@andreprado/agentkit 0.1.0-alpha.9 → 0.1.0

package/src/runtime/channels/slack.ts

@@ -0,0 +1,646 @@
+import type {
+  ChannelAdapter,
+  ChannelSendInput,
+  ChannelSendResult,
+  NormalizedChannelEvent,
+  RawWebhookEvent,
+  WebhookVerificationResult,
+} from "../channels";
+import { AgentKitError } from "../errors";
+
+const SLACK_API_BASE_URL = "https://slack.com/api";
+const SLACK_SIGNATURE_VERSION = "v0";
+const SLACK_REPLAY_WINDOW_SECONDS = 60 * 5;
+
+export const slackChannelAdapter: ChannelAdapter = {
+  type: "slack",
+  provider: "slack",
+  requiredSecrets: ["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"],
+  async verifyWebhook(input): Promise<WebhookVerificationResult> {
+    return verifySlackWebhook(input);
+  },
+  getWebhookResponse(input) {
+    const body = parseJsonObject(input);
+
+    if (readString(body, "type") !== "url_verification") {
+      return null;
+    }
+
+    const challenge = readString(body, "challenge");
+
+    if (!challenge) {
+      throw new AgentKitError("channel_payload_invalid", "Slack url_verification payload is missing challenge.");
+    }
+
+    return {
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+      },
+      body: challenge,
+    };
+  },
+  normalizeInbound(input) {
+    const body = parseJsonObject(input);
+    const envelopeType = readString(body, "type");
+
+    if (envelopeType === "url_verification") {
+      return [];
+    }
+
+    const providerEventId = readString(body, "event_id");
+    const teamId = readString(body, "team_id") ?? "unknown";
+
+    if (envelopeType === "app_rate_limited") {
+      const minute = readNumber(body, "minute_rate_limited");
+
+      return [
+        {
+          ...slackBaseEvent(input, {
+            providerEventId: providerEventId ?? `rate_limited:${teamId}:${minute ?? input.receivedAt}`,
+            teamId,
+          }),
+          kind: "unsupported",
+          unsupportedReason: "slack_app_rate_limited",
+          providerMetadata: {
+            envelopeType,
+            ...(minute !== undefined ? { minuteRateLimited: minute } : {}),
+          },
+        },
+      ];
+    }
+
+    if (envelopeType !== "event_callback") {
+      return [
+        {
+          ...slackBaseEvent(input, {
+            providerEventId: providerEventId ?? `unsupported:${teamId}:${input.receivedAt}`,
+            teamId,
+          }),
+          kind: "unsupported",
+          unsupportedReason: `unsupported_envelope_type:${envelopeType ?? "unknown"}`,
+          providerMetadata: {
+            envelopeType,
+          },
+        },
+      ];
+    }
+
+    if (!providerEventId) {
+      throw new AgentKitError("channel_payload_invalid", "Slack event_callback payload is missing event_id.");
+    }
+
+    const event = readRecord(body, "event");
+    const eventType = readString(event, "type");
+    const subtype = readString(event, "subtype");
+    const botId = readString(event, "bot_id");
+    const channelId = readString(event, "channel");
+    const userId = readString(event, "user");
+    const text = readString(event, "text");
+    const messageTs = readString(event, "ts");
+    const threadTs = readString(event, "thread_ts");
+    const channelType = readString(event, "channel_type");
+    const isDirectMessage = eventType === "message" && channelType === "im";
+    const isAppMention = eventType === "app_mention";
+    const base = slackBaseEvent(input, {
+      providerEventId,
+      teamId,
+      channelId,
+      userId,
+      threadTs: isDirectMessage ? undefined : threadTs ?? messageTs,
+    });
+
+    if (subtype || botId) {
+      return [];
+    }
+
+    if (!isAppMention && !isDirectMessage) {
+      return [
+        {
+          ...base,
+          kind: "unsupported",
+          unsupportedReason: `unsupported_event_type:${eventType ?? "unknown"}`,
+          providerMetadata: slackProviderMetadata(body, event),
+        },
+      ];
+    }
+
+    if (!channelId || !userId || !messageTs || text === undefined) {
+      throw new AgentKitError("channel_payload_invalid", "Slack message event is missing channel, user, ts, or text.");
+    }
+
+    const content = isAppMention ? stripSlackBotMention(text) : text.trim();
+
+    if (!content) {
+      return [
+        {
+          ...base,
+          kind: "unsupported",
+          unsupportedReason: "empty_message",
+          providerMetadata: slackProviderMetadata(body, event),
+        },
+      ];
+    }
+
+    return [
+      {
+        ...base,
+        kind: "message",
+        providerMetadata: slackProviderMetadata(body, event),
+        replyTarget: {
