@cursor/july 0.1.16 → 0.1.17

package/skills/setup-slack/SKILL.md

@@ -1,16 +1,138 @@
 ---
 name: agentkit-setup-slack
 description: >-
-  Set up a Slack channel for an agentkit project — Socket Mode,
-  manifests, doctor, smoke test, and opt-in Slack tool approvals (HITL).
-  Read this skill when wiring Slack for an agentkit project.
+  Put an agentkit agent in Slack. Covers the required connection decision
+  (Cursor-hosted connection vs dedicated Socket Mode Slack app) with an
+  AskQuestion gate, then both setup paths end to end — cursorAccount
+  sign-in + smoke, or manifests, tokens, doctor, smoke test, and opt-in
+  Slack tool approvals (HITL). Read this skill when wiring Slack for an
+  agentkit project.
 ---
 
 # Setup Slack for agentkit
 
 Use this skill when a human asks to wire Slack to an agentkit agent.
 
-## Goal
+There are **two ways to connect**, and they differ mostly in setup cost:
+
+- **Path A — Cursor-hosted connection**
+  (`slackChannel({ cursorAccount: true })`): rides the Cursor Slack
+  integration already installed in the workspace. No Slack app, no
+  manifests, no tokens, no Slack admin. Live in minutes.
+- **Path B — Dedicated Slack app** (Socket Mode): the agent's own bot
+  user, created from generated manifests with an `xoxb-…` + `xapp-…`
+  token pair. Required for channel watching, approval buttons, or a
+  distinct bot handle. When the workspace is enrolled in Cursor's
+  **Add to Slack** (feature gate + a workspace-manager consent),
+  `agentkit slack create` provisions all of it in one command.
+
+**Do not generate manifests or ask for tokens until the decision below
+is made.** Defaulting into Path B buries the user in Slack admin work
+(two app creations, token minting, env wiring) they may not need.
+
+## Step 0 — Choose the connection (required gate)
+
+Walk the user through the tradeoffs before touching files:
+
+| | A: Cursor-hosted | B: Dedicated Slack app |
+| --- | --- | --- |
+| Setup | Zero Slack admin — sign the host in (`agentkit login` / `CURSOR_API_KEY`) and serve | Enrolled in Cursor's Add to Slack: one `agentkit slack create` per env (app + install + tokens, signed-in host). Otherwise: a Slack admin creates **two** apps (dev + prod) from manifests, installs them, mints `xoxb-…` + `xapp-…` for each |
+| Prereq | Cursor Slack integration installed in the workspace and linked to the Cursor account | Permission to create Slack apps; token storage/rotation is on you |
+| How users reach it | `@Cursor <AgentName> …`, DMs to @Cursor, replies in claimed threads | Its own bot user: @mention, DM, channel invites |
+| Identity | Posts as the Cursor app under the agent's name + icon | Own app name, avatar, and handle |
+| Channel watching (dispatch without a mention) | Not available | `engagement.channelPosts` allowlist |
+| Tool approvals / Block Kit interactivity | Not available (construction throws) | `toolApprovals: true` Approve/Deny cards |
+| Reply delivery | Status while working, then one final post (no streaming edits) | Streaming replies with postMessage fallback |
+| Multi-agent hosts | Any number of agents, unique `agentName` each, no extra Slack apps | One Slack app + token pair **per agent** |
+
+Decision shortcuts — skip the question when the request already decides:
+
+- Needs channel watching, Approve/Deny buttons, `onBlockAction`, or its
