@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/slack-provisioning/install-cli.js

@@ -0,0 +1,323 @@
+/**
+ * Official Slack CLI installer (Mac/Linux install.sh only).
+ *
+ * @fileoverview Do not apt/snap install the Slack desktop app
+ */
+
+'use strict';
+
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+const { promisify } = require('util');
+const { spawn } = require('child_process');
+const execFileDefault = promisify(require('child_process').execFile);
+const chalk = require('chalk');
+const ora = require('ora');
+const logger = require('../../utils/logger');
+const { formatSuccessLine } = require('../../utils/cli-layout-chalk');
+const { SLACK_CLI_INSTALL_SCRIPT_URL } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+const { withGoTrustedCa } = require('./go-ca-bundle');
+const { withCurlOnPath } = require('./with-curl-on-path');
+
+const MAX_SCRIPT_BYTES = 512 * 1024;
+const MAX_REDIRECTS = 5;
+const SLACK_CLI_FALLBACK_HOME = 'aifabrix-slack-home';
+
+/**
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function isRootHomeDir(dir) {
+  const resolved = path.resolve(dir);
+  return resolved === path.parse(resolved).root;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function usableHomeDir(value) {
+  const trimmed = typeof value === 'string' ? value.trim() : '';
+  if (!trimmed || isRootHomeDir(trimmed)) {
+    return '';
+  }
+  return path.resolve(trimmed);
+}
+
+/**
+ * HOME=/ in builder-api cannot mkdir ~/.slack. Use a writable temp home instead.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function slackCliHomeDir(env = process.env) {
+  const ownHome = Boolean(env && Object.prototype.hasOwnProperty.call(env, 'HOME'));
+  const home = ownHome
+    ? usableHomeDir(env.HOME)
+    : usableHomeDir(env && env.HOME) || usableHomeDir(process.env.HOME);
+  if (home) {
+    return home;
+  }
+  const fallback = path.join(os.tmpdir(), SLACK_CLI_FALLBACK_HOME);
+  fs.mkdirSync(fallback, { recursive: true });
+  return fallback;
+}
+
+/**
+ * @returns {boolean}
+ */
+function isSlackCliInstallerSupported() {
+  return process.platform === 'linux' || process.platform === 'darwin';
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function slackCliLocalBinDir(env = process.env) {
+  return path.join(slackCliHomeDir(env), '.local', 'bin');
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function withSlackCliPath(env = process.env) {
+  const home = slackCliHomeDir(env);
+  const dir = slackCliLocalBinDir({ ...env, HOME: home });
+  const current = env.PATH || '';
+  const parts = current.split(path.delimiter).filter(Boolean);
+  const nextPath = parts.includes(dir) ? current : `${dir}${path.delimiter}${current}`;
+  return withGoTrustedCa({ ...env, HOME: home, PATH: nextPath }, home);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {void}
+ */
+function applySlackCliPath(deps = {}) {
+  const next = withSlackCliPath(deps.env || process.env);
+  deps.env = next;
+  process.env.PATH = next.PATH;
+  if (next.SSL_CERT_FILE) {
+    process.env.SSL_CERT_FILE = next.SSL_CERT_FILE;
+  }
+  if (!usableHomeDir(process.env.HOME)) {
+    process.env.HOME = next.HOME;
+  }
+}
+
+/**
+ * @param {string} url
+ * @param {import('http').IncomingMessage} res
+ * @param {number} redirects
+ * @param {(value: string) => void} resolve
+ * @param {(reason: Error) => void} reject
+ * @returns {boolean}
+ */
+function followHttpsRedirect(url, res, redirects, resolve, reject) {
+  const status = res.statusCode || 0;
+  if (!(status >= 300 && status < 400 && res.headers.location)) {
+    return false;
+  }
+  res.resume();
+  if (redirects >= MAX_REDIRECTS) {
+    reject(new Error('Too many redirects downloading Slack CLI installer.'));
+    return true;
+  }
+  const nextUrl = new URL(res.headers.location, url).toString();
+  if (!nextUrl.startsWith('https://')) {
+    reject(new Error('Slack CLI installer redirect was not HTTPS.'));
+    return true;
+  }
+  fetchHttpsText(nextUrl, redirects + 1).then(resolve, reject);
+  return true;
+}
+
+/**
+ * @param {import('http').IncomingMessage} res
+ * @param {(value: string) => void} resolve
+ * @param {(reason: Error) => void} reject
+ * @returns {void}
+ */
+function readInstallScriptBody(res, resolve, reject) {
+  const chunks = [];
+  let size = 0;
+  res.on('data', (chunk) => {
+    size += chunk.length;
+    if (size > MAX_SCRIPT_BYTES) {
+      res.destroy(new Error('Slack CLI installer script is larger than expected.'));
+      return;
+    }
+    chunks.push(chunk);
+  });
+  res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+  res.on('error', reject);
+}
+
+/**
