@aifabrix/builder 2.54.1 → 2.55.0

package/lib/channels/slack-channel-add.js

@@ -21,6 +21,7 @@ const {
   maybeOnboardSlackUsers,
   unmatchedRemainingStep
 } = require('./slack-provisioning/onboard');
+const { registerSlackMcpCallback, slackMcpProfileUrl } = require('./slack-mcp-callback');
 
 /**
  * @param {Error} error
@@ -223,36 +224,88 @@ async function recoverOrRefreshAuth(error, params, options, deps, ctx, projectRo
  * @param {Object} params
  * @returns {Promise<Object|null>}
  */
-async function maybeProvisionSlackChannel(params) {
-  if (!params || params.channelTarget !== 'slack') {
+async function maybeRegisterSlackMcpCallback(params) {
+  const runtime = params && params.runtimeValues;
+  const ctx = params && params.ctx;
+  if (!runtime || !runtime.enableMcpServer) {
     return null;
   }
-  if (params.options && params.options.dryRun === true) {
+  if (!ctx || !ctx.controllerUrl || !ctx.authConfig) {
+    return {
+      ok: false,
+      fallback: true,
+      remaining: ['Open the OAuth2 profile and add the Slack MCP callback URL']
+    };
+  }
+  try {
+    const result = await registerSlackMcpCallback({ ctx, ...(params.slackMcpCallbackDeps || {}) });
+    if (result && result.fallback) {
+      const profileUrl = result.profileUrl || slackMcpProfileUrl(ctx);
+      return {
+        ok: false,
+        fallback: true,
+        remaining: [`Open ${profileUrl} and add the Slack MCP callback URL`]
+      };
+    }
+    return result;
+  } catch (error) {
+    return {
+      ok: false,
+      fallback: true,
+      remaining: [error && error.message ? error.message : 'Slack MCP callback could not be registered']
+    };
+  }
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeProvisionSlackChannel(params) {
+  if (!params || params.channelTarget !== 'slack' || (params.options && params.options.dryRun === true)) {
     return null;
   }
   const ctx = params.ctx || {};
   const options = params.options || {};
   const deps = slackDepsFromOptions(options);
   const projectRoot = options.projectRoot || process.cwd();
+  const mcpCallback = await maybeRegisterSlackMcpCallback(params);
   if (options.quiet === true) {
     const portal = await preparePortalSlackAuth(options, deps);
     if (portal.waiting) {
       await publishSlackAfterSecrets({ connected: false }, options, deps);
-      return portal.result;
+      return attachSlackMcpRemaining(portal.result, mcpCallback);
     }
   }
   try {
     if (options.quiet !== true) {
       await ensureSlackCliReady(options, deps);
     }
-    return await provisionAndPublish(params, options, deps, ctx, projectRoot);
+    const result = await provisionAndPublish(params, options, deps, ctx, projectRoot);
+    return attachSlackMcpRemaining(result, mcpCallback);
   } catch (error) {
-    return recoverOrRefreshAuth(error, params, options, deps, ctx, projectRoot);
+    const recovered = await recoverOrRefreshAuth(error, params, options, deps, ctx, projectRoot);
+    return attachSlackMcpRemaining(recovered, mcpCallback);
+  }
+}
+
+/**
+ * @param {Object|null} result
+ * @param {Object|null} mcpCallback
+ * @returns {Object|null}
+ */
+function attachSlackMcpRemaining(result, mcpCallback) {
+  const extra = mcpCallback && Array.isArray(mcpCallback.remaining) ? mcpCallback.remaining : [];
+  if (extra.length === 0) {
+    return result;
   }
+  const base = result && typeof result === 'object' ? result : {};
+  return { ...base, remaining: [...(base.remaining || []), ...extra] };
 }
 
 module.exports = {
   maybeProvisionSlackChannel,
+  maybeRegisterSlackMcpCallback,
   applySlackOnboardToCtx,
   remainingFromError
 };