+  own bot user / handle → **Path B**. Say which requirement forced it.
+- Workspace has no Cursor Slack integration and won't install it →
+  **Path B**.
+- "Just get it into Slack", a first bring-up, or the user already said
+  to use the Cursor Slack integration, with none of the above → **Path A**.
+
+### Collect the decision with AskQuestion
+
+Otherwise ask — one single-select question via the `AskQuestion` tool,
+recommended option first so one click accepts it:
+
+- **Cursor-hosted Slack connection (recommended)** — zero Slack setup;
+  sign in and mention `@Cursor <AgentName>`. No channel watching or
+  approval buttons.
+- **Dedicated Slack app (Socket Mode)** — own bot user, channel
+  watching, approval buttons; needs a Slack admin to create two apps
+  and mint tokens.
+
+If `AskQuestion` is unavailable in your environment, or the user does
+not answer, **default to Path A (Cursor-hosted)**: state the assumption
+in one line and proceed. It is the reversible choice — a dedicated app
+can be added later as a *second* channel file without losing anything.
+Never mix both in one channel definition: `cursorAccount: true` rejects
+`credentials` / `envPrefix` at construction.
+
+## Path A — Cursor-hosted connection
+
+Goal: mention `@Cursor <AgentName>` in the linked workspace and get a
+threaded reply. No Slack app, no tokens, no manifests.
+
+### A1 — Author the channel (agent)
+
+Write `agent/channels/slack.ts` by hand — do **not** run
+`agentkit slack init` (that scaffolds the Path B manifests + env):
+
+```ts
+import { slackChannel } from "@cursor/july/channels/slack";
+
+export default slackChannel({
+  cursorAccount: true,
+  agentName: "MyAgent", // single token, no whitespace; prefer PascalCase
+  agentIcon: { emoji: ":robot_face:" },
+});
+```
+
+`agentName` defaults from the mount slug (PascalCase) and must be a
+single token — string literals with spaces fail typecheck; runtime
+values throw at construction/serve. Names must be unique on the host;
+an unmatched `@Cursor <name>` stays with Cursor's normal Slack agent.
+
+### A2 — Sign in + serve (agent)
+
+```bash
+agentkit login   # or export CURSOR_API_KEY
+agentkit dev .
+```
+
+Confirm log: `[agentkit] cursor-slack: relaying Slack for <AgentName> …`.
+An unsigned host fails `serve` with a sign-in hint naming the channel.
+
+### A3 — Smoke (human)
+
+1. In the Slack workspace linked to the Cursor account, post
+   `@Cursor MyAgent <question>` (or DM @Cursor)
+2. Confirm a working status while the turn runs, then a threaded reply
+   posted under the agent's name and icon
+3. Reply in the thread without re-mentioning — it stays with the agent
+
+### Path A limits (enforced at construction)
+
+- `credentials` / `envPrefix` → throw (author a second channel file for
+  a dedicated app instead)
+- `engagement.channelPosts`, `toolApprovals`, `interactivity`,
+  `onBlockAction` → throw (Socket Mode only)
+- `engagement.mentions: false` / `directMessages: false` → throw (the
+  relay always delivers those)
+- Streaming is forced off: rotating status while thinking, one final
+  reply post
+
+When one of these limits becomes a real requirement, keep the
+cursor-account channel and add a Path B channel file beside it.
+
+## Path B — Dedicated Slack app (Socket Mode)
+
+Goal:
 
