@aifabrix/builder 2.53.1 → 2.55.0

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -24,21 +24,21 @@ dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
 | **Teams Developer Portal app** | Package definition (`manifest.json.id`) and organisation publish request. | Teams app / manifest ID |
 | **Teams admin centre catalogue** | Approval, availability, policy, published state. | Catalogue entry after org publish |
 
-`--oauth-plugin-vault-reference-id` is the **Teams Entra SSO registration / auth-config ID** from Developer Portal Tools → Microsoft Entra SSO. It is **not** the Entra Client (application) ID and **not** a client secret.
+`--oauth-plugin-vault-reference-id` is the **Microsoft auth-config ID** that Microsoft 365 Agents Toolkit (`atk` / `oauth/register`) writes into `OAuthPluginVault.reference_id`. It is **not** the Entra Client (application) ID and **not** a client secret. That CLI registration is stored in Microsoft’s token store; it often **does not** appear as a Teams Developer Portal “Entra SSO registration” you can browse. Teams Developer Portal is fallback, inspection, or recovery only.
 
 Do **not** configure AI Fabrix OAuth client secrets under Connected Systems → Authentication for this Entra SSO flow.
 
 ## Package prerequisites (before Import)
 
-1. Generate the channel package with `aifabrix channel add microsoft-copilot`.
-2. Configure Microsoft Entra SSO: **Tools → Microsoft Entra SSO client ID registration** (see table below). Copy the generated registration / auth-config ID.
-3. Re-run packaging so `ai-plugin.json` gets `auth.type = OAuthPluginVault` and `auth.reference_id = <auth-config-id>`:
+1. Run `aifabrix channel add microsoft-copilot` (or continue from the portal). Sign in with Microsoft when asked so Agents Toolkit can create or reuse the auth-config.
+2. Toolkit captures the auth-config ID and Application ID URI, then embeds `auth.type = OAuthPluginVault` and `auth.reference_id` in `ai-plugin.json`.
+3. Use `--oauth-plugin-vault-reference-id` only when Toolkit cannot create the id (fallback / recovery):
 
 ```bash
-aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
+aifabrix channel add microsoft-copilot --name "{{appName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
 ```
 
-Keep any `webApplicationInfo` the portal binds for Entra SSO — do not strip it on re-import.
+Keep package `webApplicationInfo` aligned with the **Azure** Application ID URI (`api://{clientId}` / Trust audience). Do not replace it with the Teams portal display URI `api://auth-…` on re-import.
 
 Upload **only** the ZIP package. Do not upload individual source files or `channel-microsoft-copilot.json`.
 
@@ -49,11 +49,11 @@ Upload **only** the ZIP package. Do not upload individual source files or `chann
 3. Developer Portal → selected app → **Publish to your org** → Distribute / submit.
 4. Teams admin approves in [Teams admin centre → Manage apps](https://admin.teams.microsoft.com/policies/manage-apps) (Manage apps → search → allow). Expect **Published** / **Unblocked** per organisation policy. Allow several minutes for propagation.
 5. Open **Teams** → **Apps** (**Built for your org**), click **{{appName}}**, **Add** the application, then choose **Open with Copilot**.
-6. In Copilot, click **Show my role assistants** and run the command.
+6. In Copilot, click a starter titled like **vX.Y.Z — Role Assistants** (package version in the title) and run it.
 7. Confirm Runtime MCP and governed tools using this guide, then re-run with `--probe` after organisation publish:
 
 ```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --oauth-plugin-vault-reference-id "{{{oauthPluginVaultReferenceId}}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{appName}}" --oauth-plugin-vault-reference-id "{{{oauthPluginVaultReferenceId}}}" --probe
 ```
 
 8. After the app is available under **Built for your org**, re-run:
@@ -119,7 +119,7 @@ Use this when replacing the app, cleaning a failed publish, or removing **{{appN
 2. Search for **{{appName}}**, open the app, open the action menu, choose **Delete**, and confirm.
 3. Open [Teams Developer Portal → Apps](https://dev.teams.microsoft.com/apps).
 4. Find the app in the list, open **…** (Actions) → **Delete**, and confirm by typing the app name.
-5. Open [Microsoft Entra SSO client ID registration](https://dev.teams.microsoft.com/tools/entra-configuration).
+5. Open [Teams Developer Portal → Microsoft Entra SSO client ID registration](https://dev.teams.microsoft.com/tools/entra-configuration).
 6. Find the registration for this channel (same registration / auth-config used as `--oauth-plugin-vault-reference-id`), open **…** (Actions) → **Delete**, and confirm.
 
