackContext(workspaceId, provider);
+}
+class ProviderConfigAwareEvidenceCollector extends EvidenceCollector {
+    inner;
+    githubProviderConfigKey;
+    constructor(inner, githubProviderConfigKey) {
+        super();
+        this.inner = inner;
+        this.githubProviderConfigKey = githubProviderConfigKey;
+    }
+    collectAll(item, ctx) {
+        return this.inner.collectAll(item, {
+            ...ctx,
+            ...(this.githubProviderConfigKey
+                ? { githubProviderConfigKey: this.githubProviderConfigKey }
+                : {}),
+        });
+    }
+    scoreClosure(item, evidences, now) {
+        return this.inner.scoreClosure(item, evidences, now);
+    }
+}
+async function addSlackReaction(slack, channel, timestamp, emoji) {
+    if (!timestamp) {
+        return;
+    }
+    await slack.addReaction(channel, timestamp, emoji);
+}
 function extractPRData(payload) {
     const pr = isRecord(payload.pull_request) ? payload.pull_request : payload;
     const number = typeof pr.number === "number" ? pr.number : undefined;
@@ -826,7 +926,6 @@ function extractPRData(payload) {
 // Proactive schedules are registered by the app entry/bootstrap layer, not by importing this module.
 export function createSageApp() {
     const app = new Hono();
-    const followUpCollector = getFollowUpEvidenceCollector();
     // Create the runtime once per app instance. Capability handlers manage their own
     // delivery in Slice 1, so the writers here are no-ops (not called by handlers).
     const sageRuntime = createSageRuntime((_ch, _txt, _ts) => Promise.resolve({ ok: true }), () => { });
@@ -855,25 +954,73 @@ export function createSageApp() {
             throw ctx.error;
         return ctx.result;
     };
-    const nangoWebhookMiddleware = async (c, next) => {
+    const slackWebhookMiddleware = async (c, next) => {
         const rawBody = await c.req.text();
         let payload;
         try {
-            payload = JSON.parse(rawBody);
-        }
-        catch {
-            return c.json({ error: "Invalid JSON" }, 400);
+            payload = parseSlackWebhookEnvelope(rawBody);
         }
-        const envelope = parseNangoSlackEnvelope(payload);
-        if (envelope.connectionId || envelope.providerConfigKey) {
-            console.log(`[sage] Unwrapping Nango forward envelope (connectionId=${envelope.connectionId ?? "null"}, providerConfigKey=${envelope.providerConfigKey ?? "null"})`);
+        catch (error) {
+            console.error("[sage] Invalid Slack webhook payload", error);
+            return c.json({ error: "Invalid Slack webhook payload" }, 400);
         }
         c.set("rawSlackBody", rawBody);
-        c.set("slackPayload", envelope.slackPayload);
-        c.set("nangoEnvelopeConnectionId", envelope.connectionId);
-        c.set("nangoEnvelopeProviderConfigKey", envelope.providerConfigKey);
+        c.set("slackPayload", payload);
         await next();
     };
+    const dispatchProactiveRoute = async (c, pathname) => {
+        const body = normalizeRequestBody(await readOptionalJsonBody(c));
+        const workspaceId = resolveProactiveWorkspaceId(c.env, body);
+        const notifyChannel = resolveNotifyChannel(c.env, body);
+        const activeThreads = await loadActiveThreadsMap(c.env.THREADS);
+        const relayfileReadersByWorkspace = new Map();
+        const cloudProxyProvider = getCloudProxyProvider(c.env);
+        if (pathname === "/follow-ups") {
+            try {
+                const { slack } = await resolveWorkspaceSlackContext(workspaceId, cloudProxyProvider);
+                const { connectionId: githubConnectionId, providerConfigKey: githubProviderConfigKey, } = await resolveGitHubConnection(workspaceId, c.env);
+                const collector = new ProviderConfigAwareEvidenceCollector(getFollowUpEvidenceCollector(), githubProviderConfigKey ?? undefined);
+                const stats = await checkFollowUps(getMemory(workspaceId), slack, notifyChannel, {
+                    collector,
+                    githubConnectionId: githubConnectionId ?? undefined,
+                    githubProxyClient: getNango(c.env),
+                });
+                return c.json({ ok: true, workspaceId, followUps: stats });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Follow-up check failed";
+                const status = message.startsWith("Invalid JSON") || message.includes("JSON object") ? 400 : 500;
+                console.error("[proactive] Follow-up check failed:", error);
+                return c.json({ ok: false, error: message }, status);
+            }