 - Importable **dev** and **prod** Slack app manifests (Socket Mode on)
 - App-level Token (`xapp-…`, `connections:write`) + Bot token (`xoxb-…`)
@@ -18,10 +140,40 @@ Use this skill when a human asks to wire Slack to an agentkit agent.
 - Thread ↔ session via `continuationToken = channelId:threadTs`
 - One Slack app (token pair) **per agent** when serving multiple demos
 
-## Phases
-
 Update `.agent-serve/slack/setup-status.json` as you complete phases.
 
+### Provisioned variant — `agentkit slack create` (primary when enrolled)
+
+When the Slack workspace is enrolled in Cursor's **Add to Slack**
+(the provisioning feature gate plus a workspace-manager consent), one
+command collapses Phases 0–3 — manifest import, app creation, install,
+and token minting:
+
+```bash
+agentkit slack create --dir <agent>          # dev app (default)
+agentkit slack create --dir <agent> --prod   # prod app
+```
+
+`create` scaffolds `agent/channels/slack.ts` + the `.agent-serve/slack`
+files when missing (never overwriting existing ones), runs the browser
+consent flow when the workspace is not connected yet, provisions +
+installs the app, writes `<PREFIX>_SLACK_BOT_TOKEN` /
+`<PREFIX>_SLACK_APP_TOKEN` into `<dir>/.env.local` (replacing stale
+lines), and finishes with `doctor`. It needs a signed-in host
+(`agentkit login` / `CURSOR_API_KEY`). Pass `--slack-team <id>` when
+several workspaces are connected. If the install lands in
+`pending_admin_approval`, a Slack workspace admin must approve the
+printed link — then re-run `create` to finish and mint the tokens.
+`agentkit slack destroy` deletes the provisioned app (tokens left in
+`.env.local` simply stop working). Skip to Phase 4 when `create`
+succeeds — `dev`/`serve` load the agent's `.env.local` (real env wins).
+Note: re-running `create` rebuilds the app manifest from the command's
+flags, so any customization made outside the CLI resets to it.
+
+If the command reports the feature gate is not enabled (the workspace
+is not enrolled), fall back to the manual manifest-import flow below
+(Phases 0–3).
+
 ### Phase 0 — Generate (agent)
 
 ```bash
@@ -92,7 +244,7 @@ Human:
 
 ## Features (defaults ON)
 
-- Chat streaming (`chat.startStream` / `appendStream` / `stopStream`) with postMessage fallback
+- Chat streaming (`chat.startStream` / `appendStream` / `stopStream`) with postMessage fallback (Path B; Path A posts one final reply)
 - Thinking / task cards for tool calls
 - `assistant.threads.setStatus` with rotating `loading_messages`
 - Thread title + suggested prompts
@@ -101,7 +253,7 @@ Human:
 
 If a Slack API is unavailable (`method_not_found` / `missing_scope`), the pack falls back to postMessage + setStatus.
 
-## Engagement: mentions by default, channel watch opt-in
+## Engagement: mentions by default, channel watch opt-in (Path B only)
 
 The pack dispatches only on `app_mention` + DMs unless told otherwise —
 summoned, never proactive. To watch channels (dispatch on new posts without
@@ -128,7 +280,7 @@ bot to each watched channel. Posts mentioning the bot stay on the
 thread. `engagement.mentions` / `engagement.directMessages` can be set to
 `false` to turn those surfaces off.
 
-## Tool approvals over Slack (opt-in HITL)
+## Tool approvals over Slack (opt-in HITL, Path B only)
 
 Tools with `needsApproval` park until a human approves or denies. To route
 that through Slack, set `toolApprovals: true` on `slackChannel` — it posts
@@ -163,15 +315,25 @@ Requirements and caveats:
 
 ## Notes
 
-- Dev and prod are **separate Slack apps** (separate tokens).
-- Socket Mode only — no Events HTTP / Request URL path.
+- Dev and prod are **separate Slack apps** (separate tokens) on Path B.
+  Path A has no per-env app split — the host's Cursor account decides
+  where it relays.
+- Socket Mode / the Cursor relay are outbound only — no Events HTTP /
+  Request URL path on either connection.
 - Do not `await waitForCompletion()` inside Slack dispatch handlers — the pack uses `waitUntil`.
 - Do not share one token pair across multiple agents in the same process.
 
 ## CLI reference
 
+`slack create` / `destroy` / `init` / `manifest` / `doctor` are Path B
+tooling; Path A needs only `login`.
+
 ```bash
 agentkit slack setup
+agentkit slack create --dir .                     # provision via Add to Slack (dev app)
+agentkit slack create --dir . --prod              # prod app
+agentkit slack create --dir . --slack-team T0123ABCD
+agentkit slack destroy --dir . [--prod] [--slack-team T0123ABCD]
 agentkit slack init --dir . --name "My Agent"
 agentkit slack init --dir . --no-prefix
 agentkit slack init --dir . --channel-posts   # + message.channels/groups events

