@automagik/omni 2.260922.2 → 2.260922.4

package/db/drizzle/0078_instances_slack_oauth_identity.sql

@@ -0,0 +1,39 @@
+-- Slack OAuth identity on instances (wish: slack-personal-oauth).
+--
+-- The one-click Slack install (OAuth v2) provisions one instance per
+-- (workspace, authorizing user) and must find that instance again when the
+-- same person re-authorizes, so the callback upserts by a persisted Slack
+-- identity instead of by name. The connection method records how the
+-- credentials arrived, so the manual pasted-token path keeps its behavior.
+--
+--   instances.slack_team_id           Slack workspace id (T…); also filled for
+--                                     pasted-token instances by the
+--                                     instance.connected listener
+--   instances.slack_user_id           authorizing user id (U…); null for
+--                                     bot-mode instances (keyed by team only)
+--   instances.slack_connection_method 'manual' | 'oauth'; NULL reads as 'manual'
+--   instances_slack_identity_idx      composite index on (team, user) for the
+--                                     identity finder a follow-up adds. It
+--                                     serves NO query today: the callback's
+--                                     upsert still scans `instances.list`,
+--                                     which is capped at 1,000 Slack rows and
+--                                     is the documented trigger for a
+--                                     `findBySlackIdentity` service finder.
+--                                     The index ships here so that finder, and
+--                                     the uniqueness work tracked alongside
+--                                     it, need no second migration.
+--
+-- All nullable; existing rows are untouched. Not a credential column.
+--
+-- Hand-written following the 0043/0044/0052 precedent (additive, idempotent).
+-- No explicit BEGIN/COMMIT — the boot migrator executes this file on a pooled
+-- postgres-js connection, which rejects raw transaction control.
+
+ALTER TABLE "instances" ADD COLUMN IF NOT EXISTS "slack_team_id" varchar(32);
+
+ALTER TABLE "instances" ADD COLUMN IF NOT EXISTS "slack_user_id" varchar(32);
+
+ALTER TABLE "instances" ADD COLUMN IF NOT EXISTS "slack_connection_method" varchar(16);
+
+CREATE INDEX IF NOT EXISTS "instances_slack_identity_idx"
+  ON "instances" ("slack_team_id", "slack_user_id");

package/db/drizzle/meta/_journal.json

@@ -547,6 +547,13 @@
       "when": 1787700000000,
       "tag": "0077_instances_close_contact_config",
       "breakpoints": true
+    },
+    {
+      "idx": 78,
+      "version": "7",
+      "when": 1787800000000,
+      "tag": "0078_instances_slack_oauth_identity",
+      "breakpoints": true
     }
   ]
 }