 After Microsoft cleanup, delete local package output if needed (`dist/channels/microsoft-copilot/`) and re-run `aifabrix channel add` with a **new** Entra SSO registration / auth-config ID. Do not reuse a deleted registration id.

package/templates/channels/microsoft-copilot/integration/README.md

@@ -1,4 +1,4 @@
-# Microsoft 365 Copilot package channel
+# Microsoft Copilot
 
 Generated by `aifabrix channel scaffold microsoft-copilot`.
 

package/templates/channels/microsoft-copilot/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "microsoft-copilot",
-    "displayName": "Microsoft Copilot package channel",
-    "description": "Assistant communication channel — deploy then channel add",
+    "displayName": "Microsoft Copilot",
+    "description": "Publish a Microsoft Copilot package for Microsoft 365.",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/microsoft-copilot/integration/env.template

@@ -1,6 +1,3 @@
-# Microsoft Copilot package channel credential references
-# aifabrix secret set microsoft-copilot/clientId "<value>" --shared
-# aifabrix secret set microsoft-copilot/clientSecret "<value>" --shared
-
-KV_MICROSOFT_COPILOT_CLIENTID=kv://microsoft-copilot/clientId
-KV_MICROSOFT_COPILOT_CLIENTSECRET=kv://microsoft-copilot/clientSecret
+# Microsoft Copilot
+# OAuth / Entra app secrets are not stored here (authType: system).
+# Remaining Microsoft 365 publish uses the generated package and OAuth plugin vault.

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -1,14 +1,73 @@
 {
   "key": "microsoft-copilot",
-  "displayName": "Microsoft Copilot package channel",
-  "description": "Communication external system for Microsoft Copilot package onboarding",
+  "displayName": "Microsoft Copilot",
+  "description": "Publish a Microsoft Copilot package for Microsoft 365.",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
     "authType": "system"
   },
-  "configuration": [],
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    },
+    {
+      "name": "CHANNEL_PACKAGE_VERSION",
+      "value": "1.0.0",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "CHANNEL_OAUTH_PLUGIN_VAULT_REFERENCE_ID",
+      "value": "",
+      "location": "variable",
+      "required": false
+    }
+  ],
   "dataSources": [],
-  "endpointsActive": false
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "microsoft-copilot",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "microsoftCopilot",
+      "templateDir": "microsoft-copilot",
+      "artifactFileName": "channel-microsoft-copilot.json",
+      "artifactFormat": "json",
+      "credentialKey": "microsoft-copilot-channel",
+      "capabilities": [
+        "chat",
+        "notify",
+        "documentApproval",
+        "enterpriseActions"
+      ],
+      "displayLabel": "Microsoft Copilot",
+      "category": "employee-ai",
+      "wizardOrder": 10,
+      "remainingManualStep": "Publish the app in Microsoft 365.",
+      "docsAnchor": "microsoft-copilot",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
 }

package/templates/channels/microsoft-copilot/integration/rbac.json

@@ -0,0 +1,13 @@
+{
+  "roles": [
+    {
+      "name": "Everyone",
+      "value": "aifabrix-everyone",
+      "description": "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)",
+      "groups": [
+        "AI-Fabrix-Everyone"
+      ]
+    }
+  ],
+  "permissions": []
+}

package/templates/channels/microsoft-copilot/oauth-plugin-vault-required.template.md.hbs

@@ -1,15 +1,15 @@
-microsoft-copilot packaging requires `--oauth-plugin-vault-reference-id` with the Teams Entra SSO **registration / auth-config ID**.
+microsoft-copilot packaging needs a Microsoft **auth-config ID** in `OAuthPluginVault.reference_id`.
 