+ * @param {string} url
+ * @param {number} [redirects]
+ * @returns {Promise<string>}
+ */
+function fetchHttpsText(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { timeout: 30000 }, (res) => {
+      if (followHttpsRedirect(url, res, redirects, resolve, reject)) {
+        return;
+      }
+      if ((res.statusCode || 0) !== 200) {
+        res.resume();
+        reject(new Error(`Slack CLI installer download failed (${res.statusCode || 0}).`));
+        return;
+      }
+      readInstallScriptBody(res, resolve, reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Prefer child stderr over Node's "Command failed: bash /tmp/…" wrapper.
+ * @param {unknown} error
+ * @returns {string}
+ */
+function slackCliInstallFailureMessage(error) {
+  const stderr = error && error.stderr ? String(error.stderr).trim() : '';
+  const stdout = error && error.stdout ? String(error.stdout).trim() : '';
+  const raw = error && error.message ? String(error.message) : '';
+  const fromChild = stderr || stdout;
+  if (fromChild) {
+    const lines = fromChild.split('\n').map((line) => line.trim()).filter(Boolean);
+    return lines[lines.length - 1] || fromChild;
+  }
+  const stripped = raw.replace(/^Command failed: bash \S+\s*/i, '').trim();
+  return stripped || 'Slack CLI install failed.';
+}
+
+function assertInstallScript(script) {
+  const text = String(script || '').trim();
+  if (!text.startsWith('#!')) {
+    throw slackProvisioningError('Slack CLI installer script is not a shell script.', 'SLACK_CLI');
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function runInstallScript(deps = {}) {
+  const fetchFn = deps.fetchInstallScript || fetchHttpsText;
+  const script = await fetchFn(SLACK_CLI_INSTALL_SCRIPT_URL);
+  assertInstallScript(script);
+  const scriptPath = path.join(os.tmpdir(), `aifabrix-slack-cli-install-${process.pid}.sh`);
+  fs.writeFileSync(scriptPath, script, { mode: 0o700 });
+  const execFileImpl = deps.execFile || execFileDefault;
+  const env = await withCurlOnPath(withSlackCliPath(deps.env || process.env));
+  try {
+    await execFileImpl('bash', [scriptPath], {
+      env,
+      timeout: deps.timeout || 180000,
+      maxBuffer: 2 * 1024 * 1024
+    });
+  } catch (error) {
+    throw slackProvisioningError(slackCliInstallFailureMessage(error), 'SLACK_CLI');
+  } finally {
+    try {
+      fs.unlinkSync(scriptPath);
+    } catch {
+      // ignore
+    }
+  }
+}
+
+/**
+ * @param {string} text
+ * @returns {import('ora').Ora|null}
+ */
+function startInstallSpinner(text) {
+  if (!process.stdout || !process.stdout.isTTY) {
+    logger.log(chalk.white(text));
+    return null;
+  }
+  return ora({ text: chalk.white(text), spinner: 'dots' }).start();
+}
+
+/**
+ * Official Slack install.sh. Never apt/snap `slack` (desktop app).
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function installOfficialSlackCli(deps = {}) {
+  if (typeof deps.installCli === 'function') {
+    await deps.installCli();
+    applySlackCliPath(deps);
+    return;
+  }
+  if (!isSlackCliInstallerSupported()) {
+    throw slackProvisioningError(
+      'Automatic Slack CLI install is available on Linux and macOS only.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  const spinner = startInstallSpinner('Installing Slack CLI…');
+  try {
+    await runInstallScript(deps);
+    applySlackCliPath(deps);
+    if (spinner) {
+      spinner.stop();
+    }
+    logger.log(formatSuccessLine('Slack CLI installed'));
+  } catch (error) {
+    if (spinner) {
+      spinner.stop();
+    }
+    throw slackProvisioningError(
+      error && error.message ? error.message : 'Slack CLI install failed.',
+      'SLACK_CLI'
+    );
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function runSlackLogin(deps = {}) {
+  if (typeof deps.slackLogin === 'function') {
+    await deps.slackLogin();
+    return;
+  }
+  const bin = typeof deps.slackBinary === 'string' && deps.slackBinary.trim()
+    ? deps.slackBinary.trim()
+    : 'slack';
+  await new Promise((resolve, reject) => {
+    const child = spawn(bin, ['login'], {
+      stdio: 'inherit',
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    child.on('error', reject);
+    child.on('exit', (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(slackProvisioningError(`slack login exited ${code}.`, 'SLACK_CLI'));
+    });
+  });
+}
+
+module.exports = {
+  isSlackCliInstallerSupported,
+  slackCliHomeDir,
+  slackCliLocalBinDir,
+  withSlackCliPath,
+  applySlackCliPath,
+  fetchHttpsText,
+  assertInstallScript,
+  slackCliInstallFailureMessage,
+  installOfficialSlackCli,
+  runSlackLogin
+};

