@cursor/july 0.1.15 → 0.1.17

package/skills/create-agent/SKILL.md

@@ -61,7 +61,7 @@ questions, concrete options, the recommended option listed first and labeled
 | --- | --- | --- |
 | **Runtime** | `local` (default) · `cloud` | Local = Cursor SDK harness on this machine; server tools, skills, sandbox seeds, and tool approvals all work. Cloud = Cursor cloud agents; needs `cloud.repos`, no server tools/skills/sandbox seeds (instructions are prepended to the first prompt). Recommend local unless the purpose needs a repo checkout on a cloud VM. |
 | **Model** | `grok-4.5` with `effort=high`, `fast=true` (default) · Other model id | Effort and fast are params, not id suffixes: `{ id: "grok-4.5", params: [{ id: "effort", value: "high" }, { id: "fast", value: "true" }] }` — the SDK rejects suffix-style ids. |
-| **Channels** (multi) | playground + HTTP API only (always mounted) · Slack · GitHub webhooks · custom webhook · schedule (cron) | Slack is Socket Mode with one app + token pair per agent. GitHub verifies `X-Hub-Signature-256` when a secret is set. Discord/Teams packs do not exist yet — offer custom webhook instead. |
+| **Channels** (multi) | playground + HTTP API only (always mounted) · Slack · GitHub webhooks · custom webhook · schedule (cron) | Slack has two connections: the Cursor-hosted connection (`cursorAccount: true` — zero Slack admin, recommended default) and a dedicated Socket Mode app (own bot user + one app/token pair per agent; needed for channel watching or approval buttons). When Slack is picked, resolve the connection with the Step 0 gate in `setup-slack/SKILL.md` — either fold its AskQuestion into this round or ask it before channel setup; default to Cursor-hosted when you cannot ask. GitHub verifies `X-Hub-Signature-256` when a secret is set. Discord/Teams packs do not exist yet — offer custom webhook instead. |
 | **MCP connections** (multi) | none · remote server (URL + header auth) · local stdio server · Other | One file per server under `agent/mcp-connections/`; filename = server name; tokens via env vars, never hardcoded. MCP connections serve the model **and** host code (`ctx.host.mcp`, channel `host.mcp`). |
 | **Capabilities** (multi) | server tools · agent tools (scripts) · skills · subagents · hooks · sandbox seed files · tool approvals (HITL) · evals (recommend) | Server tools, skills, sandbox seeds, approvals are local-runtime only. Agent tools (`execution: "agent"`) work on both runtimes. Always recommend at least one smoke eval. |
 
@@ -77,7 +77,7 @@ inventing:
 