package/dist/commands/slack.d.ts

@@ -3,10 +3,82 @@
  *
  *   omni slack dm <instance> <userId>       — resolve/open the DM channel
  *   omni slack search <instance> <query>    — full-text search (user token only)
+ *   omni slack app setup                    — register the deployment Slack app
+ *   omni slack app status                   — is the deployment app configured?
+ *   omni slack connect                      — one-click OAuth install from a terminal
  *
- * Neither has a cross-channel equivalent, which is why they live here rather
- * than under `omni messages`.
+ * None has a cross-channel equivalent, which is why they live here rather
+ * than under `omni messages` / `omni instances`.
+ *
+ * Exit codes across this group: 0 success, 2 usage, 3 API failure.
+ *
+ * Secrets (client secret, signing secret, app-level token) are accepted ONLY
+ * from a piped stdin (`--*-stdin`) or an interactive prompt on stderr — there
+ * is deliberately no `--client-secret <value>` style flag, because a value on
+ * the command line lands in the shell history and in `ps`. Anything this file
+ * echoes back goes through `maskSecret` first. `--*-stdin` is the
+ * non-echoing path; the prompt is the convenience path.
  */
+import type { OmniClient } from '@omni/sdk';
 import { Command } from 'commander';
+/** Every handler returns the process exit code it earned (0 — failures exit through `output.error`). */
+interface CommandResult {
+    readonly exitCode: number;
+    readonly instanceId?: string;
+}
+/**
+ * Mask a secret for display. Local to this file on purpose: `instances.ts`
+ * masks API *body fields*, this masks the values `slack app setup` collected
+ * before they reach the API, and the two must be free to diverge.
+ */
+declare function maskSecret(secret: string): string;
+/** Side effects `slack app setup` needs — injected so the test never touches the real stdin. */
+interface SetupPorts {
+    readonly readStdin: () => Promise<string>;
+    readonly prompt: (question: string) => Promise<string>;
+}
+/** Side effects `slack connect` needs — injected so the test never waits or launches anything. */
+interface ConnectPorts {
+    readonly openBrowser: (url: string) => Promise<boolean>;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly now: () => number;
+    readonly intervalMs: number;
+}
+interface SetupOptions {
+    readonly publicUrl?: string;
+    readonly clientId?: string;
+    readonly clientSecretStdin?: boolean;
+    readonly signingSecretStdin?: boolean;
+    readonly appTokenStdin?: boolean;
+    readonly nonInteractive?: boolean;
+}
+declare function handleAppSetup(client: OmniClient, opts: SetupOptions, ports?: SetupPorts): Promise<CommandResult>;
+declare function handleAppStatus(client: OmniClient): Promise<CommandResult>;
+interface ConnectOptions {
+    readonly mode?: string;
+    /** commander sets this to `false` for `--no-open`. */
+    readonly open?: boolean;
+    readonly timeout?: string;
+}
+declare function handleConnect(client: OmniClient, opts: ConnectOptions, ports?: ConnectPorts): Promise<CommandResult>;
 export declare function createSlackCommand(): Command;
+export declare const __testables: {
+    handleAppSetup: typeof handleAppSetup;
+    handleAppStatus: typeof handleAppStatus;
+    handleConnect: typeof handleConnect;
+    maskSecret: typeof maskSecret;
+    SETTING_KEYS: {
+        readonly clientId: "slack.app.client_id";
+        readonly clientSecret: "slack.app.client_secret";
+        readonly signingSecret: "slack.app.signing_secret";
+        readonly appToken: "slack.app.app_token";
+        readonly publicUrl: "server.public_url";
+    };
+    EXIT_OK: number;
+    EXIT_USAGE: number;
+    EXIT_API: number;
+    POLL_INTERVAL_MS: number;
+    DEFAULT_TIMEOUT_SECONDS: number;
+};
+export {};
 //# sourceMappingURL=slack.d.ts.map

package/dist/commands/slack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../src/commands/slack.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,kBAAkB,IAAI,OAAO,CAoD5C"}
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../src/commands/slack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,wGAAwG;AACxG,UAAU,aAAa;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,iBAAS,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1C;AAkDD,gGAAgG;AAChG,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AAED,kGAAkG;AAClG,UAAU,YAAY;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAkDD,UAAU,YAAY;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAgJD,iBAAe,cAAc,CAC3B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,YAAY,EAClB,KAAK,GAAE,UAA8B,GACpC,OAAO,CAAC,aAAa,CAAC,CAcxB;AAED,iBAAe,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAGzE;AAMD,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA0CD,iBAAe,aAAa,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,YAAkC,GACxC,OAAO,CAAC,aAAa,CAAC,CAgDxB;AAgCD,wBAAgB,kBAAkB,IAAI,OAAO,CAkE5C;AAED,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;CAWvB,CAAC"}