package/lib/channels/slack-mcp-callback.js

@@ -0,0 +1,51 @@
+/**
+ * Allowlist Slack MCP OAuth callback on the existing customerOAuth client.
+ *
+ * @fileoverview Reuse ChatGPT Integration Client; never rotate the secret
+ */
+
+'use strict';
+
+const {
+  registerChatGptCallbackUrls,
+  chatgptProfileUrl
+} = require('./chatgpt-callback');
+const {
+  CHATGPT_INTEGRATION_CLIENT_KEY,
+  CHATGPT_OAUTH2_PROFILE_ID,
+  CHATGPT_OAUTH2_PROFILE_PATH
+} = require('./chatgpt-runtime-contract');
+const { SLACK_MCP_CALLBACK_URI } = require('./slack-mcp-runtime');
+
+const SLACK_MCP_CALLBACK_CONTRACT = {
+  integrationClientKey: CHATGPT_INTEGRATION_CLIENT_KEY,
+  oauth2ProfileId: CHATGPT_OAUTH2_PROFILE_ID,
+  oauth2ProfilePath: CHATGPT_OAUTH2_PROFILE_PATH,
+  vendorLabel: 'Slack MCP'
+};
+
+/**
+ * @param {Object} ctx
+ * @returns {string}
+ */
+function slackMcpProfileUrl(ctx) {
+  return chatgptProfileUrl(ctx, SLACK_MCP_CALLBACK_CONTRACT);
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function registerSlackMcpCallback(params) {
+  return registerChatGptCallbackUrls({
+    ...params,
+    callbackUrls: [SLACK_MCP_CALLBACK_URI],
+    contract: SLACK_MCP_CALLBACK_CONTRACT
+  });
+}
+
+module.exports = {
+  SLACK_MCP_CALLBACK_CONTRACT,
+  slackMcpProfileUrl,
+  registerSlackMcpCallback
+};