-That value is **not** the Entra Client (application) ID and **not** a client secret.
+AI Fabrix provisions that value with **Microsoft 365 Agents Toolkit**. Sign in with Microsoft (`atk auth login m365`), then re-run `aifabrix channel add microsoft-copilot`. Do not paste an Entra Client (application) ID or a client secret.
 
-Register Entra SSO in the Teams Developer Portal **before** packaging (no ZIP needed first): paste the values below, Save, copy the registration id, then re-run.
+Teams Developer Portal is fallback, inspection, restrictions, or recovery only — not the normal provisioning path.
 
 {{> entraSsoRegistration}}
 
-Then:
+If Toolkit cannot create the id:
 
 ```bash
-aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<Teams-Entra-SSO-registration-id>"
+aifabrix channel add microsoft-copilot --name "{{appName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
 ```
 
 Next: Developer Portal → Apps → Import app (`appPackage.<env>.zip`) → Publish to your org → Teams admin centre approval. Sideloading is optional and not the organisation path.

package/templates/channels/slack/channel.json

@@ -0,0 +1,234 @@
+{
+  "key": "slack",
+  "displayName": "Slack",
+  "description": "Chat with Role Assistants, send notifications, and review documents in Slack.",
+  "type": "custom",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "slack-app",
+      "displayName": "Slack App",
+      "method": "hmac",
+      "writeOnce": true,
+      "variables": {
+        "algorithm": "sha256",
+        "signatureHeader": "X-Slack-Signature",
+        "timestampHeader": "X-Slack-Request-Timestamp",
+        "signaturePrefix": "v0=",
+        "timestampMaxAge": "300",
+        "baseUrl": "https://slack.com",
+        "testEndpoint": "https://slack.com/api/auth.test"
+      },
+      "security": {
+        "signingSecret": "kv://slack/signingSecret",
+        "botToken": "kv://slack/botToken",
+        "clientSecret": "kv://slack/clientSecret"
+      },
+      "formFields": [
+        {
+          "name": "signingSecret",
+          "required": true,
+          "label": "Signing secret"
+        },
+        {
+          "name": "botToken",
+          "required": true,
+          "label": "Bot user OAuth token",
+          "placeholder": "xoxb-…"
+        },
+        {
+          "name": "clientSecret",
+          "required": false,
+          "label": "Client secret"
+        }
+      ]
+    }
+  },
+  "authentications": [
+    {
+      "key": "default",
+      "usage": "api",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "slack-app",
+        "displayName": "Slack App",
+        "method": "hmac",
+        "writeOnce": true,
+        "variables": {
+          "algorithm": "sha256",
+          "signatureHeader": "X-Slack-Signature",
+          "timestampHeader": "X-Slack-Request-Timestamp",
+          "signaturePrefix": "v0=",
+          "timestampMaxAge": "300",
+          "baseUrl": "https://slack.com",
+          "testEndpoint": "https://slack.com/api/auth.test"
+        },
+        "security": {
+          "signingSecret": "kv://slack/signingSecret",
+          "botToken": "kv://slack/botToken",
+          "clientSecret": "kv://slack/clientSecret"
+        },
+        "formFields": [
+          {
+            "name": "signingSecret",
+            "required": true,
+            "label": "Signing secret"
+          },
+          {
+            "name": "botToken",
+            "required": true,
+            "label": "Bot user OAuth token",
+            "placeholder": "xoxb-…"
+          },
+          {
+            "name": "clientSecret",
+            "required": false,
+            "label": "Client secret"
+          }
+        ]
+      }
+    },
+    {
+      "key": "webhookInbound",
+      "usage": "webhookInbound",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "slack-app",
+        "displayName": "Slack inbound webhook",
+        "method": "hmac",
+        "writeOnce": true,
+        "variables": {
+          "algorithm": "sha256",