package/lib/channels/slack-provisioning/manifest.js

@@ -0,0 +1,89 @@
+/**
+ * Local Slack manifest checks — generated artifact is SSOT.
+ *
+ * @fileoverview Do not rebuild Slack fields; validate the generated JSON
+ */
+
+'use strict';
+
+const { slackProvisioningError } = require('./errors');
+const { SLACK_APP_LONG_DESCRIPTION_MIN_LENGTH } = require('../channel-description');
+
+/**
+ * @param {string} content
+ * @returns {Object}
+ */
+function parseGeneratedManifest(content) {
+  if (typeof content !== 'string' || !content.trim()) {
+    throw slackProvisioningError('Generated Slack manifest is empty.', 'MANIFEST');
+  }
+  try {
+    const parsed = JSON.parse(content);
+    if (!parsed || typeof parsed !== 'object') {
+      throw new Error('not an object');
+    }
+    return parsed;
+  } catch {
+    throw slackProvisioningError('Generated Slack manifest is not valid JSON.', 'MANIFEST');
+  }
+}
+
+/**
+ * @param {Object} [display]
+ * @returns {boolean}
+ */
+function hasDisplayParts(display) {
+  const name = display && display.name;
+  const longDescription = String((display && display.long_description) || '').trim();
+  return Boolean(name && longDescription.length >= SLACK_APP_LONG_DESCRIPTION_MIN_LENGTH);
+}
+
+/**
+ * @param {Object} [features]
+ * @returns {boolean}
+ */
+function hasFeatureParts(features) {
+  const commands = features && features.slash_commands;
+  return Boolean(features && features.bot_user && Array.isArray(commands) && commands.length > 0);
+}
+
+/**
+ * @param {Object} [settings]
+ * @returns {boolean}
+ */
+function hasSettingsParts(settings) {
+  return Boolean(settings && settings.event_subscriptions && settings.interactivity);
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {boolean}
+ */
+function hasRequiredManifestParts(manifest) {
+  return Boolean(
+    hasDisplayParts(manifest && manifest.display_information) &&
+      hasFeatureParts(manifest && manifest.features) &&
+      hasSettingsParts(manifest && manifest.settings)
+  );
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {void}
+ */
+function assertLocalManifest(manifest) {
+  if (!hasRequiredManifestParts(manifest)) {
+    throw slackProvisioningError(
+      'Generated Slack manifest is missing required display, long_description (min 175 characters), bot, events, interactivity, or slash commands.',
+      'MANIFEST'
+    );
+  }
+  if (manifest.settings && manifest.settings.socket_mode_enabled === true) {
+    throw slackProvisioningError('Slack Socket Mode must stay disabled for this channel.', 'MANIFEST');
+  }
+}
+
+module.exports = {
+  parseGeneratedManifest,
+  assertLocalManifest
+};