package/dist/index.js

@@ -82328,6 +82328,9 @@ var init_schema2 = __esm(() => {
     slackAuthMode: varchar("slack_auth_mode", { length: 10 }),
     slackAppToken: text("slack_app_token"),
     slackSigningSecret: text("slack_signing_secret"),
+    slackTeamId: varchar("slack_team_id", { length: 32 }),
+    slackUserId: varchar("slack_user_id", { length: 32 }),
+    slackConnectionMethod: varchar("slack_connection_method", { length: 16 }),
     telegramBotToken: text("telegram_bot_token"),
     telegramReactionLevel: varchar("telegram_reaction_level", { length: 20 }).notNull().default("off"),
     gupshupCallbackUrl: text("gupshup_callback_url"),
@@ -82449,6 +82452,7 @@ var init_schema2 = __esm(() => {
     isDefaultIdx: index("instances_is_default_idx").on(table3.isDefault),
     agentIdIdx: index("instances_agent_id_idx").on(table3.agentId),
     metaPhoneNumberIdx: index("instances_meta_phone_number_idx").on(table3.metaPhoneNumberId),
+    slackIdentityIdx: index("instances_slack_identity_idx").on(table3.slackTeamId, table3.slackUserId),
     chainModeCheck: check("instances_chain_mode_check", sql`${table3.chainMode} IN ('off', 'forward', 'bidirectional')`)
   }));
   whatsappTemplates = pgTable("whatsapp_templates", {
@@ -137204,6 +137208,31 @@ function createOmniClient(config) {
         if (!resp.ok)
           throw OmniApiError.from(json, resp.status);
         return json?.data ?? [];
+      },
+      async appStatus() {
+        const resp = await apiFetch(`${baseUrl}/api/v2/slack/app`);
+        const json = await resp.json();
+        if (!resp.ok)
+          throw OmniApiError.from(json, resp.status);
+        return json;
+      },
+      async oauthStart(body) {
+        const resp = await apiFetch(`${baseUrl}/api/v2/slack/oauth/start`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(body)
+        });
+        const json = await resp.json();
+        if (!resp.ok)
+          throw OmniApiError.from(json, resp.status);
+        return json;
+      },
+      async oauthResult(nonce) {
+        const resp = await apiFetch(`${baseUrl}/api/v2/slack/oauth/result/${encodeURIComponent(nonce)}`);
+        const json = await resp.json();
+        if (!resp.ok)
+          throw OmniApiError.from(json, resp.status);
+        return json;
       }
     },
     followUp: {
@@ -137424,7 +137453,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260922.2",
+  version: "2.260922.4",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",
@@ -151184,9 +151213,275 @@ async function runSetupAgent(options3) {
 }
 