 | Purpose looks like | Proven shape |
 | --- | --- |
-| Slack chat assistant | minimal `slackChannel()` pack with suggested prompts |
+| Slack chat assistant | minimal `slackChannel({ cursorAccount: true, agentName: "…" })` with suggested prompts; dedicated Socket Mode app only when the Step 0 gate picked it |
 | PR review with host-prepared evidence | channel `callTool` prep into a trimmed workspace `pr/` tree |
 | GitHub-webhook automation | `githubChannel()` hooks, per-PR debounce, replay fixtures |
 | Domain assistant over live APIs / MCP | server + agent tools, a stdio MCP connection, a skill, a schedule |
@@ -98,6 +98,7 @@ Defaults that make first cuts good:
   multi-line strings).
 - **Env prefix** for Slack tokens = upper-snake slug (`my-agent` →
   `MY_AGENT_SLACK_*`); `agentkit slack init` derives it for you.
+  Dedicated-app path only — the Cursor-hosted connection has no tokens.
 - **Host prep beats model wandering:** when the purpose has a deterministic
   setup step (fetch a PR, seed files), do it in the channel handler via
   `callTool` / `workspaceFiles` rather than instructing the model to do it.
@@ -125,10 +126,14 @@ plan:
    with the real tools.
 4. Add the chosen `channels/`, `mcp-connections/`, `skills/`, `subagents/<id>/`
    (needs `description`), `schedules/`, `hooks/`, `sandbox/workspace/`. For
-   Slack, do not hand-write the channel: `agentkit slack init --dir
-   ./<slug> --name "<Name>"` generates `agent/channels/slack.ts` (with
-   the env prefix) plus manifests and `env.example`; customize the generated
-   file (e.g. `suggestedPrompts`) afterwards.
+   Slack, follow the connection decided in the interview: Cursor-hosted is a
+   short hand-written `agent/channels/slack.ts`
+   (`slackChannel({ cursorAccount: true, agentName: "<Name>" })` — no
+   tokens, no manifests); for a dedicated Socket Mode app do not hand-write
+   the channel — `agentkit slack init --dir ./<slug> --name "<Name>"`
+   generates `agent/channels/slack.ts` (with the env prefix) plus manifests
+   and `env.example`; customize the generated file (e.g. `suggestedPrompts`)
+   afterwards.
 5. `evals/evals.config.ts` — `defineEvalConfig({ maxConcurrency: 20 })`
    (playground runs are memory-only unless you add `persistRuns`)
    (`maxConcurrency` is required; hard-capped at 200 due to model provider
@@ -186,7 +191,10 @@ Each surface beyond the playground has a human gate — drive the user through
 it, verify with doctor commands, and smoke-test before declaring victory.
 
 - **Slack** — follow `packages/agent-serve/skills/setup-slack/SKILL.md` end
-  to end (init → human creates apps → doctor → `@mention` smoke).
+  to end, starting from its Step 0 connection gate. Cursor-hosted: sign in
+  (`agentkit login` / `CURSOR_API_KEY`) → serve → `@Cursor <AgentName>`
+  smoke. Dedicated app: init → human creates apps → doctor → `@mention`
+  smoke.
 - **GitHub** — follow `packages/agent-serve/skills/github/SKILL.md`
   (fixtures / replay / forward / `--cursor-events`).
 - **Custom webhook** — `POST /<slug>/v1/channels/<id>/<route>`. Default

package/skills/debug/SKILL.md

@@ -53,7 +53,9 @@ curl -sN 'localhost:3000/<slug>/v1/session/<id>/stream?startIndex=0' | head -50
 | `403` on stream/follow-up | Caller principal ≠ session owner. In dev, create and inspect with the same auth; beyond loopback pass `--bearer-token` and send it. |
 | Works on localhost, 401/blocked through a tunnel or LAN | Default `localDevStrict()` auth only admits direct loopback, **rejects proxy-forwarding headers** (`X-Forwarded-For`, ...), and requires a loopback `Host`. Use `--bearer-token <secret>` (or authored `bearerAuth`) — `--allow-anonymous` only for trusted-network demos (and never with Cursor account MCP connections). |
 | Channel route won't compile: body/query schema type error | `GET` requires a Zod `querySchema`, `POST`/`PUT`/`PATCH` a Zod `bodySchema` — plain JSON Schema objects don't type-check. Use `z.object({})` / `z.unknown()` for open surfaces. Empty POST bodies are coerced to `{}` before validation. |
-| Slack channel prints `channel idle ... missing credentials` | Expected: tokens absent. Multi-agent needs `<PREFIX>_SLACK_BOT_TOKEN` + `<PREFIX>_SLACK_APP_TOKEN` per agent. `agentkit slack doctor --prefix <PREFIX>`. |
+| Slack channel prints `channel idle ... missing credentials` | Expected: tokens absent (dedicated-app path). Multi-agent needs `<PREFIX>_SLACK_BOT_TOKEN` + `<PREFIX>_SLACK_APP_TOKEN` per agent. `agentkit slack doctor --prefix <PREFIX>`. |
+| `serve` fails: `Slack channels using the Cursor account connection ... not signed in to Cursor` | Cursor-hosted Slack (`cursorAccount: true`) needs a signed-in host: `agentkit login` or `CURSOR_API_KEY`. No Slack tokens exist on this path — `slack doctor` doesn't apply. |
+| `@Cursor <name>` in Slack gets Cursor's normal agent, not yours | Agent name mismatch or host not relaying. Names are single-token and matched case-insensitively; confirm the serve log `cursor-slack: relaying Slack for <AgentName>` and that the workspace's Cursor Slack integration is linked to the signed-in account. |
 | Turn fails immediately with an API-key error | Model turns need `CURSOR_API_KEY`; everything structural (validate/info/call/serve bring-up) doesn't. |
 | Server tools / skills / sandbox silently absent | Runtime is `cloud` — those are local-only. `validate` prints exactly this warning; read it. |
 | `validate` clean, `run` works, CI typecheck fails | tsx never typechecked it. See invariant 3 in `framework-map/SKILL.md` (JSON-shaped tool returns; `type` not `interface`). |