package/lib/channels/slack-provisioning/oauth-lock.js

@@ -0,0 +1,33 @@
+/**
+ * Keep Slack OAuth fields Slack will not let us turn off.
+ *
+ * @fileoverview Token rotation cannot be disabled after it was enabled.
+ * Never copy remote OAuth redirect URLs — Slack HMAC does not use a callback.
+ */
+
+'use strict';
+
+/**
+ * @param {Object} manifest
+ * @param {Object|null} remote
+ * @returns {Object}
+ */
+function preserveSlackOAuthLocks(manifest, remote) {
+  if (!manifest || typeof manifest !== 'object') {
+    return manifest;
+  }
+  const next = {
+    ...manifest,
+    settings: { ...(manifest.settings || {}) },
+    oauth_config: { ...(manifest.oauth_config || {}) }
+  };
+  if (remote && remote.settings && remote.settings.token_rotation_enabled === true) {
+    next.settings.token_rotation_enabled = true;
+  }
+  next.oauth_config.redirect_urls = [];
+  return next;
+}
+
+module.exports = {
+  preserveSlackOAuthLocks
+};

package/lib/channels/slack-provisioning/offer-cli.js

@@ -0,0 +1,113 @@
+/**
+ * Offer to install Slack CLI and sign in during channel add.
+ *
+ * @fileoverview Interactive TTY only — CI / JSON keep remaining steps
+ */
+
+'use strict';
+
+const inquirer = require('inquirer');
+const { isChannelAddInteractive } = require('../channel-add-wizard');
+const { shouldSkipLiveSlackCli, resolveSlackBinary } = require('./cli');
+const {
+  isSlackCliInstallerSupported,
+  installOfficialSlackCli,
+  runSlackLogin
+} = require('./install-cli');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipCliOffer(deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return false;
+  }
+  if (typeof deps.slackApi === 'function') {
+    return true;
+  }
+  return shouldSkipLiveSlackCli(deps);
+}
+
+/**
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function canOfferSlackCliInstall(options = {}, deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return true;
+  }
+  if (!isSlackCliInstallerSupported()) {
+    return false;
+  }
+  return isChannelAddInteractive(options);
+}
+
+/**
+ * @param {string} message
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function confirmYesNo(message, deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return deps.confirm(message);
+  }
+  const answers = await inquirer.prompt([
+    {
+      type: 'confirm',
+      name: 'ok',
+      message,
+      default: true
+    }
+  ]);
+  return answers.ok === true;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function offerInstallAndLogin(deps = {}) {
+  const accepted = await confirmYesNo('Install Slack CLI now?', deps);
+  if (!accepted) {
+    throw slackProvisioningError('Slack CLI install declined.', 'SLACK_CLI_MISSING');
+  }
+  await installOfficialSlackCli(deps);
+  const signIn = await confirmYesNo('Sign in to Slack now?', deps);
+  if (signIn) {
+    await runSlackLogin(deps);
+  }
+}
+
+/**
+ * Prompt + install Slack CLI when missing, then continue channel add.
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function ensureSlackCliReady(options = {}, deps = {}) {
+  if (shouldSkipCliOffer(deps)) {
+    return;
+  }
+  const existing = await resolveSlackBinary(deps);
+  if (existing) {
+    return;
+  }
+  if (!canOfferSlackCliInstall(options, deps)) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  await offerInstallAndLogin(deps);
+}
+
+module.exports = {
+  shouldSkipCliOffer,
+  canOfferSlackCliInstall,
+  confirmYesNo,
+  offerInstallAndLogin,
+  ensureSlackCliReady
+};