 // src/commands/slack.ts
+import { createInterface as createInterface3 } from "readline";
 init_output();
+var EXIT_OK = 0;
+var EXIT_USAGE = 2;
+var EXIT_API = 3;
+var SETTING_KEYS = {
+  clientId: "slack.app.client_id",
+  clientSecret: "slack.app.client_secret",
+  signingSecret: "slack.app.signing_secret",
+  appToken: "slack.app.app_token",
+  publicUrl: "server.public_url"
+};
+var POLL_INTERVAL_MS2 = 2000;
+var DEFAULT_TIMEOUT_SECONDS = 240;
+function maskSecret2(secret) {
+  if (secret.length <= 12)
+    return "****";
+  return `****${secret.slice(-4)}`;
+}
+async function readStdinText2() {
+  if (process.stdin.isTTY) {
+    throw new Error('a --*-stdin flag requires piped stdin (e.g. `printf %s "$SECRET" | omni slack app setup ...`)');
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function promptLine2(question) {
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve4) => {
+      rl.question(`${question}: `, resolve4);
+    });
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
+  try {
+    const proc = Bun.spawn({ cmd, stdout: "ignore", stderr: "ignore" });
+    return await proc.exited === 0;
+  } catch {
+    return false;
+  }
+}
+var defaultSetupPorts = { readStdin: readStdinText2, prompt: promptLine2 };
+var defaultConnectPorts = {
+  openBrowser,
+  sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms)),
+  now: () => Date.now(),
+  intervalMs: POLL_INTERVAL_MS2
+};
+function messageOf(err2) {
+  return err2 instanceof Error ? err2.message : "Unknown error";
+}
+function codeOf(err2) {
+  if (typeof err2 === "object" && err2 !== null && "code" in err2) {
+    const code = err2.code;
+    if (typeof code === "string")
+      return code;
+  }
+  return;
+}
+async function fetchAppStatus(client) {
+  try {
+    return await client.slack.appStatus();
+  } catch (err2) {
+    error(`Failed to read the Slack app status: ${messageOf(err2)}`, undefined, EXIT_API);
+  }
+}
+function printAppStatus(status) {
+  keyValue("configured", status.configured);
+  keyValue("missing", status.missing);
+  keyValue("redirectUrl", status.redirectUrl);
+  keyValue("manifestUrl", status.manifestUrl);
+  if (!status.configured) {
+    info(`Not configured yet \u2014 missing: ${status.missing.join(", ")}. Run: omni slack app setup`);
+  }
+}
+var SECRET_REQUESTS = [
+  { field: "clientSecret", flag: "--client-secret-stdin", question: "Slack app client secret" },
+  { field: "signingSecret", flag: "--signing-secret-stdin", question: "Slack app signing secret" },
+  { field: "appToken", flag: "--app-token-stdin", question: "Slack app-level token (xapp-\u2026)" }
+];
+function wantsStdin(opts, field) {
+  if (field === "clientSecret")
+    return opts.clientSecretStdin === true;
+  if (field === "signingSecret")
+    return opts.signingSecretStdin === true;
+  return opts.appTokenStdin === true;
+}
+async function readSecretsFromStdin(requests, ports) {
+  const collected = new Map;
+  if (requests.length === 0)
+    return collected;
+  let text3;
+  try {
+    text3 = await ports.readStdin();
+  } catch (err2) {
+    error(messageOf(err2), undefined, EXIT_USAGE);
+  }
+  const lines = text3.split(/\r?\n/).map((line3) => line3.trim()).filter((line3) => line3.length > 0);
+  if (lines.length < requests.length) {
+    const flags = requests.map((r6) => r6.flag).join(", ");
+    error(`stdin carried ${lines.length} non-empty line(s) but ${requests.length} were requested (${flags}), one line per flag in that order`, undefined, EXIT_USAGE);
+  }
+  requests.forEach((request, index2) => collected.set(request.field, lines[index2]));
+  return collected;
+}
+async function resolvePlainValue(given, question, flag2, opts, ports) {
+  const trimmed = given?.trim();
+  if (trimmed)
+    return trimmed;
+  if (opts.nonInteractive) {
+    error(`--non-interactive requires ${flag2}`, undefined, EXIT_USAGE);
+  }
+  const answer = (await ports.prompt(question)).trim();
+  if (!answer) {
+    error(`${flag2} is required`, undefined, EXIT_USAGE);
+  }
+  return answer;
+}
+async function resolveSetupValues(opts, ports) {
+  const requested = SECRET_REQUESTS.filter((request) => wantsStdin(opts, request.field));
+  const fromStdin = await readSecretsFromStdin(requested, ports);
+  const publicUrl = await resolvePlainValue(opts.publicUrl, "Public base URL of this deployment (https://\u2026)", "--public-url <url>", opts, ports);
+  const clientId = await resolvePlainValue(opts.clientId, "Slack app client id", "--client-id <id>", opts, ports);
+  const secrets2 = new Map(fromStdin);
+  for (const request of SECRET_REQUESTS) {
+    if (secrets2.has(request.field))
+      continue;
+    if (opts.nonInteractive) {
+      error(`--non-interactive requires ${request.flag}`, undefined, EXIT_USAGE);
+    }
+    const answer = (await ports.prompt(request.question)).trim();
+    if (!answer) {
+      error(`${request.flag} is required`, undefined, EXIT_USAGE);
+    }
+    secrets2.set(request.field, answer);
+  }
+  return {
+    publicUrl,
+    clientId,
+    clientSecret: secrets2.get("clientSecret") ?? "",
+    signingSecret: secrets2.get("signingSecret") ?? "",
+    appToken: secrets2.get("appToken") ?? ""
+  };
+}
+async function writeAppSettings(client, values2) {
+  const entries = [
+    [SETTING_KEYS.clientId, values2.clientId, false],
+    [SETTING_KEYS.clientSecret, values2.clientSecret, true],
+    [SETTING_KEYS.signingSecret, values2.signingSecret, true],
+    [SETTING_KEYS.appToken, values2.appToken, true],
+    [SETTING_KEYS.publicUrl, values2.publicUrl, false]
+  ];
+  for (const [key, value] of entries) {
+    try {
+      await client.settings.set(key, value);
+    } catch (err2) {
+      error(`Failed to write ${key}: ${messageOf(err2)}`, undefined, EXIT_API);
+    }
+  }
+  success(`Wrote ${entries.length} Slack app settings`);
+  list(entries.map(([key, value, secret]) => ({ key, value: secret ? maskSecret2(value) : value })));
+}
+async function handleAppSetup(client, opts, ports = defaultSetupPorts) {