package/src/bin/agent-serve.ts

@@ -56,6 +56,7 @@ import {
   CLI_COMMAND_NAME as CLI,
   packageVersion,
 } from "../internal/distribution.js";
+import { loadAgentLocalEnv } from "../internal/local-env.js";
 import { clearTerminal, stdoutPalette } from "../internal/terminal-style.js";
 import { cmdUpdate, warnIfOutdated } from "../internal/update-check.js";
 import type { AgentProject, AgentServeHandle } from "../types.js";
@@ -100,7 +101,9 @@ Usage:
   ${CLI} mcp oauth   <connection> [--dir <path>] [--store] [--slug <slug>]
   ${CLI} eval        [--dir <path>] [evalId...] [--list] [--json]
                           [--tag <tag>]... [--verbose] [--timeout-ms <n>]
-                          [--no-stream] [--no-wait]
+                          [--strict] [--max-concurrency <n>]
+                          [--junit <path>] [--artifacts <dir>|--no-artifacts]
+                          [--skip-report] [--no-stream] [--no-wait]
                           [--prod | --url <baseUrl>] [--slug <slug>]
                           [--team <id>]
   ${CLI} eval status [runId] --prod|--url <baseUrl> [--dir <path>] [--json]
@@ -223,7 +226,8 @@ Commands:
   secrets     Manage deployment secrets: set (upsert by name; NAMEs without
               =VALUE are prompted for with hidden input, or read from piped
               stdin), list (names + createdAt; never values), unset.
-  slack       Slack channel pack: init, manifests, doctor (see slack help).
+  slack       Slack channel pack: create/destroy/icon (Cursor Add to Slack
+              provisioning), init, manifests, doctor (see slack help).
   github      GitHub webhook pack: forward live deliveries, events, doctor
               (wraps \`gh webhook forward\`; see github help).
 
@@ -320,6 +324,13 @@ Options:
   --tag              eval: only run cases with this tag (repeatable).
   --list             eval: print discovered cases without running.
   --verbose          eval: stream t.log lines and reply snippets.
+  --strict           eval: a missed soft threshold (SCORED) also exits 1.
+  --max-concurrency  eval: override evals.config.ts maxConcurrency.
+  --junit            eval: write JUnit XML here for CI annotations.
+  --artifacts        eval: run-artifact directory (default a timestamped dir
+                     under <dir>/.agent-serve/evals/).
+  --no-artifacts     eval: do not write run artifacts.
+  --skip-report      eval: ignore reporters from evals.config.ts / eval files.
   --no-stream        run/eval: silence live progress on stderr (JSON still prints).
   --json             JSON output (init/info/chat/eval/logs/sessions/session/
                      github; run defaults to JSON). logs: NDJSON progress/log
@@ -433,10 +444,14 @@ async function main(argv: string[]): Promise<number> {
       "base-url": { type: "string" },
       print: { type: "boolean", default: false },
       store: { type: "boolean", default: false },
+      remote: { type: "boolean", default: false },
       transport: { type: "string" },
       prefix: { type: "string" },
       "no-prefix": { type: "boolean", default: false },
       "channel-posts": { type: "boolean", default: false },
+      "slack-team": { type: "string" },
+      icon: { type: "string" },
+      force: { type: "boolean", default: false },
       repo: { type: "string", multiple: true },
       org: { type: "string" },
       "cursor-events": { type: "boolean", default: false },
@@ -456,6 +471,12 @@ async function main(argv: string[]): Promise<number> {
       all: { type: "boolean", default: false },
       "cursor-events-repo": { type: "string", multiple: true },
       "allow-domain": { type: "string", multiple: true },
+      strict: { type: "boolean", default: false },
+      junit: { type: "string" },
+      artifacts: { type: "string" },
+      "no-artifacts": { type: "boolean", default: false },
+      "skip-report": { type: "boolean", default: false },
+      "max-concurrency": { type: "string" },
     },
   });
   const dir = values.dir ?? ".";
@@ -483,6 +504,13 @@ async function main(argv: string[]): Promise<number> {
         prefix: values.prefix,
         noPrefix: values["no-prefix"],
         channelPosts: values["channel-posts"],
+        slackTeam: values["slack-team"],
+        prod: values.prod,
+        team: values.team,
+        apiKey: values["api-key"],
+        icon: values.icon,
+        force: values.force,
+        iconSource: positionals[0] === "icon" ? positionals[1] : undefined,
       });
     }
     case "github": {
@@ -545,6 +573,7 @@ async function main(argv: string[]): Promise<number> {
         print: values.print,
         json: values.json,
         store: values.store,
+        remote: values.remote,
         oauthConnection: mcpSub === "oauth" ? positionals[1] : undefined,
       });
     }
@@ -754,6 +783,11 @@ async function main(argv: string[]): Promise<number> {
           stateRoot: values["state-root"],
           timeoutMs: parseTimeoutMs(values["timeout-ms"]),
           stream: values["no-stream"] ? false : undefined,
+          strict: values.strict,
+          junit: values.junit,
+          artifacts: values["no-artifacts"] ? false : values.artifacts,
+          skipReport: values["skip-report"],
+          maxConcurrency: parseMaxConcurrency(values["max-concurrency"]),
         })
       );
     }
@@ -1016,6 +1050,16 @@ async function main(argv: string[]): Promise<number> {
       }
       const dev = command === "dev" || values.dev === true;
       const style = stdoutPalette();
+      // Real env wins (loadEnvFile never overrides). Runs inside start()
+      // so dev's Enter-restart picks up tokens written since boot.
+      const loadLocalEnv = (): void => {
+        const loadedEnvFiles = loadAgentLocalEnv(serveDir);
+        if (loadedEnvFiles.length > 0) {
+          process.stdout.write(
+            `${style.dim(`env: loaded ${loadedEnvFiles.join(", ")}`)}\n`
+          );
+        }
+      };
       const serveOptions = {
         port,
         host: values.host,
@@ -1055,6 +1099,7 @@ async function main(argv: string[]): Promise<number> {
       };
 