package/lib/channels/slack-mcp-runtime.js

@@ -0,0 +1,156 @@
+/**
+ * Slackbot MCP Client packaging (opt-in). Auth freeze: manual_auth.
+ *
+ * @fileoverview Slack MCP manifest fields from discovery; HMAC path stays default
+ */
+
+'use strict';
+
+const SLACK_MCP_AUTH_TYPE = 'manual_auth';
+const SLACK_MCP_AUTH_PROVIDER_KEY = 'mcp_aifabrix';
+const SLACK_MCP_SERVER_KEY = 'runtime-orchestration';
+const SLACK_MCP_CALLBACK_URI = 'https://oauth2.slack.com/external/auth/callback';
+const SLACK_MCP_OAUTH_SCOPES = ['openid', 'profile', 'email', 'offline_access'];
+const SLACK_MCP_CAPABILITY = 'customerOAuth';
+const SLACK_MCP_MISSING_URL = 'Runtime MCP URL is missing.';
+
+/**
+ * @param {string} [controllerUrl]
+ * @param {string} [mcpUrl]
+ * @param {string} [dataplaneBaseUrl]
+ * @returns {string}
+ */
+function authorizationServerBase(controllerUrl, mcpUrl, dataplaneBaseUrl) {
+  const candidate = controllerUrl || mcpUrl || dataplaneBaseUrl;
+  try {
+    return `${new URL(candidate).origin}/auth/realms/aifabrix`;
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string} asBase
+ * @returns {{ authorizationUrl: string, tokenUrl: string }}
+ */
+function keycloakEndpoints(asBase) {
+  if (!asBase) {
+    return { authorizationUrl: '', tokenUrl: '' };
+  }
+  return {
+    authorizationUrl: `${asBase}/protocol/openid-connect/auth`,
+    tokenUrl: `${asBase}/protocol/openid-connect/token`
+  };
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {void}
+ */
+function clearSlackMcpPackaging(resolved) {
+  resolved.slackMcpAuthType = '';
+  resolved.slackMcpAuthProviderKey = '';
+  resolved.slackMcpCallbackUri = '';
+  resolved.slackMcpCapability = '';
+  resolved.slackMcpServersJson = '';
+  resolved.slackExternalAuthJson = '';
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {boolean}
+ */
+function selectsCustomerOAuth(resolved) {
+  const caps = resolved.discoveryAuthenticationCapabilities;
+  if (!Array.isArray(caps) || caps.length === 0) {
+    return true;
+  }
+  return caps.includes(SLACK_MCP_CAPABILITY);
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @param {string} mcpUrl
+ * @returns {Object}
+ */
+function buildExternalAuthProviders(resolved, params, mcpUrl) {
+  const asBase = authorizationServerBase(
+    params && params.controllerUrl,
+    mcpUrl,
+    resolved.dataplaneBaseUrl
+  );
+  const endpoints = keycloakEndpoints(asBase);
+  const provider = {
+    authorization_url: endpoints.authorizationUrl,
+    token_url: endpoints.tokenUrl,
+    scope: SLACK_MCP_OAUTH_SCOPES,
+    use_pkce: true,
+    identity_config: null
+  };
+  const clientId =
+    typeof resolved.slackMcpClientId === 'string' ? resolved.slackMcpClientId.trim() : '';
+  if (clientId) {
+    provider.client_id = clientId;
+  }
+  return { oauth2: { [SLACK_MCP_AUTH_PROVIDER_KEY]: provider } };
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} [params]
+ * @returns {void}
+ */
+function applySlackMcpRuntimeValues(resolved, params) {
+  if (!resolved.enableMcpServer) {
+    clearSlackMcpPackaging(resolved);
+    return;
+  }
+  const mcpUrl = typeof resolved.mcpUrl === 'string' ? resolved.mcpUrl.trim() : '';
+  if (!mcpUrl) {
+    throw new Error(SLACK_MCP_MISSING_URL);
+  }
+  if (!selectsCustomerOAuth(resolved)) {
+    throw new Error('Slack MCP requires customerOAuth on Runtime discovery.');
+  }
+  resolved.slackMcpAuthType = SLACK_MCP_AUTH_TYPE;
+  resolved.slackMcpAuthProviderKey = SLACK_MCP_AUTH_PROVIDER_KEY;
+  resolved.slackMcpCallbackUri = SLACK_MCP_CALLBACK_URI;
+  resolved.slackMcpCapability = SLACK_MCP_CAPABILITY;
+  resolved.slackMcpServersJson = JSON.stringify({
+    [SLACK_MCP_SERVER_KEY]: {
+      url: mcpUrl,
+      auth_type: SLACK_MCP_AUTH_TYPE,
+      auth_provider_key: SLACK_MCP_AUTH_PROVIDER_KEY
+    }
+  });
+  resolved.slackExternalAuthJson = JSON.stringify(
+    buildExternalAuthProviders(resolved, params || {}, mcpUrl)
+  );
+}
+
+/**
+ * @param {Object} [runtimeValues]
+ * @returns {string[]}
+ */
+function slackMcpRemainingSteps(runtimeValues) {
+  if (!runtimeValues || !runtimeValues.enableMcpServer) {
+    return [];
+  }
+  return [
+    'Connect the AI Fabrix MCP server in Slack',
+    'Complete sign-in at AI Fabrix when Slack asks'
+  ];
+}
+
+module.exports = {
+  SLACK_MCP_AUTH_TYPE,
+  SLACK_MCP_AUTH_PROVIDER_KEY,
+  SLACK_MCP_SERVER_KEY,
+  SLACK_MCP_CALLBACK_URI,
+  SLACK_MCP_OAUTH_SCOPES,
+  SLACK_MCP_CAPABILITY,
+  SLACK_MCP_MISSING_URL,
+  applySlackMcpRuntimeValues,
+  slackMcpRemainingSteps
+};