package/skills/mcp-auth/SKILL.md

@@ -22,7 +22,7 @@ Docs: `docs/guides/mcp-oauth.md`, `docs/reference/connections.md`,
 
 | Need | Use |
 | --- | --- |
-| Connector already in Cursor dashboard (Linear, Notion, …) | `defineConnection({ cursorAccount: true, servers: […] })` |
+| Connector already in Cursor dashboard (Linear, Notion, …) | `defineConnection({ cursorAccount: true })` or `servers: "*"` for every connected server; `servers: […]` to allowlist |
 | Remote URL that speaks OAuth; host must hold tokens | `defineConnection({ url, oauth: true })` + this skill |
 | Static bearer / API key | `headers` / env on a plain `{ url }` connection |
 

package/skills/setup-slack/SKILL.md

@@ -1,16 +1,138 @@
 ---
 name: agentkit-setup-slack
 description: >-
-  Set up a Slack channel for an agentkit project — Socket Mode,
-  manifests, doctor, smoke test, and opt-in Slack tool approvals (HITL).
-  Read this skill when wiring Slack for an agentkit project.
+  Put an agentkit agent in Slack. Covers the required connection decision
+  (Cursor-hosted connection vs dedicated Socket Mode Slack app) with an
+  AskQuestion gate, then both setup paths end to end — cursorAccount
+  sign-in + smoke, or manifests, tokens, doctor, smoke test, and opt-in
+  Slack tool approvals (HITL). Read this skill when wiring Slack for an
+  agentkit project.
 ---
 
 # Setup Slack for agentkit
 
 Use this skill when a human asks to wire Slack to an agentkit agent.
 