       const start = async (): Promise<AgentServeHandle> => {
+        loadLocalEnv();
         const next = await serve(serveDir, serveOptions);
         printServeBanner(next, bannerOpts);
         if (enterToRestart) {
@@ -1179,6 +1224,11 @@ function axFromOptions(
     once: partial.once,
     rawEvents: partial.rawEvents,
     print: partial.print,
+    strict: partial.strict,
+    junit: partial.junit,
+    artifacts: partial.artifacts,
+    skipReport: partial.skipReport,
+    maxConcurrency: partial.maxConcurrency,
   };
 }
 
@@ -1217,6 +1267,17 @@ function parseTimeoutMs(value: string | undefined): number | undefined {
   return n;
 }
 
+function parseMaxConcurrency(value: string | undefined): number | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  const n = Number.parseInt(value, 10);
+  if (Number.isNaN(n) || n <= 0) {
+    throw new Error(`invalid --max-concurrency: ${value}`);
+  }
+  return n;
+}
+
 /**
  * Load mounts the same way `serve` does (multi-agent layout by default).
  */

package/src/channels/slack/api.ts

@@ -350,7 +350,14 @@ export async function postMessage(args: {
     base.thread_ts = args.threadTs;
   }
   const hasBlocks = args.blocks !== undefined && args.blocks.length > 0;
-  const usePlainText = args.plainText === true || hasBlocks;
+  // User-group mentions (`<!subteam^…>`) and Slack mrkdwn links
+  // (`<https://…|label>`) only render correctly via mrkdwn `text`,
+  // not `markdown_text`.
+  const usePlainText =
+    args.plainText === true ||
+    hasBlocks ||
+    args.text.includes("<!subteam^") ||
+    /<https?:\/\/[^|>]+\|/.test(args.text);
 