package/lib/channels/slack-provisioning/install-cli.js

@@ -179,6 +179,19 @@ function fetchHttpsText(url, redirects = 0) {
   });
 }
 
+/**
+ * Drop Node's version footer; prefer an Error: line when present.
+ * @param {string} text
+ * @returns {string}
+ */
+function lastUsefulInstallLine(text) {
+  const lines = text.split('\n').map((line) => line.trim()).filter(Boolean);
+  const withoutNode = lines.filter((line) => !/^Node\.js v\d/i.test(line));
+  const pool = withoutNode.length ? withoutNode : lines;
+  const errorLine = [...pool].reverse().find((line) => /^Error:/i.test(line));
+  return errorLine || pool[pool.length - 1] || '';
+}
+
 /**
  * Prefer child stderr over Node's "Command failed: bash /tmp/…" wrapper.
  * @param {unknown} error
@@ -190,8 +203,7 @@ function slackCliInstallFailureMessage(error) {
   const raw = error && error.message ? String(error.message) : '';
   const fromChild = stderr || stdout;
   if (fromChild) {
-    const lines = fromChild.split('\n').map((line) => line.trim()).filter(Boolean);
-    return lines[lines.length - 1] || fromChild;
+    return lastUsefulInstallLine(fromChild) || fromChild;
   }
   const stripped = raw.replace(/^Command failed: bash \S+\s*/i, '').trim();
   return stripped || 'Slack CLI install failed.';

package/lib/channels/slack-provisioning/with-curl-on-path.js

@@ -22,7 +22,12 @@ async function curlExists(env) {
 }
 
 function writeCurlShim(dir) {
-  const runtime = path.join(__dirname, 'curl-shim.js');
+  const source = path.join(__dirname, 'curl-shim.js');
+  if (!fs.existsSync(source)) {
+    throw new Error(`Slack CLI curl shim missing: ${source}`);
+  }
+  const runtime = path.join(dir, 'curl-shim.js');
+  fs.copyFileSync(source, runtime);
   const wrapper = `#!/bin/sh\nexec "${process.execPath}" "${runtime}" "$@"\n`;
   fs.writeFileSync(path.join(dir, 'curl'), wrapper, { mode: 0o755 });
 }

package/lib/cli/index.js

@@ -25,9 +25,11 @@ const { setupDimensionCommands } = require('../commands/dimension');
 const { setupResourceTypeCommands } = require('../commands/resource-type');
 const { setupRoleCommands } = require('../commands/role');
 const { setupRoleAssistantCommands } = require('../commands/role-assistant');
+const { setupSearchCommands } = require('../commands/search');
 const { setupEvidenceKindCommands } = require('../commands/evidence-kind');
 const { setupEnterpriseKnowledgeCommands } = require('../commands/enterprise-knowledge');
 const { setupIdentityCommands } = require('../commands/identity');
+const { setupAgentKitCommands } = require('../commands/agent-kit');
 const { setupProtectionCommands } = require('../commands/protection');
 const { setupEvidenceCommands } = require('../commands/evidence');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
@@ -80,9 +82,11 @@ function setupExtendedCliCommands(program) {
   setupResourceTypeCommands(program);
   setupRoleCommands(program);
   setupRoleAssistantCommands(program);
+  setupSearchCommands(program);
   setupEvidenceKindCommands(program);
   setupEnterpriseKnowledgeCommands(program);
   setupIdentityCommands(program);
+  setupAgentKitCommands(program);
   setupProtectionCommands(program);
   setupEvidenceCommands(program);
   setupUtilityCommands(program);

package/lib/cli/setup-certification-commands.js

@@ -20,7 +20,7 @@ function setupVerifyOperationsCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Readiness breakdown and verification step checklist')
     .option('-d, --debug', 'Write debug logs under integration/<systemKey>/logs/')
-    .option('--no-publish', 'Skip publishing local integration files before dataplane steps')
+    .option('--no-publish', 'Skip uploading local files (verify-operations does not upload by default)')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'
@@ -39,7 +39,7 @@ function setupVerifyTrustCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Per-datasource breakdown')
     .option('-d, --debug', 'Write debug log under integration/<systemKey>/logs/')
-    .option('--no-publish', 'Skip publishing local integration files before validate')
+    .option('--no-publish', 'Skip uploading local files (verify-trust does not upload by default)')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'

package/lib/cli/setup-certification.help.js

@@ -12,6 +12,8 @@ Examples:
 