-## Goal
+There are **two ways to connect**, and they differ mostly in setup cost:
+
+- **Path A — Cursor-hosted connection**
+  (`slackChannel({ cursorAccount: true })`): rides the Cursor Slack
+  integration already installed in the workspace. No Slack app, no
+  manifests, no tokens, no Slack admin. Live in minutes.
+- **Path B — Dedicated Slack app** (Socket Mode): the agent's own bot
+  user, created from generated manifests with an `xoxb-…` + `xapp-…`
+  token pair. Required for channel watching, approval buttons, or a
+  distinct bot handle. When the workspace is enrolled in Cursor's
+  **Add to Slack** (feature gate + a workspace-manager consent),
+  `agentkit slack create` provisions all of it in one command.
+
+**Do not generate manifests or ask for tokens until the decision below
+is made.** Defaulting into Path B buries the user in Slack admin work
+(two app creations, token minting, env wiring) they may not need.
+
+## Step 0 — Choose the connection (required gate)
+
+Walk the user through the tradeoffs before touching files:
+
+| | A: Cursor-hosted | B: Dedicated Slack app |
+| --- | --- | --- |
+| Setup | Zero Slack admin — sign the host in (`agentkit login` / `CURSOR_API_KEY`) and serve | Enrolled in Cursor's Add to Slack: one `agentkit slack create` per env (app + install + tokens, signed-in host). Otherwise: a Slack admin creates **two** apps (dev + prod) from manifests, installs them, mints `xoxb-…` + `xapp-…` for each |
+| Prereq | Cursor Slack integration installed in the workspace and linked to the Cursor account | Permission to create Slack apps; token storage/rotation is on you |
+| How users reach it | `@Cursor <AgentName> …`, DMs to @Cursor, replies in claimed threads | Its own bot user: @mention, DM, channel invites |
+| Identity | Posts as the Cursor app under the agent's name + icon | Own app name, avatar, and handle |
+| Channel watching (dispatch without a mention) | Not available | `engagement.channelPosts` allowlist |
+| Tool approvals / Block Kit interactivity | Not available (construction throws) | `toolApprovals: true` Approve/Deny cards |
+| Reply delivery | Status while working, then one final post (no streaming edits) | Streaming replies with postMessage fallback |
+| Multi-agent hosts | Any number of agents, unique `agentName` each, no extra Slack apps | One Slack app + token pair **per agent** |
+
+Decision shortcuts — skip the question when the request already decides:
+
+- Needs channel watching, Approve/Deny buttons, `onBlockAction`, or its
+  own bot user / handle → **Path B**. Say which requirement forced it.
+- Workspace has no Cursor Slack integration and won't install it →
+  **Path B**.
+- "Just get it into Slack", a first bring-up, or the user already said
+  to use the Cursor Slack integration, with none of the above → **Path A**.
+
+### Collect the decision with AskQuestion
+
+Otherwise ask — one single-select question via the `AskQuestion` tool,
+recommended option first so one click accepts it:
+
+- **Cursor-hosted Slack connection (recommended)** — zero Slack setup;
+  sign in and mention `@Cursor <AgentName>`. No channel watching or
+  approval buttons.
+- **Dedicated Slack app (Socket Mode)** — own bot user, channel
+  watching, approval buttons; needs a Slack admin to create two apps
+  and mint tokens.
+
+If `AskQuestion` is unavailable in your environment, or the user does
+not answer, **default to Path A (Cursor-hosted)**: state the assumption
+in one line and proceed. It is the reversible choice — a dedicated app
+can be added later as a *second* channel file without losing anything.
+Never mix both in one channel definition: `cursorAccount: true` rejects
+`credentials` / `envPrefix` at construction.
+
+## Path A — Cursor-hosted connection
+
+Goal: mention `@Cursor <AgentName>` in the linked workspace and get a
+threaded reply. No Slack app, no tokens, no manifests.
+
+### A1 — Author the channel (agent)
+
+Write `agent/channels/slack.ts` by hand — do **not** run
+`agentkit slack init` (that scaffolds the Path B manifests + env):
+
+```ts
+import { slackChannel } from "@cursor/july/channels/slack";
+
+export default slackChannel({
+  cursorAccount: true,
+  agentName: "MyAgent", // single token, no whitespace; prefer PascalCase
+  agentIcon: { emoji: ":robot_face:" },
+});
+```
+
+`agentName` defaults from the mount slug (PascalCase) and must be a
+single token — string literals with spaces fail typecheck; runtime
+values throw at construction/serve. Names must be unique on the host;
+an unmatched `@Cursor <name>` stays with Cursor's normal Slack agent.
+
+### A2 — Sign in + serve (agent)
+
+```bash
+agentkit login   # or export CURSOR_API_KEY
+agentkit dev .
+```
+
+Confirm log: `[agentkit] cursor-slack: relaying Slack for <AgentName> …`.
+An unsigned host fails `serve` with a sign-in hint naming the channel.
+
+### A3 — Smoke (human)
+
+1. In the Slack workspace linked to the Cursor account, post
+   `@Cursor MyAgent <question>` (or DM @Cursor)
+2. Confirm a working status while the turn runs, then a threaded reply
+   posted under the agent's name and icon
+3. Reply in the thread without re-mentioning — it stays with the agent
+
+### Path A limits (enforced at construction)
+
+- `credentials` / `envPrefix` → throw (author a second channel file for
+  a dedicated app instead)
+- `engagement.channelPosts`, `toolApprovals`, `interactivity`,
+  `onBlockAction` → throw (Socket Mode only)
+- `engagement.mentions: false` / `directMessages: false` → throw (the
+  relay always delivers those)
+- Streaming is forced off: rotating status while thinking, one final
+  reply post
+
+When one of these limits becomes a real requirement, keep the
+cursor-account channel and add a Path B channel file beside it.
+
+## Path B — Dedicated Slack app (Socket Mode)
+
+Goal:
 