   let response: Record<string, unknown>;
   if (usePlainText) {
@@ -451,8 +458,14 @@ export async function updateMessage(args: {
     channel: args.channel,
     ts: args.ts,
   };
-  if (args.blocks !== undefined || args.plainText === true) {
-    // Blocks / plainText force the legacy text path (same as postMessage).
+  if (
+    args.blocks !== undefined ||
+    args.plainText === true ||
+    args.text.includes("<!subteam^") ||
+    /<https?:\/\/[^|>]+\|/.test(args.text)
+  ) {
+    // Blocks / plainText / user-group mentions / mrkdwn links force the
+    // legacy text path (same as postMessage).
     return callSlackApiSoft({
       botToken: args.botToken,
       operation: "chat.update",

package/src/channels/slack/auth.ts

@@ -4,7 +4,7 @@
 
 import { samePrincipal } from "../../internal/auth.js";
 import type { AuthContext } from "../../types.js";
-import type { SlackBinding, SlackMessage } from "./types.js";
+import type { SlackBinding, SlackBlockAction, SlackMessage } from "./types.js";
 
 /**
  * Build a thread-scoped principal so any participant in the same Slack
@@ -88,6 +88,21 @@ export function buildSlackInteractiveApprovalAuth(args: {
   return clickerAuth;
 }
 
+/**
+ * Default auth for an `onBlockAction` dispatch: the click's thread-scoped
+ * principal with the clicker in attributes, so replies in the same thread
+ * continue the session and the clicker is the attributable user.
+ */
+export function blockActionAuth(action: SlackBlockAction): AuthContext {
+  return buildSlackAuthContext({
+    channelId: action.channelId,
+    threadTs: action.threadTs,
+    teamId: action.teamId,
+    userId: action.userId,
+    userName: action.userName,
+  });
+}
+
 export function defaultSlackAuth(
   message: SlackMessage,
   ctx: SlackBinding,