 Notes:
   - Orchestrates validate → test → test-integration → test-e2e for the system.
+  - Does not upload. Upload is not publish; run aifabrix deploy to publish.
+  - Static custom packages (syncBridge disabled) skip live E2E (not FAILED).
   - Default output shows Operational Readiness % and OPERATIONS VERIFIED/FAILED only.
   - -v / --verbose adds readiness breakdown and verification step checklist at the end.
   - -v does not enable upload sidecar logs or inner E2E poll spinners (use aifabrix upload -v for upload detail).
@@ -28,7 +30,7 @@ Examples:
 Notes:
   - For one datasource: aifabrix datasource verify-trust <datasourceKey>
   - Does not call external vendor APIs (use verify-operations / test-e2e for connectivity).
-  - Local integration files are published before run unless --no-publish.
+  - Does not upload. Upload is not publish; run aifabrix deploy to publish.
 `;
 
 const VERIFY_GOVERNANCE_HELP_AFTER = `

package/lib/commands/agent-kit-help.js

@@ -0,0 +1,79 @@
+/**
+ * Help text for `aifabrix agent-kit` leaves.
+ * @fileoverview Per-command examples so update -h is not install-centric
+ */
+
+'use strict';
+
+const GROUP_HELP = `
+Examples:
+  $ aifabrix agent-kit init cust-demo --host all --approve-all --yes
+  $ aifabrix agent-kit install --host all --approve-all --yes
+  $ aifabrix agent-kit update --host all --approve-all --yes
+  $ aifabrix agent-kit status
+  $ aifabrix agent-kit validate
+`;
+
+const INSTALL_HELP = `
+Examples:
+  $ aifabrix agent-kit install
+  $ aifabrix agent-kit install --host all --approve-all --yes
+  $ aifabrix agent-kit install --host claude --approve-all --yes
+  $ aifabrix agent-kit install --skip-approve-all
+  $ aifabrix agent-kit install --dry-run
+
+TTY asks to auto-approve Claude Code and Codex permissions (default yes). Silent: --approve-all --yes. Skip: --skip-approve-all.
+`;
+
+const STATUS_HELP = `
+Examples:
+  $ aifabrix agent-kit status
+  $ aifabrix agent-kit status --json
+`;
+
+const UPDATE_HELP = `
+Examples:
+  $ aifabrix agent-kit update
+  $ aifabrix agent-kit update --host all --approve-all --yes
+  $ aifabrix agent-kit update --host claude --force
+  $ aifabrix agent-kit update --dry-run
+
+Omit --host to keep the coding hosts already recorded. Pass --host when you add or switch Cursor, Claude Code, or Codex.
+`;
+
+const VALIDATE_HELP = `
+Examples:
+  $ aifabrix agent-kit validate
+  $ aifabrix agent-kit validate --json
+`;
+
+const INIT_HELP = `
+Examples:
+  $ aifabrix agent-kit init cust-demo
+  $ aifabrix agent-kit init cust-demo --host all --approve-all --yes
+  $ aifabrix agent-kit init cust-demo --host all --remote --org my-org --yes
+  $ aifabrix agent-kit init ./path/to/cust-demo --dry-run --json
+
+Interactive (TTY): omit --host / --yes to be prompted.
+Silent local: --host all --approve-all --yes
+Silent remote: --host all --remote --org <owner> --yes
+`;
+
+const REMOTE_HELP = `
+Examples:
+  $ cd cust-demo && aifabrix agent-kit remote create
+  $ aifabrix agent-kit remote create --org my-org --yes
+  $ aifabrix agent-kit remote create --org my-org --dry-run --json
+
+Interactive (TTY): omit flags to be prompted. Silent: --org <owner> --yes
+`;
+
+module.exports = {
+  GROUP_HELP,
+  INSTALL_HELP,
+  STATUS_HELP,
+  UPDATE_HELP,
+  VALIDATE_HELP,
+  INIT_HELP,
+  REMOTE_HELP
+};