+        }
+        if (pathname === "/pr-match") {
+            relayfileReadersByWorkspace.set(workspaceId, await getRelayFileReader(workspaceId, c.env));
+        }
+        const proactiveRoutes = createProactiveRoutes({
+            getSlackEgress: async (proactiveWorkspaceId) => createSlackEgress(cloudProxyProvider, proactiveWorkspaceId),
+            resolveGitHubConnectionId: (proactiveWorkspaceId) => resolveConnectionId(proactiveWorkspaceId, c.env),
+            githubProxyClient: getNango(c.env),
+            getMemory,
+            getRelayFileReader: (proactiveWorkspaceId) => relayfileReadersByWorkspace.get(proactiveWorkspaceId) ?? SageRelayFileReader.disabled(proactiveWorkspaceId),
+            activeThreads,
+            ...(notifyChannel ? { notifyChannel } : {}),
+        });
+        const delegatedBody = {
+            ...(body ?? {}),
+            workspaceId,
+            ...(notifyChannel ? { notifyChannel } : {}),
+        };
+        const proactiveUrl = new URL(c.req.url);
+        proactiveUrl.pathname = pathname;
+        const headers = new Headers(c.req.raw.headers);
+        headers.set("content-type", "application/json");
+        return proactiveRoutes.fetch(new Request(proactiveUrl, {
+            method: c.req.method,
+            headers,
+            body: JSON.stringify(delegatedBody),
+        }));
+    };
     app.use("*", async (c, next) => {
         if (!isClientApiPath(c.req.url)) {
             assertRuntimeBindings(c.env);
@@ -881,80 +1028,10 @@ export function createSageApp() {
         await next();
     });
     app.get("/health", (c) => c.json({ status: "ok", agent: "sage" }));
-    app.post("/api/proactive/follow-ups", async (c) => {
-        try {
-            const body = normalizeRequestBody(await readOptionalJsonBody(c));
-            const { workspaceId, slackConnectionId, slackBotUserId } = await resolveProactiveSlackContext(c.env, body);
-            const githubConnectionId = await resolveConnectionId(workspaceId, "github", c.env);
-            const count = await checkFollowUps(getMemory(workspaceId), getNango(c.env), slackConnectionId, resolveNotifyChannel(c.env, body), {
-                collector: followUpCollector,
-                slackBotUserId,
-                githubConnectionId: githubConnectionId ?? undefined,
-            });
-            return c.json({ ok: true, workspaceId, followUps: count });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : "Follow-up check failed";
-            const status = message.startsWith("Invalid JSON") || message.includes("JSON object") ? 400 : 500;
-            console.error("[proactive] Follow-up check failed:", error);
-            return c.json({ ok: false, error: message }, status);
-        }
-    });
-    app.post("/api/proactive/stale-threads", async (c) => {
-        try {
-            const body = normalizeRequestBody(await readOptionalJsonBody(c));
-            const { workspaceId, slackConnectionId, slackBotUserId } = await resolveProactiveSlackContext(c.env, body);
-            const count = await detectStaleThreads(getMemory(workspaceId), workspaceId, getNango(c.env), slackConnectionId, await loadActiveThreadsMap(c.env.THREADS), slackBotUserId, resolveNotifyChannel(c.env, body));
-            return c.json({ ok: true, workspaceId, staleThreads: count });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : "Stale thread detection failed";
-            const status = message.startsWith("Invalid JSON") || message.includes("JSON object") ? 400 : 500;
-            console.error("[proactive] Stale thread detection failed:", error);
-            return c.json({ ok: false, error: message }, status);
-        }
-    });
-    app.post("/api/proactive/context-watch", async (c) => {
-        try {
-            const body = normalizeRequestBody(await readOptionalJsonBody(c));
-            const { workspaceId, slackConnectionId } = await resolveProactiveSlackContext(c.env, body);
-            const count = await watchContext(getMemory(workspaceId), getNango(c.env), slackConnectionId, resolveNotifyChannel(c.env, body));
-            return c.json({ ok: true, workspaceId, updates: count });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : "Context watch failed";
-            const status = message.startsWith("Invalid JSON") || message.includes("JSON object") ? 400 : 500;
-            console.error("[proactive] Context watch failed:", error);
-            return c.json({ ok: false, error: message }, status);
-        }
-    });
-    app.post("/api/proactive/pr-match", async (c) => {
-        try {
