@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/microsoft-provisioning/teams-cli.js

@@ -0,0 +1,82 @@
+/**
+ * Spawn Teams Developer CLI (`teams`) without scattering argv.
+ *
+ * @fileoverview Documented CLI only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const { shouldSkipLiveToolkit, runAtk } = require('./cli');
+const { findOrInstallTeamsBinary } = require('./install-teams');
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipLiveTeamsCli(deps = {}) {
+  return shouldSkipLiveToolkit(deps);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function resolveTeamsBinary(deps = {}) {
+  if (typeof deps.teamsBinary === 'string' && deps.teamsBinary.trim()) {
+    return deps.teamsBinary.trim();
+  }
+  if (shouldSkipLiveTeamsCli(deps)) {
+    return null;
+  }
+  return findOrInstallTeamsBinary(deps);
+}
+
+/**
+ * @param {string} bin
+ * @param {string[]} args
+ * @param {Object} [opts]
+ * @param {Object} [deps]
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function runTeams(bin, args, opts = {}, deps = {}) {
+  return runAtk(bin, args, opts, deps);
+}
+
+/**
+ * @param {string} text
+ * @returns {boolean}
+ */
+function teamsStatusLooksLoggedIn(text) {
+  const blob = String(text || '');
+  if (/not logged in/i.test(blob)) {
+    return false;
+  }
+  return /logged in as|sideloading:\s*enabled/i.test(blob);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function isTeamsCliLoggedIn(deps = {}) {
+  const bin = await resolveTeamsBinary(deps);
+  if (!bin) {
+    return false;
+  }
+  try {
+    const result = await runTeams(bin, ['status'], { timeout: 20000 }, deps);
+    return teamsStatusLooksLoggedIn(`${result.stdout}\n${result.stderr}`);
+  } catch (error) {
+    const stdout = error && error.stdout ? String(error.stdout) : '';
+    const stderr = error && error.stderr ? String(error.stderr) : '';
+    return teamsStatusLooksLoggedIn(`${stdout}\n${stderr}`);
+  }
+}
+
+module.exports = {
+  shouldSkipLiveTeamsCli,
+  resolveTeamsBinary,
+  runTeams,
+  teamsStatusLooksLoggedIn,
+  isTeamsCliLoggedIn
+};

package/lib/channels/runtime-tool-catalog.js

@@ -108,9 +108,12 @@ function preferLayerBToolNames(names) {
  */
 async function fetchRuntimeLayerBToolNames(dataplaneUrl, authConfig, channelTarget) {
   const target = getChannelTarget(channelTarget);
-  const routeSystemKey = target.routeSystemKey || target.key;
+  const runtimeKey =
+    (target.runtimeTarget && target.runtimeTarget.defaultSystemKey) ||
+    target.routeSystemKey ||
+    'runtime-orchestration';
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  const endpoints = buildToolCatalogEndpoints(routeSystemKey);
+  const endpoints = buildToolCatalogEndpoints(runtimeKey);
   for (const endpoint of endpoints) {
     try {
       const response = await client.get(endpoint, { timeoutMs: 10000 });