+  const before = await fetchAppStatus(client);
+  if (before.manifestUrl) {
+    info("Create (or update) the Slack app from this pre-filled manifest, then come back:");
+    keyValue("manifestUrl", before.manifestUrl);
+  } else {
+    info("The pre-filled manifest link appears once server.public_url is known \u2014 this setup writes it.");
+  }
+  const values2 = await resolveSetupValues(opts, ports);
+  await writeAppSettings(client, values2);
+  printAppStatus(await fetchAppStatus(client));
+  return { exitCode: EXIT_OK };
+}
+async function handleAppStatus(client) {
+  printAppStatus(await fetchAppStatus(client));
+  return { exitCode: EXIT_OK };
+}
+function resolveMode(opts) {
+  if (opts.mode === undefined)
+    return;
+  if (opts.mode === "user" || opts.mode === "bot")
+    return opts.mode;
+  error(`--mode must be 'user' or 'bot' (got '${opts.mode}')`, undefined, EXIT_USAGE);
+}
+function resolveTimeoutSeconds(opts) {
+  if (opts.timeout === undefined)
+    return DEFAULT_TIMEOUT_SECONDS;
+  const seconds = Number(opts.timeout);
+  if (!Number.isFinite(seconds) || seconds <= 0) {
+    error(`--timeout must be a positive number of seconds (got '${opts.timeout}')`, undefined, EXIT_USAGE);
+  }
+  return seconds;
+}
+async function pollOauthResult(client, nonce, ports, timeoutMs) {
+  const deadline = ports.now() + timeoutMs;
+  const maxPolls = Math.max(1, Math.ceil(timeoutMs / Math.max(1, ports.intervalMs)));
+  for (let attempt = 0;attempt < maxPolls; attempt++) {
+    await ports.sleep(ports.intervalMs);
+    let result;
+    try {
+      result = await client.slack.oauthResult(nonce);
+    } catch (err2) {
+      error(`Failed to read the install result: ${messageOf(err2)}`, undefined, EXIT_API);
+    }
+    if (result.status !== "pending")
+      return result;
+    if (ports.now() >= deadline)
+      break;
+  }
+  return;
+}
+async function handleConnect(client, opts, ports = defaultConnectPorts) {
+  const mode = resolveMode(opts);
+  const timeoutSeconds = resolveTimeoutSeconds(opts);
+  let started;
+  try {
+    started = await client.slack.oauthStart({ entry: "cli", ...mode ? { mode } : {} });
+  } catch (err2) {
+    if (codeOf(err2) === "SLACK_APP_NOT_CONFIGURED") {
+      error(`The deployment Slack app is not configured: ${messageOf(err2)}. Run: omni slack app setup`, undefined, EXIT_API);
+    }
+    error(`Failed to start the Slack install: ${messageOf(err2)}`, undefined, EXIT_API);
+  }
+  info("Approve the install in Slack \u2014 open this URL if a browser does not:");
+  keyValue("authorizeUrl", started.authorizeUrl);
+  keyValue("nonce", started.nonce);
+  keyValue("expiresAt", started.expiresAt);
+  if (opts.open !== false) {
+    const launched = await ports.openBrowser(started.authorizeUrl);
+    if (!launched)
+      info("Could not open a browser here \u2014 copy the URL above.");
+  }
+  const result = await pollOauthResult(client, started.nonce, ports, timeoutSeconds * 1000);
+  if (!result) {
+    error(`Timed out after ${timeoutSeconds}s waiting for Slack. The pending install (nonce ${started.nonce}) is single-use and cannot be resumed \u2014 start over with: omni slack connect`, undefined, EXIT_API);
+  }
+  if (result.status === "error") {
+    error(`Slack install failed: ${result.message}`, { code: result.code }, EXIT_API);
+  }
+  if (result.status !== "done") {
+    error(`Slack install did not complete (status: ${result.status})`, undefined, EXIT_API);
+  }
+  success(`Slack connected: instance ${result.instanceId}`);
+  keyValue("instanceId", result.instanceId);
+  keyValue("status", result.status);
+  return { exitCode: EXIT_OK, instanceId: result.instanceId };
+}
+function createSlackAppCommand() {
+  const app = new Command("app").description("Deployment-level Slack app registration (one app, every workspace)");
+  app.command("setup").description("Register the deployment Slack app: print the manifest link, collect the values, write the settings").option("--public-url <url>", "Public base URL of this deployment (https://\u2026)").option("--client-id <id>", "Slack app client id").option("--client-secret-stdin", "Read the client secret from stdin (one line)").option("--signing-secret-stdin", "Read the signing secret from stdin (one line)").option("--app-token-stdin", "Read the app-level token from stdin (one line)").option("--non-interactive", "Never prompt: every value must arrive by flag or stdin").action(async (opts) => {
+    await handleAppSetup(getClient(), opts);
+  });
+  app.command("status").description("Is the deployment Slack app configured? Shows missing keys, redirect URL and manifest link.").action(async () => {
+    await handleAppStatus(getClient());
+  });
+  return app;
+}
 function createSlackCommand() {
-  const cmd = new Command("slack").description("Slack-only operations: open a DM, search messages (#889)");
+  const cmd = new Command("slack").description("Slack-only operations: connect a workspace, open a DM, search messages (#889)");
   cmd.command("dm <instance> <userId>").description("Resolve the DM channel id for a Slack user (U\u2026). Idempotent.").action(async (instance3, userId) => {
     try {
       const instanceId = await resolveInstanceId(instance3);
@@ -151219,6 +151514,10 @@ function createSlackCommand() {
       error(`Search failed: ${err2 instanceof Error ? err2.message : "Unknown error"}`, undefined, 3);
     }
   });
+  cmd.addCommand(createSlackAppCommand());
+  cmd.command("connect").description("Connect a Slack workspace through the deployment app (opens Slack, then waits for the callback)").option("--mode <mode>", "Authorize as the person ('user', default) or as the workspace bot ('bot')").option("--no-open", "Do not try to open a browser; just print the URL").option("--timeout <seconds>", `Seconds to wait for the callback (default ${DEFAULT_TIMEOUT_SECONDS})`).action(async (opts) => {
+    await handleConnect(getClient(), opts);
+  });
   return cmd;
 }
 