+          type: "slack_message",
+          channelId,
+          messageTs,
+          ...(threadTs || isAppMention ? { threadTs: threadTs ?? messageTs } : {}),
+        },
+        message: {
+          role: "user",
+          contentType: "text",
+          content,
+          providerMessageId: messageTs,
+        },
+      },
+    ];
+  },
+  async sendMessage(input) {
+    return sendSlackMessage(input);
+  },
+  getStatus(input) {
+    if (!input.secrets.SLACK_BOT_TOKEN) {
+      return {
+        status: "needs_setup",
+        checkedAt: new Date().toISOString(),
+        message: "Secret SLACK_BOT_TOKEN is missing.",
+      };
+    }
+
+    if (!input.secrets.SLACK_SIGNING_SECRET) {
+      return {
+        status: "needs_setup",
+        checkedAt: new Date().toISOString(),
+        message: "Secret SLACK_SIGNING_SECRET is missing.",
+      };
+    }
+
+    return {
+      status: "waiting_for_provider_event",
+      checkedAt: new Date().toISOString(),
+      message: "Paste the AgentKit webhook URL into the Slack app Event Subscriptions Request URL.",
+    };
+  },
+};
+
+export type SlackPostMessageRequest = {
+  method: "POST";
+  url: string;
+  headers: {
+    Authorization: string;
+    "Content-Type": "application/json";
+  };
+  body: {
+    channel: string;
+    text: string;
+    thread_ts?: string;
+    mrkdwn: boolean;
+    parse: "none";
+    link_names: boolean;
+    unfurl_links: boolean;
+    unfurl_media: boolean;
+  };
+  idempotencyKey: string;
+};
+
+type SlackFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export function buildSlackPostMessageRequest(input: ChannelSendInput): SlackPostMessageRequest {
+  return buildSlackPostMessageRequestInternal(input, {
+    redactToken: true,
+  });
+}
+
+export async function sendSlackMessage(
+  input: ChannelSendInput,
+  fetcher: SlackFetch = fetch,
+): Promise<ChannelSendResult> {
+  if (input.replyTarget?.type !== "slack_message") {
+    return {
+      ok: false,
+      retryable: false,
+      code: "channel_send_failed",
+      message: "Slack sendMessage requires a Slack message reply target.",
+    };
+  }
+
+  if (input.secrets.AGENTKIT_CHANNEL_SEND_DRY_RUN === "1") {
+    try {
+      const request = buildSlackPostMessageRequest(input);
+
+      return {
+        ok: true,
+        status: "stubbed",
+        providerRequestId: request.idempotencyKey,
+        providerMetadata: {
+          method: request.method,
+          url: request.url,
+          headers: request.headers,
+          body: request.body,
+        },
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        retryable: false,
+        code: "channel_send_failed",
+        message: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  if (!input.secrets.SLACK_BOT_TOKEN) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "channel_secret_missing",
+      message: "Secret SLACK_BOT_TOKEN is not set for this channel.",
+    };
+  }
+
+  let request: SlackPostMessageRequest;
+  let actualRequest: SlackPostMessageRequest;
+
+  try {
+    request = buildSlackPostMessageRequest(input);
+    actualRequest = buildSlackPostMessageRequestInternal(input, {
+      redactToken: false,
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "channel_send_failed",
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+
+  let response: Response;
+
+  try {
+    response = await fetcher(actualRequest.url, {
+      method: actualRequest.method,
+      headers: actualRequest.headers,
+      body: JSON.stringify(actualRequest.body),
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      retryable: true,
+      code: "channel_provider_unavailable",
+      message: `Slack chat.postMessage request failed before a response: ${redactSlackToken(
+        error instanceof Error ? error.message : String(error),
+        input.secrets.SLACK_BOT_TOKEN,
+      )}`,
+      providerRequestId: request.idempotencyKey,
+      providerMetadata: {
+        method: request.method,
+        url: request.url,
+        headers: request.headers,
+        body: request.body,
+      },
+    };
+  }
+
+  const payload = await response.json().catch(() => null);
+  const retryAfter = response.headers.get("retry-after") ?? undefined;
+
+  if (!response.ok || !isRecord(payload) || payload.ok !== true) {
+    return {
+      ok: false,
+      retryable: response.status === 429 || response.status >= 500,
+      code: response.status === 429 || response.status >= 500 ? "channel_provider_unavailable" : "channel_send_failed",
+      message: redactSlackToken(readSlackErrorMessage(payload, response.status), input.secrets.SLACK_BOT_TOKEN),