package/lib/channels/slack-channel-add-portal.js

@@ -0,0 +1,130 @@
+/**
+ * Portal HTTP Slack auth: start ticket, return slash command, complete with challenge.
+ *
+ * @fileoverview Do not tell the browser user to install Slack CLI or re-run channel add
+ */
+
+'use strict';
+
+const {
+  looksLikeSlackAccessToken,
+  slashCommandForTicket,
+  startSlackAuthTicket,
+  completeSlackAuthTicket
+} = require('./slack-provisioning/auth-ticket');
+const { SLACK_AUTH_HANDSHAKE_STEPS } = require('./channel-add-remaining');
+const { redactSlackSecrets } = require('./slack-provisioning/errors');
+
+/**
+ * @param {string} slashCommand
+ * @param {string} ticket
+ * @returns {{ waiting: true, result: Object }}
+ */
+function handshakeWaiting(slashCommand, ticket) {
+  return {
+    waiting: true,
+    result: {
+      connected: false,
+      remaining: [...SLACK_AUTH_HANDSHAKE_STEPS],
+      slashCommand,
+      slackAuthTicket: ticket
+    }
+  };
+}
+
+/**
+ * @param {Error} error
+ * @returns {{ waiting: true, result: Object }}
+ */
+function handshakeFailed(error) {
+  const code = error && error.code;
+  const remaining = code === 'SLACK_CLI_MISSING'
+    ? ['Slack authentication could not start on this host.']
+    : [redactSlackSecrets((error && error.message) || 'Slack authentication could not start.')];
+  return {
+    waiting: true,
+    result: {
+      connected: false,
+      remaining,
+      handshakeFailed: true
+    }
+  };
+}
+
+/**
+ * @param {string} ticket
+ * @param {Error} error
+ * @returns {{ waiting: true, result: Object }}
+ */
+function handshakeRetry(ticket, error) {
+  const slashCommand = slashCommandForTicket(ticket);
+  if (!slashCommand) {
+    return handshakeFailed(error);
+  }
+  return handshakeWaiting(slashCommand, ticket);
+}
+
+/**
+ * @param {Error|Object|null} error
+ * @returns {boolean}
+ */
+function isStaleSlackLoginError(error) {
+  const message = String((error && error.message) || '');
+  return /run the slack login command again|error handling your login/i.test(message);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<{ waiting: true, result: Object }>}
+ */
+async function startOrFailHandshake(deps = {}) {
+  try {
+    const started = await startSlackAuthTicket(deps);
+    return handshakeWaiting(started.slashCommand, started.ticket);
+  } catch (error) {
+    return handshakeFailed(error);
+  }
+}
+
+/**
+ * Quiet HTTP install: start or complete the Slack CLI ticket handshake.
+ * @param {Object} options
+ * @param {Object} deps
+ * @returns {Promise<{ waiting: boolean, result?: Object }>}
+ */
+async function preparePortalSlackAuth(options = {}, deps = {}) {
+  if (options.retryLogin === true) {
+    return startOrFailHandshake(deps);
+  }
+  const submitted = typeof options.vendorSessionToken === 'string'
+    ? options.vendorSessionToken.trim()
+    : '';
+  const ticket = typeof options.slackAuthTicket === 'string'
+    ? options.slackAuthTicket.trim()
+    : '';
+  if (looksLikeSlackAccessToken(submitted)) {
+    deps.slackUserToken = submitted;
+    return { waiting: false };
+  }
+  if (submitted && ticket) {
+    try {
+      deps.slackUserToken = await completeSlackAuthTicket({ ticket, challenge: submitted }, deps);
+      return { waiting: false };
+    } catch (error) {
+      if (isStaleSlackLoginError(error)) {
+        return startOrFailHandshake(deps);
+      }
+      return handshakeRetry(ticket, error);
+    }
+  }
+  if (ticket) {
+    return handshakeWaiting(slashCommandForTicket(ticket), ticket);
+  }
+  return startOrFailHandshake(deps);
+}
+
+module.exports = {
+  preparePortalSlackAuth,
+  handshakeWaiting,
+  handshakeFailed
+};

package/lib/channels/slack-channel-add-tty-auth.js

@@ -0,0 +1,95 @@
+/**
+ * Interactive Slack ticket handshake for `aifabrix channel add`.
+ *
+ * @fileoverview Print slash command, collect challenge, complete auth token
+ */
+
+'use strict';
+
+const inquirer = require('inquirer');
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { printLabeledUrl } = require('./channel-add-tty');
+const { isChannelAddInteractive } = require('./channel-add-wizard');
+const { handshakeFailed, handshakeWaiting } = require('./slack-channel-add-portal');
+const {
+  startSlackAuthTicket,
+  completeSlackAuthTicket
+} = require('./slack-provisioning/auth-ticket');
+const { slackProvisioningError } = require('./slack-provisioning/errors');
+
+/**
+ * @param {Object} options
+ * @param {Object} deps
+ * @returns {boolean}
+ */
+function canRefreshInteractive(options = {}, deps = {}) {
+  if (options.quiet === true) {
+    return false;
+  }
+  if (typeof deps.promptChallenge === 'function') {
+    return true;
+  }
+  return isChannelAddInteractive(options);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function promptChallengeCode(deps = {}) {
+  if (typeof deps.promptChallenge === 'function') {
+    return String((await deps.promptChallenge()) || '').trim();
+  }
+  const answers = await inquirer.prompt([
+    {
+      type: 'input',
+      name: 'challenge',
+      message: 'Challenge code',
+      validate: (value) => Boolean(String(value || '').trim()) || 'Challenge code is required'
+    }
+  ]);
+  return String(answers.challenge || '').trim();
+}
+
+/**
+ * @param {Object} started
+ * @returns {void}
+ */
+function printHandshakeCommand(started) {
+  printLabeledUrl('Run in Slack', started.slashCommand);
+  logger.log(chalk.white('Approve the permissions Slack shows, then paste the challenge code.'));
+}
+
+/**
+ * Start a new Slack ticket, prompt for the challenge, store the session token on deps.
+ * @param {Object} deps
+ * @returns {Promise<{ ok: boolean, result?: Object }>}
+ */
+async function refreshInteractiveSlackAuth(deps = {}) {
+  let started = null;
+  try {
+    started = await startSlackAuthTicket(deps);
+    printHandshakeCommand(started);
+    const challenge = await promptChallengeCode(deps);
+    if (!challenge) {
+      throw slackProvisioningError('Challenge code is required.', 'SLACK_CLI');
+    }
+    deps.slackUserToken = await completeSlackAuthTicket({
+      ticket: started.ticket,
+      challenge
+    }, deps);
+    return { ok: true };
+  } catch (error) {
+    if (started && started.slashCommand) {
+      return { ok: false, result: handshakeWaiting(started.slashCommand, started.ticket).result };
+    }
+    return { ok: false, result: handshakeFailed(error).result };
+  }
+}
+
+module.exports = {
+  canRefreshInteractive,
+  promptChallengeCode,
+  refreshInteractiveSlackAuth
+};