 - Importable **dev** and **prod** Slack app manifests (Socket Mode on)
 - App-level Token (`xapp-…`, `connections:write`) + Bot token (`xoxb-…`)
@@ -18,10 +140,40 @@ Use this skill when a human asks to wire Slack to an agentkit agent.
 - Thread ↔ session via `continuationToken = channelId:threadTs`
 - One Slack app (token pair) **per agent** when serving multiple demos
 
-## Phases
-
 Update `.agent-serve/slack/setup-status.json` as you complete phases.
 
+### Provisioned variant — `agentkit slack create` (primary when enrolled)
+
+When the Slack workspace is enrolled in Cursor's **Add to Slack**
+(the provisioning feature gate plus a workspace-manager consent), one
+command collapses Phases 0–3 — manifest import, app creation, install,
+and token minting:
+
+```bash
+agentkit slack create --dir <agent>          # dev app (default)
+agentkit slack create --dir <agent> --prod   # prod app
+```
+
+`create` scaffolds `agent/channels/slack.ts` + the `.agent-serve/slack`
+files when missing (never overwriting existing ones), runs the browser
+consent flow when the workspace is not connected yet, provisions +
+installs the app, writes `<PREFIX>_SLACK_BOT_TOKEN` /
+`<PREFIX>_SLACK_APP_TOKEN` into `<dir>/.env.local` (replacing stale
+lines), and finishes with `doctor`. It needs a signed-in host
+(`agentkit login` / `CURSOR_API_KEY`). Pass `--slack-team <id>` when
+several workspaces are connected. If the install lands in
+`pending_admin_approval`, a Slack workspace admin must approve the
+printed link — then re-run `create` to finish and mint the tokens.
+`agentkit slack destroy` deletes the provisioned app (tokens left in
+`.env.local` simply stop working). Skip to Phase 4 when `create`
+succeeds — `dev`/`serve` load the agent's `.env.local` (real env wins).
+Note: re-running `create` rebuilds the app manifest from the command's
+flags, so any customization made outside the CLI resets to it.
+
+If the command reports the feature gate is not enabled (the workspace
+is not enrolled), fall back to the manual manifest-import flow below
+(Phases 0–3).
+
 ### Phase 0 — Generate (agent)
 
 ```bash
@@ -92,7 +244,7 @@ Human:
 
 ## Features (defaults ON)
 
-- Chat streaming (`chat.startStream` / `appendStream` / `stopStream`) with postMessage fallback
+- Chat streaming (`chat.startStream` / `appendStream` / `stopStream`) with postMessage fallback (Path B; Path A posts one final reply)
 - Thinking / task cards for tool calls
 - `assistant.threads.setStatus` with rotating `loading_messages`
 - Thread title + suggested prompts
@@ -101,7 +253,7 @@ Human:
 
 If a Slack API is unavailable (`method_not_found` / `missing_scope`), the pack falls back to postMessage + setStatus.
 
-## Engagement: mentions by default, channel watch opt-in
+## Engagement: mentions by default, channel watch opt-in (Path B only)
 
 The pack dispatches only on `app_mention` + DMs unless told otherwise —
 summoned, never proactive. To watch channels (dispatch on new posts without
@@ -128,7 +280,7 @@ bot to each watched channel. Posts mentioning the bot stay on the
 thread. `engagement.mentions` / `engagement.directMessages` can be set to
 `false` to turn those surfaces off.
 
-## Tool approvals over Slack (opt-in HITL)
+## Tool approvals over Slack (opt-in HITL, Path B only)
 
 Tools with `needsApproval` park until a human approves or denies. To route
 that through Slack, set `toolApprovals: true` on `slackChannel` — it posts
@@ -163,15 +315,25 @@ Requirements and caveats:
 
 ## Notes
 
-- Dev and prod are **separate Slack apps** (separate tokens).
-- Socket Mode only — no Events HTTP / Request URL path.
+- Dev and prod are **separate Slack apps** (separate tokens) on Path B.
+  Path A has no per-env app split — the host's Cursor account decides
+  where it relays.
+- Socket Mode / the Cursor relay are outbound only — no Events HTTP /
+  Request URL path on either connection.
 - Do not `await waitForCompletion()` inside Slack dispatch handlers — the pack uses `waitUntil`.
 - Do not share one token pair across multiple agents in the same process.
 
 ## CLI reference
 
+`slack create` / `destroy` / `init` / `manifest` / `doctor` are Path B
+tooling; Path A needs only `login`.
+
 ```bash
 agentkit slack setup
+agentkit slack create --dir .                     # provision via Add to Slack (dev app)
+agentkit slack create --dir . --prod              # prod app
+agentkit slack create --dir . --slack-team T0123ABCD
+agentkit slack destroy --dir . [--prod] [--slack-team T0123ABCD]
 agentkit slack init --dir . --name "My Agent"
 agentkit slack init --dir . --no-prefix
 agentkit slack init --dir . --channel-posts   # + message.channels/groups events