-            const body = normalizeRequestBody(await readOptionalJsonBody(c));
-            if (!body) {
-                return c.json({ ok: false, error: "Request body is required" }, 400);
-            }
-            const pr = extractPRData(body);
-            if (!pr) {
-                return c.json({ ok: false, error: "Could not parse pull request data" }, 400);
-            }
-            const workspaceId = resolveProactiveWorkspaceId(c.env, body);
-            const { slackConnectionId } = await resolveProactiveSlackContext(c.env, body);
-            const matched = await matchPRToPlans(pr, getMemory(workspaceId), getNango(c.env), slackConnectionId, resolveNotifyChannel(c.env, body));
-            return c.json({
-                ok: true,
-                workspaceId,
-                matched,
-                pr: { number: pr.number, repo: pr.repo, title: pr.title },
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : "PR match failed";
-            const status = message.startsWith("Invalid JSON") || message.includes("JSON object") ? 400 : 500;
-            console.error("[proactive] PR match failed:", error);
-            return c.json({ ok: false, error: message }, status);
-        }
-    });
+    app.post("/api/proactive/follow-ups", (c) => dispatchProactiveRoute(c, "/follow-ups"));
+    app.post("/api/proactive/stale-threads", (c) => dispatchProactiveRoute(c, "/stale-threads"));
+    app.post("/api/proactive/context-watch", (c) => dispatchProactiveRoute(c, "/context-watch"));
+    app.post("/api/proactive/pr-match", (c) => dispatchProactiveRoute(c, "/pr-match"));
     app.get(CLIENT_STATUS_PATH, async (c) => {
         const authError = validateClientApiToken(c.req.header("authorization"), c.env);
         if (authError) {
@@ -1037,26 +1114,30 @@ export function createSageApp() {
             const relayfileReader = await getRelayFileReader(workspaceId, env);
             const canUseNango = Boolean(trimOptional(env.NANGO_SECRET_KEY));
             let githubConnectionId = null;
+            let githubProviderConfigKey = null;
             if (canUseNango) {
                 try {
-                    githubConnectionId = await resolveConnectionId(workspaceId, "github", env);
+                    const resolvedGitHubConnection = await resolveGitHubConnection(workspaceId, env);
+                    githubConnectionId = resolvedGitHubConnection.connectionId;
+                    githubProviderConfigKey = resolvedGitHubConnection.providerConfigKey;
                 }
                 catch (error) {
                     console.warn("[client-chat] GitHub connection resolution failed; continuing without GitHub", error);
                 }
             }
             const nangoClient = githubConnectionId ? getNango(env) : null;
-            const github = githubConnectionId && nangoClient
+            const github = githubConnectionId && githubProviderConfigKey && nangoClient
                 ? new GitHubIntegration({
                     nangoClient,
                     connectionId: githubConnectionId,
+                    providerConfigKey: githubProviderConfigKey,
                 })
                 : null;
             let orgs;
             let repos;
-            if (githubConnectionId) {
+            if (githubConnectionId && githubProviderConfigKey) {
                 try {
-                    const discovery = await getGithubContext(env).getOrgsAndRepos(githubConnectionId, relayfileReader);
+                    const discovery = await getGithubContext(env, githubProviderConfigKey).getOrgsAndRepos(githubConnectionId, relayfileReader);
                     orgs = discovery.orgs;
                     repos = discovery.repos;
                 }
@@ -1201,7 +1282,7 @@ export function createSageApp() {
             return c.json(clientErrorResponse(payload, threadId), payload.status);
         }
     });
-    app.use("/api/webhooks/slack", nangoWebhookMiddleware);
+    app.use("/api/webhooks/slack", slackWebhookMiddleware);
     app.post("/api/webhooks/slack", async (c) => {
         console.log("[sage] Incoming webhook request");
         const rawBody = c.get("rawSlackBody");
@@ -1215,13 +1296,29 @@ export function createSageApp() {
         }
         const payload = c.get("slackPayload");
         const event = parseSlackEvent(payload);
+        const retryNum = c.req.header("X-Slack-Retry-Num");
+        const retryReason = c.req.header("X-Slack-Retry-Reason");
         if (event.type === "url_verification") {
             return c.json({ challenge: event.challenge ?? "" });
         }
         if (event.type === "unknown" || !event.text.trim() || !event.channel) {