package/lib/channels/slack-provisioning/onboard-members.js

@@ -0,0 +1,122 @@
+/**
+ * Slack workspace member list + email-join helpers for channel onboard.
+ *
+ * @fileoverview Skip bots; never print emails or Slack user ids on TTY
+ */
+
+'use strict';
+
+const { listUsers } = require('../../api/users.api');
+const { extractUserListItems } = require('../../identity/resolve-user-id');
+const { runSlackApi } = require('./cli');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {Object} member
+ * @returns {'skip'|'unmatched'|'candidate'}
+ */
+function classifySlackMember(member) {
+  if (!member || member.deleted === true) {
+    return 'skip';
+  }
+  if (member.is_bot === true || member.is_app_user === true || member.id === 'USLACKBOT') {
+    return 'skip';
+  }
+  if (typeof member.id !== 'string' || !member.id.trim()) {
+    return 'skip';
+  }
+  const email = member.profile && String(member.profile.email || '').trim();
+  if (!email || !email.includes('@')) {
+    return 'unmatched';
+  }
+  return 'candidate';
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackWorkspaceMembers(deps = {}) {
+  const members = [];
+  let cursor = '';
+  for (let page = 0; page < 50; page += 1) {
+    const payload = { limit: 200 };
+    if (cursor) {
+      payload.cursor = cursor;
+    }
+    const body = await runSlackApi('users.list', payload, deps);
+    if (!body || body.ok !== true) {
+      throw slackProvisioningError('Slack users.list failed.', 'SLACK_API');
+    }
+    members.push(...(Array.isArray(body.members) ? body.members : []));
+    cursor = (body.response_metadata && body.response_metadata.next_cursor) || '';
+    if (!cursor) {
+      break;
+    }
+  }
+  return members;
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} email
+ * @returns {Promise<Object|null>}
+ */
+async function lookupUniqueUserByEmail(controllerUrl, authConfig, email) {
+  const value = String(email || '').trim();
+  if (!value) {
+    return null;
+  }
+  const listed = await listUsers(controllerUrl, authConfig, {
+    filter: `email:eq:${value}`,
+    pageSize: 2,
+    page: 1
+  });
+  if (!listed || listed.success === false) {
+    return null;
+  }
+  const lower = value.toLowerCase();
+  const matches = extractUserListItems(listed).filter(
+    (user) => String(user.email || '').toLowerCase() === lower && user.id
+  );
+  return matches.length === 1 ? matches[0] : null;
+}
+
+/**
+ * @async
+ * @param {Object[]} members
+ * @param {{ controllerUrl: string, authConfig: Object }} ctx
+ * @param {Object} [deps]
+ * @returns {Promise<{ items: Object[], unmatched: number }>}
+ */
+async function matchSlackMembersToUsers(members, ctx, deps = {}) {
+  const lookup = deps.lookupUniqueUserByEmail || lookupUniqueUserByEmail;
+  const items = [];
+  let unmatched = 0;
+  for (const member of members || []) {
+    const kind = classifySlackMember(member);
+    if (kind === 'skip') {
+      continue;
+    }
+    if (kind !== 'candidate') {
+      unmatched += 1;
+      continue;
+    }
+    const user = await lookup(ctx.controllerUrl, ctx.authConfig, member.profile.email.trim());
+    if (user && user.id) {
+      items.push({ externalUserId: member.id, platformUserId: user.id });
+    } else {
+      unmatched += 1;
+    }
+  }
+  return { items, unmatched };
+}
+
+module.exports = {
+  classifySlackMember,
+  listSlackWorkspaceMembers,
+  lookupUniqueUserByEmail,
+  matchSlackMembersToUsers
+};