package/src/bin/agent-serve.ts

@@ -56,6 +56,7 @@ import {
   CLI_COMMAND_NAME as CLI,
   packageVersion,
 } from "../internal/distribution.js";
+import { loadAgentLocalEnv } from "../internal/local-env.js";
 import { clearTerminal, stdoutPalette } from "../internal/terminal-style.js";
 import { cmdUpdate, warnIfOutdated } from "../internal/update-check.js";
 import type { AgentProject, AgentServeHandle } from "../types.js";
@@ -100,7 +101,9 @@ Usage:
   ${CLI} mcp oauth   <connection> [--dir <path>] [--store] [--slug <slug>]
   ${CLI} eval        [--dir <path>] [evalId...] [--list] [--json]
                           [--tag <tag>]... [--verbose] [--timeout-ms <n>]
-                          [--no-stream] [--no-wait]
+                          [--strict] [--max-concurrency <n>]
+                          [--junit <path>] [--artifacts <dir>|--no-artifacts]
+                          [--skip-report] [--no-stream] [--no-wait]
                           [--prod | --url <baseUrl>] [--slug <slug>]
                           [--team <id>]
   ${CLI} eval status [runId] --prod|--url <baseUrl> [--dir <path>] [--json]
@@ -223,7 +226,8 @@ Commands:
   secrets     Manage deployment secrets: set (upsert by name; NAMEs without
               =VALUE are prompted for with hidden input, or read from piped
               stdin), list (names + createdAt; never values), unset.
-  slack       Slack channel pack: init, manifests, doctor (see slack help).
+  slack       Slack channel pack: create/destroy/icon (Cursor Add to Slack
+              provisioning), init, manifests, doctor (see slack help).
   github      GitHub webhook pack: forward live deliveries, events, doctor
               (wraps \`gh webhook forward\`; see github help).
 