+          "signatureHeader": "X-Slack-Signature",
+          "timestampHeader": "X-Slack-Request-Timestamp",
+          "signaturePrefix": "v0=",
+          "timestampMaxAge": "300"
+        },
+        "security": {
+          "signingSecret": "kv://slack/signingSecret"
+        },
+        "formFields": [
+          {
+            "name": "signingSecret",
+            "required": true,
+            "label": "Signing secret"
+          }
+        ]
+      }
+    }
+  ],
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    },
+    {
+      "name": "CHANNEL_COMMAND_PREFIX",
+      "value": "af",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "text",
+        "label": "Slash command prefix",
+        "placeholder": "Letters and numbers, for example af",
+        "validation": {
+          "pattern": "^[a-z][a-z0-9]{0,15}$"
+        }
+      }
+    },
+    {
+      "name": "ENABLE_MCP_SERVER",
+      "value": "false",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "MCP server",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_PROACTIVE_MESSAGING",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "ENABLE_CHANNEL_NOTIFICATIONS",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "ENABLE_DIRECT_MESSAGES",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "ENABLE_MODALS",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "ENABLE_SHORTCUTS",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    }
+  ],
+  "dataSources": [
+    "slack-interactive",
+    "slack-commands",
+    "slack-events",
+    "slack-conversations",
+    "slack-messages"
+  ],
+  "endpoints": [],
+  "endpointsActive": true,
+  "systemKind": "communication",
+  "channel": {
+    "definitionKey": "slack",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "maxInstances": 1,
+    "profiles": [],
+    "packaging": {
+      "channelType": "slack",
+      "templateDir": "slack",
+      "artifactFileName": "channel-slack.json",
+      "artifactFormat": "json",
+      "credentialKey": "slack-app",
+      "capabilities": [
+        "chat",
+        "notify",
+        "documentApproval"
+      ],
+      "displayLabel": "Slack",
+      "category": "communication",
+      "wizardOrder": 40,
+      "remainingManualStep": "Workspace admin approval if Slack asks.",
+      "docsAnchor": "slack",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/slack/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Slack</title><path d="M5.042 15.165a2.528 2.528 0 0 1-2.52 2.523A2.528 2.528 0 0 1 0 15.165a2.527 2.527 0 0 1 2.522-2.52h2.52v2.52zM6.313 15.165a2.527 2.527 0 0 1 2.521-2.52 2.527 2.527 0 0 1 2.521 2.52v6.313A2.528 2.528 0 0 1 8.834 24a2.528 2.528 0 0 1-2.521-2.522v-6.313zM8.834 5.042a2.528 2.528 0 0 1-2.521-2.52A2.528 2.528 0 0 1 8.834 0a2.528 2.528 0 0 1 2.521 2.522v2.52H8.834zM8.834 6.313a2.528 2.528 0 0 1 2.521 2.521 2.528 2.528 0 0 1-2.521 2.521H2.522A2.528 2.528 0 0 1 0 8.834a2.528 2.528 0 0 1 2.522-2.521h6.312zM18.956 8.834a2.528 2.528 0 0 1 2.522-2.521A2.528 2.528 0 0 1 24 8.834a2.528 2.528 0 0 1-2.522 2.521h-2.522V8.834zM17.688 8.834a2.528 2.528 0 0 1-2.523 2.521 2.527 2.527 0 0 1-2.52-2.521V2.522A2.527 2.527 0 0 1 15.165 0a2.528 2.528 0 0 1 2.523 2.522v6.312zM15.165 18.956a2.528 2.528 0 0 1 2.523 2.522A2.528 2.528 0 0 1 15.165 24a2.527 2.527 0 0 1-2.52-2.522v-2.522h2.52zM15.165 17.688a2.527 2.527 0 0 1-2.52-2.523 2.526 2.526 0 0 1 2.52-2.52h6.313A2.527 2.527 0 0 1 24 15.165a2.528 2.528 0 0 1-2.522 2.523h-6.313z"/></svg>

package/templates/channels/slack/install.template.md.hbs

@@ -1,21 +1,61 @@
-# {{appName}} — Slack communication channel install
+# {{appName}} — Slack install
 
 {{appDescription}}
 
-Environment: **{{environment}}** · Credential key: `{{credentialKey}}` · Command prefix: `{{commandPrefix}}`
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}` · Command prefix: `{{commandPrefix}}` · Package version: **{{packageVersion}}**
 
 One Slack app delivers **Role Assistant** chat, **Work hub** shortcuts, and **document approval**.
 