package/lib/channels/slack-channel-add.js

@@ -0,0 +1,311 @@
+/**
+ * Slack channel-add provisioning hook (plan 176.0).
+ *
+ * @fileoverview Keep add-channel.js free of Slack CLI/HTTP
+ */
+
+'use strict';
+
+const { provisionSlackChannel } = require('./slack-provisioning');
+const { ensureSlackCliReady } = require('./slack-provisioning/offer-cli');
+const { SLACK_CLI_DOCS_URL } = require('./slack-provisioning/constants');
+const { redactSlackSecrets } = require('./slack-provisioning/errors');
+const { isSlackAuthDeadError } = require('./slack-provisioning/auth-ticket');
+const { preparePortalSlackAuth } = require('./slack-channel-add-portal');
+const { canRefreshInteractive, refreshInteractiveSlackAuth } = require('./slack-channel-add-tty-auth');
+const { SLACK_AUTH_HANDSHAKE_STEPS } = require('./channel-add-remaining');
+const { readProvisioningState, hasProvenAppIdentity } = require('./slack-provisioning/persist');
+const { slackConsentRemaining, slackConsentUrls } = require('./slack-provisioning/remaining-urls');
+const { ensureChannelUploaded } = require('./channel-add-ensure');
+const {
+  maybeOnboardSlackUsers,
+  unmatchedRemainingStep
+} = require('./slack-provisioning/onboard');
+const { registerSlackMcpCallback, slackMcpProfileUrl } = require('./slack-mcp-callback');
+
+/**
+ * @param {Error} error
+ * @returns {string[]}
+ */
+function remainingFromError(error) {
+  const code = error && error.code;
+  if (code === 'CALLBACKS') {
+    return [
+      'Use a public HTTPS dataplane URL for Slack Events, Interactivity, and commands'
+    ];
+  }
+  if (code === 'UNPROVEN_IDENTITY' && error && error.message) {
+    return [error.message];
+  }
+  if (code === 'SLACK_CLI_MISSING') {
+    return [
+      `Install Slack CLI (${SLACK_CLI_DOCS_URL}) and run slack login`,
+      'Re-run channel add to create the Slack app automatically',
+      'Approve the workspace install if Slack asks'
+    ];
+  }
+  if (isSlackAuthDeadError(error)) {
+    return [...SLACK_AUTH_HANDSHAKE_STEPS];
+  }
+  const detail = redactSlackSecrets(
+    (error && error.message) || 'Slack app provisioning failed'
+  );
+  return [detail, 'Approve the workspace install if Slack asks'];
+}
+
+/**
+ * @param {Error} error
+ * @param {boolean} hasApp
+ * @returns {boolean}
+ */
+function shouldUseConsentRemaining(error, hasApp) {
+  if (!hasApp) {
+    return false;
+  }
+  const code = error && error.code;
+  if (isSlackAuthDeadError(error)) {
+    return false;
+  }
+  return code !== 'CALLBACKS' && code !== 'SLACK_CLI_MISSING' && code !== 'UNPROVEN_IDENTITY';
+}
+
+/**
+ * Existing Slack app: print app + install-on-team URLs, not the generic apps list.
+ * @param {string} projectRoot
+ * @param {Error} error
+ * @returns {Object}
+ */
+function recoveryFromExistingApp(projectRoot, error) {
+  const state = readProvisioningState(projectRoot);
+  const hasApp = hasProvenAppIdentity(state);
+  const urls = hasApp ? slackConsentUrls(state) : {};
+  return {
+    connected: false,
+    remaining: shouldUseConsentRemaining(error, hasApp)
+      ? slackConsentRemaining({ storedSigningSecret: Boolean(state && state.secretsStored) })
+      : remainingFromError(error),
+    recovery: true,
+    error: error && error.message ? error.message : String(error),
+    appId: hasApp ? state.appId : undefined,
+    ...urls
+  };
+}
+
+/**
+ * Prompt/run Slack email onboard and attach TTY counts (no member dump).
+ * @param {Object} ttyCtx
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function applySlackOnboardToCtx(ttyCtx, options = {}) {
+  const deps = options.slackProvisioningDeps || {};
+  try {
+    const onboard = await maybeOnboardSlackUsers({ ctx: ttyCtx, options }, deps);
+    if (!onboard.ran) {
+      return ttyCtx;
+    }
+    const extra = unmatchedRemainingStep(onboard.unmatched);
+    return {
+      ...ttyCtx,
+      slackOnboarded: onboard.linked,
+      slackRemaining: [...(ttyCtx.slackRemaining || []), extra].filter(Boolean)
+    };
+  } catch {
+    return {
+      ...ttyCtx,
+      slackRemaining: [
+        ...(ttyCtx.slackRemaining || []),
+        'Slack user onboard could not finish'
+      ]
+    };
+  }
+}
+
+/**
+ * Publish the Slack instance CS so webhookInbound and channel.definitionKey
+ * can be patched even when Slack CLI has not returned a bot token yet.
+ *
+ * @param {Object} result
+ * @param {Object} options
+ * @param {Object} deps
+ * @returns {Promise<void>}
+ */
+async function publishSlackAfterSecrets(_result, options, deps) {
+  const publish = deps.ensureChannelUploaded || ensureChannelUploaded;
+  await publish('slack', {
+    ...options,
+    force: true,
+    suppressUploadedLine: true
+  });
+}
+
+/**
+ * Portal HTTP has no Slack CLI: still publish the instance CS, then remaining steps.
+ * @param {string} projectRoot
+ * @param {Error} error
+ * @param {Object} options
+ * @param {Object} deps
+ * @returns {Promise<Object>}
+ */