@@ -320,6 +324,13 @@ Options:
   --tag              eval: only run cases with this tag (repeatable).
   --list             eval: print discovered cases without running.
   --verbose          eval: stream t.log lines and reply snippets.
+  --strict           eval: a missed soft threshold (SCORED) also exits 1.
+  --max-concurrency  eval: override evals.config.ts maxConcurrency.
+  --junit            eval: write JUnit XML here for CI annotations.
+  --artifacts        eval: run-artifact directory (default a timestamped dir
+                     under <dir>/.agent-serve/evals/).
+  --no-artifacts     eval: do not write run artifacts.
+  --skip-report      eval: ignore reporters from evals.config.ts / eval files.
   --no-stream        run/eval: silence live progress on stderr (JSON still prints).
   --json             JSON output (init/info/chat/eval/logs/sessions/session/
                      github; run defaults to JSON). logs: NDJSON progress/log
@@ -433,10 +444,14 @@ async function main(argv: string[]): Promise<number> {
       "base-url": { type: "string" },
       print: { type: "boolean", default: false },
       store: { type: "boolean", default: false },
+      remote: { type: "boolean", default: false },
       transport: { type: "string" },
       prefix: { type: "string" },
       "no-prefix": { type: "boolean", default: false },
       "channel-posts": { type: "boolean", default: false },
+      "slack-team": { type: "string" },
+      icon: { type: "string" },
+      force: { type: "boolean", default: false },
       repo: { type: "string", multiple: true },
       org: { type: "string" },
       "cursor-events": { type: "boolean", default: false },
@@ -456,6 +471,12 @@ async function main(argv: string[]): Promise<number> {
       all: { type: "boolean", default: false },
       "cursor-events-repo": { type: "string", multiple: true },
       "allow-domain": { type: "string", multiple: true },
+      strict: { type: "boolean", default: false },
+      junit: { type: "string" },
+      artifacts: { type: "string" },
+      "no-artifacts": { type: "boolean", default: false },
+      "skip-report": { type: "boolean", default: false },
+      "max-concurrency": { type: "string" },
     },
   });
   const dir = values.dir ?? ".";
@@ -483,6 +504,13 @@ async function main(argv: string[]): Promise<number> {
         prefix: values.prefix,
         noPrefix: values["no-prefix"],
         channelPosts: values["channel-posts"],
+        slackTeam: values["slack-team"],
+        prod: values.prod,
+        team: values.team,
+        apiKey: values["api-key"],
+        icon: values.icon,
+        force: values.force,
+        iconSource: positionals[0] === "icon" ? positionals[1] : undefined,
       });
     }
     case "github": {
@@ -545,6 +573,7 @@ async function main(argv: string[]): Promise<number> {
         print: values.print,
         json: values.json,
         store: values.store,
+        remote: values.remote,
         oauthConnection: mcpSub === "oauth" ? positionals[1] : undefined,
       });
     }
@@ -754,6 +783,11 @@ async function main(argv: string[]): Promise<number> {
           stateRoot: values["state-root"],
           timeoutMs: parseTimeoutMs(values["timeout-ms"]),
           stream: values["no-stream"] ? false : undefined,
+          strict: values.strict,
+          junit: values.junit,
+          artifacts: values["no-artifacts"] ? false : values.artifacts,
+          skipReport: values["skip-report"],
+          maxConcurrency: parseMaxConcurrency(values["max-concurrency"]),
         })
       );
     }
@@ -1016,6 +1050,16 @@ async function main(argv: string[]): Promise<number> {
       }
       const dev = command === "dev" || values.dev === true;
       const style = stdoutPalette();
+      // Real env wins (loadEnvFile never overrides). Runs inside start()
+      // so dev's Enter-restart picks up tokens written since boot.
+      const loadLocalEnv = (): void => {
+        const loadedEnvFiles = loadAgentLocalEnv(serveDir);
+        if (loadedEnvFiles.length > 0) {
+          process.stdout.write(
+            `${style.dim(`env: loaded ${loadedEnvFiles.join(", ")}`)}\n`
+          );
+        }
+      };
       const serveOptions = {
         port,
         host: values.host,
@@ -1055,6 +1099,7 @@ async function main(argv: string[]): Promise<number> {
       };
 