@@ -152995,7 +153294,7 @@ function createTurnsCommand() {
 // src/commands/update.ts
 import { existsSync as existsSync20 } from "fs";
 import { join as join19 } from "path";
-import { createInterface as createInterface3 } from "readline";
+import { createInterface as createInterface4 } from "readline";
 init_source();
 init_config();
 
@@ -153667,7 +153966,7 @@ async function restartServicesAndVerify(servicesToRestart, latest, options3, dia
   }
 }
 async function promptConfirm(question) {
-  const rl = createInterface3({
+  const rl = createInterface4({
     input: process.stdin,
     output: process.stdout
   });

package/dist/sdk/client.d.ts

@@ -2588,6 +2588,12 @@ export declare function createOmniClient(config: OmniClientConfig): {
             count?: number;
             page?: number;
         }): Promise<Record<string, unknown>[]>;
+        /** Deployment Slack app status: configured?, missing setting keys, redirect + manifest URLs. */
+        appStatus(): Promise<components["schemas"]["SlackAppStatus"]>;
+        /** Start a one-click OAuth install; open `authorizeUrl` in a browser, then poll `oauthResult(nonce)`. */
+        oauthStart(body: components["schemas"]["SlackOAuthStartBody"]): Promise<components["schemas"]["SlackOAuthStart"]>;
+        /** Single-use outcome of an install: `pending` until the callback lands, then `done` or `error` once. */
+        oauthResult(nonce: string): Promise<components["schemas"]["SlackOAuthResult"]>;
     };
     followUp: {
         getAgent(id: string): Promise<components["schemas"]["FollowUpSequenceConfig"] | null>;