+async function recoverSlackProvisionFailure(projectRoot, error, options, deps) {
+  if (error && error.code === 'MANIFEST') {
+    throw error;
+  }
+  await publishSlackAfterSecrets({ connected: false }, options, deps);
+  return recoveryFromExistingApp(projectRoot, error);
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Object}
+ */
+function slackDepsFromOptions(options = {}) {
+  const deps = { ...(options.slackProvisioningDeps || {}) };
+  const token = typeof options.vendorSessionToken === 'string'
+    ? options.vendorSessionToken.trim()
+    : '';
+  if (token) {
+    deps.slackUserToken = token;
+  }
+  return deps;
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function provisionAndPublish(params, options, deps, ctx, projectRoot) {
+  const result = await provisionSlackChannel(
+    {
+      projectRoot,
+      runtimeValues: params.runtimeValues,
+      artifact: params.artifact,
+      ctx,
+      environment: ctx.environment,
+      expectedTeamId: options.expectedTeamId,
+      force: options.force === true,
+      quiet: options.quiet === true
+    },
+    deps
+  );
+  await publishSlackAfterSecrets(result, options, deps);
+  return result;
+}
+
+/**
+ * @param {Error} error
+ * @param {Object} params
+ * @param {Object} options
+ * @param {Object} deps
+ * @param {Object} ctx
+ * @param {string} projectRoot
+ * @returns {Promise<Object>}
+ */
+async function recoverOrRefreshAuth(error, params, options, deps, ctx, projectRoot) {
+  if (error && error.code === 'MANIFEST') {
+    throw error;
+  }
+  if (isSlackAuthDeadError(error) && canRefreshInteractive(options, deps)) {
+    const refresh = await refreshInteractiveSlackAuth(deps);
+    if (refresh.ok) {
+      try {
+        return await provisionAndPublish(params, options, deps, ctx, projectRoot);
+      } catch (retryError) {
+        return recoverSlackProvisionFailure(projectRoot, retryError, options, deps);
+      }
+    }
+    await publishSlackAfterSecrets({ connected: false }, options, deps);
+    return refresh.result;
+  }
+  return recoverSlackProvisionFailure(projectRoot, error, options, deps);
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeRegisterSlackMcpCallback(params) {
+  const runtime = params && params.runtimeValues;
+  const ctx = params && params.ctx;
+  if (!runtime || !runtime.enableMcpServer) {
+    return null;
+  }
+  if (!ctx || !ctx.controllerUrl || !ctx.authConfig) {
+    return {
+      ok: false,
+      fallback: true,
+      remaining: ['Open the OAuth2 profile and add the Slack MCP callback URL']
+    };
+  }
+  try {
+    const result = await registerSlackMcpCallback({ ctx, ...(params.slackMcpCallbackDeps || {}) });
+    if (result && result.fallback) {
+      const profileUrl = result.profileUrl || slackMcpProfileUrl(ctx);
+      return {
+        ok: false,
+        fallback: true,
+        remaining: [`Open ${profileUrl} and add the Slack MCP callback URL`]
+      };
+    }
+    return result;
+  } catch (error) {
+    return {
+      ok: false,
+      fallback: true,
+      remaining: [error && error.message ? error.message : 'Slack MCP callback could not be registered']
+    };
+  }
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeProvisionSlackChannel(params) {
+  if (!params || params.channelTarget !== 'slack' || (params.options && params.options.dryRun === true)) {
+    return null;
+  }
+  const ctx = params.ctx || {};
+  const options = params.options || {};
+  const deps = slackDepsFromOptions(options);
+  const projectRoot = options.projectRoot || process.cwd();
+  const mcpCallback = await maybeRegisterSlackMcpCallback(params);
+  if (options.quiet === true) {
+    const portal = await preparePortalSlackAuth(options, deps);
+    if (portal.waiting) {
+      await publishSlackAfterSecrets({ connected: false }, options, deps);
+      return attachSlackMcpRemaining(portal.result, mcpCallback);
+    }
+  }
+  try {
+    if (options.quiet !== true) {
+      await ensureSlackCliReady(options, deps);
+    }
+    const result = await provisionAndPublish(params, options, deps, ctx, projectRoot);
+    return attachSlackMcpRemaining(result, mcpCallback);
+  } catch (error) {
+    const recovered = await recoverOrRefreshAuth(error, params, options, deps, ctx, projectRoot);
+    return attachSlackMcpRemaining(recovered, mcpCallback);
+  }
+}
+
+/**
+ * @param {Object|null} result
+ * @param {Object|null} mcpCallback
+ * @returns {Object|null}
+ */
+function attachSlackMcpRemaining(result, mcpCallback) {
+  const extra = mcpCallback && Array.isArray(mcpCallback.remaining) ? mcpCallback.remaining : [];
+  if (extra.length === 0) {
+    return result;
+  }
+  const base = result && typeof result === 'object' ? result : {};
+  return { ...base, remaining: [...(base.remaining || []), ...extra] };
+}
+
+module.exports = {
+  maybeProvisionSlackChannel,
+  maybeRegisterSlackMcpCallback,
+  applySlackOnboardToCtx,
+  remainingFromError
+};