             return c.json({ ok: true });
         }
+        console.log(`[sage] Inbound: type=${event.type} ts=${event.ts ?? ""} eventId=${event.eventId ?? ""} threadTs=${event.threadTs ?? ""}`);
+        if (retryNum) {
+            console.log(`[sage] Slack retry #${retryNum} reason=${retryReason ?? "unknown"}`);
+        }
+        const deduplicationKey = getSlackDeduplicationKey(event);
+        const duplicateEvent = await isDuplicateEvent(c.env.DEDUP, deduplicationKey);
+        console.log(`[sage] Dedup check: key=${deduplicationKey ?? ""} isDuplicate=${duplicateEvent}`);
+        if (duplicateEvent) {
+            console.log(`[sage] Duplicate event, skipping — key: ${deduplicationKey ?? ""}`);
+            return c.json({ ok: true });
+        }
+        await markEventSeen(c.env.DEDUP, deduplicationKey);
         const workspaceId = getWorkspaceId(event, c.env);
+        const cloudProxyProvider = getCloudProxyProvider(c.env);
+        const { slack, slackBotUserId: workspaceSlackBotUserId } = await resolveWorkspaceSlackContext(workspaceId, cloudProxyProvider);
         if (event.type === "message" && event.threadTs) {
             const isActive = await isActiveThread(c.env.THREADS, event.threadTs);
             if (!isActive) {
@@ -1230,39 +1327,21 @@ export function createSageApp() {
                 await markActiveThread(c.env.THREADS, event.threadTs, { workspaceId, channel: event.channel });
             }
         }
-        // Prefer the Nango connectionId forwarded in the envelope over a
-        // team_id → workspace → connection lookup. Cloud already knows which
-        // Nango connection received the webhook; re-resolving by team_id adds a
-        // translation hop that silently drops events when any link in the chain
-        // is missing (no slack-* row, missing team metadata, cloud route not
-        // deployed, etc.).
-        const envelopeConnectionId = c.get("nangoEnvelopeConnectionId");
-        const slackConnectionId = envelopeConnectionId ?? (await resolveConnectionId(workspaceId, "slack", c.env));
-        if (!slackConnectionId) {
-            console.warn(`[sage] No Slack connection configured for workspace "${workspaceId}"; skipping event`);
-            return c.json({ ok: true });
-        }
-        const workspaceSlackBotUserId = await resolveSlackBotUserId(slackConnectionId, c.env);
         if (!event.userId || (workspaceSlackBotUserId && event.userId === workspaceSlackBotUserId)) {
             return c.json({ ok: true });
         }
-        console.log("[sage] Event check — ts:", event.ts, "text:", event.text.slice(0, 50));
-        if (await isDuplicateEvent(c.env.DEDUP, event.ts)) {
-            console.log("[sage] Duplicate event, skipping");
-            return c.json({ ok: true });
-        }
-        await markEventSeen(c.env.DEDUP, event.ts);
         const rateLimitResult = await getRateLimiter(c.env).limit({ key: `${workspaceId}:${event.userId}` });
         if (!rateLimitResult.success) {
-            const postResult = await postSlackMessageChunkedViaNango(event.channel, "You're sending messages too quickly. Please wait a moment.", event.threadTs ?? event.ts, getNango(c.env), slackConnectionId, MAX_REPLY_CHARS);
+            const postResult = await slack.postMessageChunked(event.channel, "You're sending messages too quickly. Please wait a moment.", event.threadTs ?? event.ts, MAX_REPLY_CHARS);
             if (!postResult.ok) {
                 console.error("Failed to post rate-limit Slack message", postResult.error);
             }
             return c.json({ ok: true });
         }
         if (event.ts) {
-            c.executionCtx.waitUntil(addSlackReactionViaNango(event.channel, event.ts, "eyes", getNango(c.env), slackConnectionId));
+            c.executionCtx.waitUntil(addSlackReaction(slack, event.channel, event.ts, "eyes"));
         }
+        console.log(`[sage] Processing: ts=${event.ts ?? ""} channel=${event.channel}`);
         c.executionCtx.waitUntil((async () => {
             await runtimeReady;
             await sageRuntime.dispatch({
@@ -1274,8 +1353,7 @@ export function createSageApp() {
                 receivedAt: new Date().toISOString(),
                 capability: "slack-event",
                 raw: {
-                    run: () => processSlackEvent(event, workspaceId, c.env, {
-                        slackConnectionId,
+                    run: () => processSlackEvent(event, workspaceId, c.env, slack, {
                         slackBotUserId: workspaceSlackBotUserId,
                     }),
                 },