+      providerRequestId: request.idempotencyKey,
+      providerMetadata: {
+        method: request.method,
+        url: request.url,
+        status: response.status,
+        ...(retryAfter ? { retryAfter } : {}),
+        headers: request.headers,
+        body: request.body,
+      },
+    };
+  }
+
+  const providerMessageId = readString(payload, "ts");
+
+  if (!providerMessageId) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "channel_send_failed",
+      message: "Slack chat.postMessage did not return ts.",
+      providerRequestId: request.idempotencyKey,
+      providerMetadata: {
+        method: request.method,
+        url: request.url,
+        status: response.status,
+        headers: request.headers,
+        body: request.body,
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    status: "sent",
+    providerRequestId: request.idempotencyKey,
+    providerMessageId,
+    providerMetadata: {
+      method: request.method,
+      url: request.url,
+      status: response.status,
+      headers: request.headers,
+      body: request.body,
+    },
+  };
+}
+
+export async function verifySlackWebhook(input: {
+  headers: Headers;
+  rawBody: string;
+  secrets: Record<string, string>;
+}): Promise<WebhookVerificationResult> {
+  const signingSecret = input.secrets.SLACK_SIGNING_SECRET;
+
+  if (!signingSecret) {
+    return {
+      ok: false,
+      code: "channel_secret_missing",
+      message: "Secret SLACK_SIGNING_SECRET is not set for this channel.",
+    };
+  }
+
+  const signature = input.headers.get("x-slack-signature");
+  const timestamp = input.headers.get("x-slack-request-timestamp");
+
+  if (!signature || !timestamp) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack signature headers are missing.",
+    };
+  }
+
+  const timestampSeconds = Number(timestamp);
+
+  if (!Number.isInteger(timestampSeconds)) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack request timestamp is invalid.",
+    };
+  }
+
+  if (Math.abs(Math.floor(Date.now() / 1000) - timestampSeconds) > SLACK_REPLAY_WINDOW_SECONDS) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack request timestamp is outside the allowed replay window.",
+    };
+  }
+
+  if (!signature.startsWith(`${SLACK_SIGNATURE_VERSION}=`)) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack request signature version is unsupported.",
+    };
+  }
+
+  const signatureBytes = hexToBytes(signature.slice(`${SLACK_SIGNATURE_VERSION}=`.length));
+
+  if (!signatureBytes || signatureBytes.byteLength !== 32) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack request signature is not valid hex.",
+    };
+  }
+
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(signingSecret),
+    {
+      name: "HMAC",
+      hash: "SHA-256",
+    },
+    false,
+    ["verify"],
+  );
+  const signedBody = encoder.encode(`${SLACK_SIGNATURE_VERSION}:${timestamp}:${input.rawBody}`);
+  const ok = await crypto.subtle.verify("HMAC", key, bytesToArrayBuffer(signatureBytes), bytesToArrayBuffer(signedBody));
+
+  if (!ok) {
+    return {
+      ok: false,
+      code: "channel_signature_invalid",
+      message: "Slack request signature did not match.",
+    };
+  }
+
+  return { ok: true };
+}
+
+function buildSlackPostMessageRequestInternal(
+  input: ChannelSendInput,
+  options: { redactToken: boolean },
+): SlackPostMessageRequest {
+  if (input.replyTarget?.type !== "slack_message") {
+    throw new Error("Slack sendMessage requires a Slack message reply target.");
+  }
+
+  const token = options.redactToken ? "<redacted>" : input.secrets.SLACK_BOT_TOKEN;
+
+  if (!token) {
+    throw new AgentKitError("channel_secret_missing", "Secret SLACK_BOT_TOKEN is not set for this channel.");
+  }
+
+  const baseUrl = input.secrets.AGENTKIT_SLACK_API_BASE_URL ?? SLACK_API_BASE_URL;
+  const url = new URL("/api/chat.postMessage", baseUrl);
+  const target = input.replyTarget;
+  const threadTs = target.threadTs;
+
+  return {
+    method: "POST",
+    url: url.href,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: {
+      channel: target.channelId,
+      text: sanitizeSlackOutboundText(input.message.content),
+      ...(threadTs ? { thread_ts: threadTs } : {}),
+      mrkdwn: true,
+      parse: "none",
+      link_names: false,
+      unfurl_links: false,
+      unfurl_media: false,
+    },
+    idempotencyKey: `slack:${input.channelId}:${input.conversationId}:${target.channelId}:${threadTs ?? target.messageTs}`,
+  };
+}
+
+function slackBaseEvent(
+  input: RawWebhookEvent,
+  options: {
+    providerEventId: string;
+    teamId: string;
+    channelId?: string;
+    userId?: string;