package/lib/channels/slack-mcp-callback.js

@@ -0,0 +1,51 @@
+/**
+ * Allowlist Slack MCP OAuth callback on the existing customerOAuth client.
+ *
+ * @fileoverview Reuse ChatGPT Integration Client; never rotate the secret
+ */
+
+'use strict';
+
+const {
+  registerChatGptCallbackUrls,
+  chatgptProfileUrl
+} = require('./chatgpt-callback');
+const {
+  CHATGPT_INTEGRATION_CLIENT_KEY,
+  CHATGPT_OAUTH2_PROFILE_ID,
+  CHATGPT_OAUTH2_PROFILE_PATH
+} = require('./chatgpt-runtime-contract');
+const { SLACK_MCP_CALLBACK_URI } = require('./slack-mcp-runtime');
+
+const SLACK_MCP_CALLBACK_CONTRACT = {
+  integrationClientKey: CHATGPT_INTEGRATION_CLIENT_KEY,
+  oauth2ProfileId: CHATGPT_OAUTH2_PROFILE_ID,
+  oauth2ProfilePath: CHATGPT_OAUTH2_PROFILE_PATH,
+  vendorLabel: 'Slack MCP'
+};
+
+/**
+ * @param {Object} ctx
+ * @returns {string}
+ */
+function slackMcpProfileUrl(ctx) {
+  return chatgptProfileUrl(ctx, SLACK_MCP_CALLBACK_CONTRACT);
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function registerSlackMcpCallback(params) {
+  return registerChatGptCallbackUrls({
+    ...params,
+    callbackUrls: [SLACK_MCP_CALLBACK_URI],
+    contract: SLACK_MCP_CALLBACK_CONTRACT
+  });
+}
+
+module.exports = {
+  SLACK_MCP_CALLBACK_CONTRACT,
+  slackMcpProfileUrl,
+  registerSlackMcpCallback
+};