       const start = async (): Promise<AgentServeHandle> => {
+        loadLocalEnv();
         const next = await serve(serveDir, serveOptions);
         printServeBanner(next, bannerOpts);
         if (enterToRestart) {
@@ -1179,6 +1224,11 @@ function axFromOptions(
     once: partial.once,
     rawEvents: partial.rawEvents,
     print: partial.print,
+    strict: partial.strict,
+    junit: partial.junit,
+    artifacts: partial.artifacts,
+    skipReport: partial.skipReport,
+    maxConcurrency: partial.maxConcurrency,
   };
 }
 
@@ -1217,6 +1267,17 @@ function parseTimeoutMs(value: string | undefined): number | undefined {
   return n;
 }
 
+function parseMaxConcurrency(value: string | undefined): number | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  const n = Number.parseInt(value, 10);
+  if (Number.isNaN(n) || n <= 0) {
+    throw new Error(`invalid --max-concurrency: ${value}`);
+  }
+  return n;
+}
+
 /**
  * Load mounts the same way `serve` does (multi-agent layout by default).
  */

package/src/channels/slack/api.ts

@@ -350,7 +350,14 @@ export async function postMessage(args: {
     base.thread_ts = args.threadTs;
   }
   const hasBlocks = args.blocks !== undefined && args.blocks.length > 0;
-  const usePlainText = args.plainText === true || hasBlocks;
+  // User-group mentions (`<!subteam^…>`) and Slack mrkdwn links
+  // (`<https://…|label>`) only render correctly via mrkdwn `text`,
+  // not `markdown_text`.
+  const usePlainText =
+    args.plainText === true ||
+    hasBlocks ||
+    args.text.includes("<!subteam^") ||
+    /<https?:\/\/[^|>]+\|/.test(args.text);
 
   let response: Record<string, unknown>;
   if (usePlainText) {
@@ -451,8 +458,14 @@ export async function updateMessage(args: {
     channel: args.channel,
     ts: args.ts,
   };
-  if (args.blocks !== undefined || args.plainText === true) {
-    // Blocks / plainText force the legacy text path (same as postMessage).
+  if (
+    args.blocks !== undefined ||
+    args.plainText === true ||
+    args.text.includes("<!subteam^") ||
+    /<https?:\/\/[^|>]+\|/.test(args.text)
+  ) {
+    // Blocks / plainText / user-group mentions / mrkdwn links force the
+    // legacy text path (same as postMessage).
     return callSlackApiSoft({
       botToken: args.botToken,
       operation: "chat.update",

package/src/channels/slack/auth.ts

@@ -4,7 +4,7 @@
 
 import { samePrincipal } from "../../internal/auth.js";
 import type { AuthContext } from "../../types.js";
-import type { SlackBinding, SlackMessage } from "./types.js";
+import type { SlackBinding, SlackBlockAction, SlackMessage } from "./types.js";
 
 /**
  * Build a thread-scoped principal so any participant in the same Slack
@@ -88,6 +88,21 @@ export function buildSlackInteractiveApprovalAuth(args: {
   return clickerAuth;
 }
 
+/**
+ * Default auth for an `onBlockAction` dispatch: the click's thread-scoped
+ * principal with the clicker in attributes, so replies in the same thread
+ * continue the session and the clicker is the attributable user.
+ */
+export function blockActionAuth(action: SlackBlockAction): AuthContext {
+  return buildSlackAuthContext({
+    channelId: action.channelId,
+    threadTs: action.threadTs,
+    teamId: action.teamId,
+    userId: action.userId,
+    userName: action.userName,
+  });
+}
+
 export function defaultSlackAuth(
   message: SlackMessage,
   ctx: SlackBinding,