 **Chat with your assistant:** DM this app (no slash command for Q&A).
 
-## Create the Slack app (workspace admin)
+## Automated install
+
+```bash
+aifabrix channel add {{channelTarget}} --name "{{baseName}}"
+```
+
+Sign in with Slack CLI (`slack login`) to the workspace that should own the app. Builder creates or **updates** the Slack app from the generated manifest (`dist/channels/slack/channel-slack.json`) and stores the bot token and signing secret in AI Fabrix Authentication. Re-run with the same name to apply new settings (slash prefix, URLs, description). Package version increases on each update (1.0.0 → 1.1.0). Approve the workspace install when Slack asks.
+
+Complete remaining Slack steps in this order:
+
+1. Open the **Open Slack Apps** URL and upload your logo (**Basic Information**).
+2. Open the **Activate the application** URL (Slack **Install App**).
+3. Open **Approve for this workspace** in Slack Manage and approve.
+4. If Authentication still needs values, copy **Signing Secret** (Basic Information) and **Bot User OAuth Token** from the Slack app into [Authentication settings]({{{credentialPortalUrl}}}).
+
+`aifabrix channel add` prints the filled URLs for your app. Do not paste client secrets into this file.
+
+{{#if enableMcpServer}}
+## MCP server
+
+This Slack app is also an MCP client of AI Fabrix Runtime. Connect the **AI Fabrix MCP server** in Slack, then sign in at **AI Fabrix** when Slack asks.
+
+The Slack bot token and signing secret stay inbound Events and slash-command auth. They are not the MCP bearer. Do not paste an Integration Client secret into this file.
+
+{{/if}}
+
+The command may ask **Onboard users?** Yes matches Slack profile email to an existing platform user email and stores the mapping. Unmatched people still use **Link account**. Non-interactive: `--onboard-users` or `--no-onboard-users`. `--force` does not re-onboard unless you pass `--onboard-users` or answer yes again.
+
+Optional validation:
+
+```bash
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
+```
+
+To use a different slash prefix (default `af`):
+
+```bash
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --command-prefix <key>
+```
+
+## Recovery (only if automation cannot create the app)
 
 1. Open [Slack API — Your Apps](https://api.slack.com/apps) and sign in as a workspace admin.
 2. Click **Create New App** → **From an app manifest**.
 3. Select your workspace, then paste or upload the generated manifest JSON from `dist/channels/slack/channel-slack.json` (same folder as this file).
 4. Review callback URLs and OAuth scopes — they must match the values in **Platform callback URLs** below.
 5. Confirm **App Home → Messages tab** is **ON** in the manifest (required for bot DMs and proactive notifications; slash commands work without it).
-6. Click **Create**, then open **Install App** → **Install to Workspace** and approve.
+6. Click **Create**, then open the **Activate the application** URL the command prints (Slack **Install App** / `install-on-team`) and approve.
 7. Copy **Bot User OAuth Token** and **Signing Secret** from the Slack app settings.
 8. Save **Bot User OAuth Token** and **Signing Secret** in AI Fabrix: [Authentication settings]({{{credentialPortalUrl}}})
 
@@ -32,11 +72,6 @@ Configure these in your Slack app if you edit settings manually. Do not embed se
 {{#if commandUrl}}
 - **Slash commands:** {{commandUrl}}
 {{/if}}
-{{#if oauthCallbackUrl}}
-- **OAuth Redirect URL:** {{oauthCallbackUrl}}
-{{/if}}
-
-Paste the **OAuth Redirect URL** into Slack app settings → **OAuth & Permissions** → **Redirect URLs** (required for Add to Slack / OAuth).
 
 Register these **V1** slash commands in the manifest (all use the same request URL):
 
@@ -51,7 +86,7 @@ Single-task and single-document detail, plus approve-in-Slack, are **not** regis
 
 Document review **block actions** use the **Interactivity** URL above.
 
-## Validate after manifest import
+## Validate after install
 
 1. `/{{commandPrefix}}-help` — returns Block Kit help (proves command is registered and dataplane responds).
 2. `/{{commandPrefix}}-assistants` — Role Assistant status cards or activation offer.
@@ -64,21 +99,3 @@ Document review **block actions** use the **Interactivity** URL above.
 Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
-
-## After Slack install
-
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}"
-```
-
-Optional validation:
-
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
-```
-
-To use a different slash prefix (default `af`):
-
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --command-prefix <key>
-```