+    threadTs?: string;
+  },
+): Omit<NormalizedChannelEvent, "kind"> {
+  const identity = options.channelId
+    ? options.threadTs
+      ? {
+          key: `slack:team:${options.teamId}:channel:${options.channelId}:thread:${options.threadTs}`,
+          display: `slack:team:${options.teamId}:channel:${options.channelId}:thread:${options.threadTs}`,
+          redactedDisplay: `slack:team:${redactSlackId(options.teamId)}:channel:${redactSlackId(
+            options.channelId,
+          )}:thread:${redactSlackTs(options.threadTs)}`,
+        }
+      : {
+          key: `slack:team:${options.teamId}:dm:${options.channelId}:user:${options.userId ?? "unknown"}`,
+          display: `slack:team:${options.teamId}:dm:${options.channelId}:user:${options.userId ?? "unknown"}`,
+          redactedDisplay: `slack:team:${redactSlackId(options.teamId)}:dm:${redactSlackId(
+            options.channelId,
+          )}:user:${redactSlackId(options.userId ?? "unknown")}`,
+        }
+    : {
+        key: `slack:team:${options.teamId}:unknown`,
+        redactedDisplay: `slack:team:${redactSlackId(options.teamId)}:unknown`,
+      };
+
+  return {
+    type: "slack",
+    provider: "slack",
+    providerEventId: options.providerEventId,
+    dedupeKey: `slack:${input.channelId}:${options.providerEventId}`,
+    externalIdentity: identity,
+    receivedAt: input.receivedAt,
+  };
+}
+
+function slackProviderMetadata(body: Record<string, unknown>, event: Record<string, unknown>): Record<string, unknown> {
+  return {
+    envelopeType: readString(body, "type"),
+    eventType: readString(event, "type"),
+    channelType: readString(event, "channel_type"),
+    teamId: readString(body, "team_id"),
+    apiAppId: readString(body, "api_app_id"),
+    eventTime: readNumber(body, "event_time"),
+    ...(readString(event, "thread_ts") ? { threadTs: readString(event, "thread_ts") } : {}),
+  };
+}
+
+function parseJsonObject(input: { rawBody: string }): Record<string, unknown> {
+  try {
+    const parsed = JSON.parse(input.rawBody) as unknown;
+
+    if (!isRecord(parsed)) {
+      throw new Error("Slack payload must be a JSON object.");
+    }
+
+    return parsed;
+  } catch (error) {
+    if (error instanceof AgentKitError) {
+      throw error;
+    }
+
+    throw new AgentKitError("channel_payload_invalid", "Slack payload must be valid JSON.");
+  }
+}
+
+function readSlackErrorMessage(payload: unknown, status: number): string {
+  if (isRecord(payload)) {
+    const error = readString(payload, "error");
+
+    if (error) {
+      return `Slack chat.postMessage failed: ${error}.`;
+    }
+  }
+
+  return `Slack chat.postMessage returned HTTP ${status}.`;
+}
+
+function stripSlackBotMention(text: string): string {
+  return text.replace(/^(?:<@[A-Z0-9]+>\s*)+/, "").trim();
+}
+
+function sanitizeSlackOutboundText(text: string): string {
+  return text
+    .replace(/<@/g, "&lt;@")
+    .replace(/<!channel/g, "&lt;!channel")
+    .replace(/<!here/g, "&lt;!here")
+    .replace(/<!everyone/g, "&lt;!everyone")
+    .replace(/<!subteam/g, "&lt;!subteam");
+}
+
+function redactSlackToken(value: string, token: string | undefined): string {
+  return token ? value.split(token).join("<redacted>") : value;
+}
+
+function redactSlackId(value: string): string {
+  if (value.length <= 4) {
+    return "***";
+  }
+
+  return `${value.slice(0, 2)}***${value.slice(-2)}`;
+}
+
+function redactSlackTs(value: string): string {
+  const parts = value.split(".");
+
+  if (parts.length !== 2) {
+    return redactSlackId(value);
+  }
+
+  return `${parts[0]}.***`;
+}
+
+function readRecord(value: Record<string, unknown>, key: string): Record<string, unknown> {
+  const nested = value[key];
+  return isRecord(nested) ? nested : {};
+}
+
+function readString(value: Record<string, unknown>, key: string): string | undefined {
+  const raw = value[key];
+  return typeof raw === "string" ? raw : undefined;
+}
+
+function readNumber(value: Record<string, unknown>, key: string): number | undefined {
+  const raw = value[key];
+  return typeof raw === "number" && Number.isFinite(raw) ? raw : undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function hexToBytes(value: string): Uint8Array | null {
+  if (!/^[a-fA-F0-9]+$/.test(value) || value.length % 2 !== 0) {
+    return null;
+  }
+
+  const bytes = new Uint8Array(value.length / 2);
+
+  for (let index = 0; index < value.length; index += 2) {
+    bytes[index / 2] = Number.parseInt(value.slice(index, index + 2), 16);
+  }
+
+  return bytes;
+}
+
+function bytesToArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;
+}