package/src/channels/slack/blocks.ts

@@ -0,0 +1,139 @@
+/**
+ * Block Kit building helpers shared by card-building agents.
+ */
+
+/** Slack cap for one section block's mrkdwn text. */
+export const SLACK_SECTION_MRKDWN_MAX = 3000;
+
+/** Slack caps for a native `table` block (one table per message). */
+export const SLACK_TABLE_MAX_ROWS = 100;
+export const SLACK_TABLE_MAX_COLUMNS = 20;
+
+/**
+ * Pack lines into as few mrkdwn section blocks as fit the 3000-char cap,
+ * preserving order. Long lists (a full service fleet, a file inventory)
+ * overflow a single section and make `chat.postMessage` refuse the whole
+ * card with `invalid_blocks`.
+ */
+export function mrkdwnSections(lines: readonly string[]): unknown[] {
+  const texts: string[] = [];
+  let current = "";
+  for (const raw of lines) {
+    // A single oversized line (one huge blob) hard-splits at the cap.
+    const parts: string[] = [];
+    for (
+      let i = 0;
+      i < Math.max(raw.length, 1);
+      i += SLACK_SECTION_MRKDWN_MAX
+    ) {
+      parts.push(raw.slice(i, i + SLACK_SECTION_MRKDWN_MAX));
+    }
+    for (const line of parts) {
+      const next = current === "" ? line : `${current}\n${line}`;
+      if (next.length > SLACK_SECTION_MRKDWN_MAX && current !== "") {
+        texts.push(current);
+        current = line;
+      } else {
+        current = next;
+      }
+    }
+  }
+  if (current !== "") {
+    texts.push(current);
+  }
+  return texts.map((text) => ({
+    type: "section",
+    text: { type: "mrkdwn", text },
+  }));
+}
+
+export type SlackTableAlign = "left" | "center" | "right";
+
+export type SlackTableColumnSetting = {
+  align?: SlackTableAlign;
+  is_wrapped?: boolean;
+};
+
+/** Cell types accepted by Slack's native `table` block. */
+export type SlackTableCell =
+  | { type: "raw_text"; text: string }
+  | {
+      type: "rich_text";
+      elements: Array<{
+        type: "rich_text_section";
+        elements: Array<
+          | { type: "text"; text: string }
+          | { type: "link"; url: string; text: string }
+        >;
+      }>;
+    };
+
+export type SlackTableBlock = {
+  type: "table";
+  rows: SlackTableCell[][];
+  column_settings?: SlackTableColumnSetting[];
+};
+
+/** Plain text cell (header or body). */
+export function slackRawTextCell(text: string): SlackTableCell {
+  return { type: "raw_text", text };
+}
+
+/** Linked cell via rich_text (preferred over mrkdwn `<url|label>` in tables). */
+export function slackLinkCell(args: {
+  url: string;
+  text: string;
+}): SlackTableCell {
+  return {
+    type: "rich_text",
+    elements: [
+      {
+        type: "rich_text_section",
+        elements: [{ type: "link", url: args.url, text: args.text }],
+      },
+    ],
+  };
+}
+
+/**
+ * Build a native Slack `table` block. First row is the header. Slack allows
+ * at most one table block per message, 100 rows, and 20 columns — callers
+ * should keep tables short.
+ */
+export function slackTableBlock(args: {
+  headers: readonly string[];
+  rows: readonly (readonly SlackTableCell[])[];
+  columnSettings?: readonly SlackTableColumnSetting[];
+}): SlackTableBlock | undefined {
+  if (args.headers.length === 0) {
+    return undefined;
+  }
+  if (args.headers.length > SLACK_TABLE_MAX_COLUMNS) {
+    throw new Error(
+      `slackTableBlock: ${args.headers.length} columns exceeds Slack cap of ${SLACK_TABLE_MAX_COLUMNS}`
+    );
+  }
+  // Header + body rows share the 100-row cap.
+  if (args.rows.length + 1 > SLACK_TABLE_MAX_ROWS) {
+    throw new Error(
+      `slackTableBlock: ${args.rows.length + 1} rows exceeds Slack cap of ${SLACK_TABLE_MAX_ROWS}`
+    );
+  }
+  const columnCount = args.headers.length;
+  for (const [index, row] of args.rows.entries()) {
+    if (row.length !== columnCount) {
+      throw new Error(
+        `slackTableBlock: row ${index} has ${row.length} cells; expected ${columnCount}`
+      );
+    }
+  }
+  const headerRow = args.headers.map((header) => slackRawTextCell(header));
+  const block: SlackTableBlock = {
+    type: "table",
+    rows: [headerRow, ...args.rows.map((row) => [...row])],
+  };
+  if (args.columnSettings !== undefined && args.columnSettings.length > 0) {
+    block.column_settings = [...args.columnSettings];
+  }
+  return block;
+}

package/src/channels/slack/defaults.ts

@@ -26,6 +26,37 @@ import type {
   SlackSuggestedPrompt,
 } from "./types.js";
 
+const SLACK_TURN_FAILURE_FALLBACK =
+  "I hit an error while handling your request. Please try again or rephrase.";
+const SLACK_TURN_FAILURE_MAX_CHARS = 400;
+
+/** Scrubbed turn.failed body for Slack (secrets / paths / URLs stripped). */
+export function formatSlackTurnFailureMessage(raw: string | undefined): string {
+  const scrubbed = scrubSlackErrorDetail(raw?.trim() ?? "");
+  if (scrubbed === "") {
+    return SLACK_TURN_FAILURE_FALLBACK;
+  }
+  if (/^I hit an error/i.test(scrubbed)) {
+    return scrubbed;
+  }
+  return `I hit an error while handling your request: ${scrubbed}`;
+}
+
+function scrubSlackErrorDetail(message: string): string {
+  const scrubbed = message
+    .replace(/https?:\/\/\S+/gi, "[url]")
+    .replace(/\b(crsr_|xox[baprs]-|sk-|Bearer\s+)\S+/gi, "[redacted]")
+    .replace(/\/(?:home|Users|var\/folders)\/\S+/g, "[path]")
+    .replace(/\b[A-Za-z]:(?:\\|\/)[^\s]+/g, "[path]")
+    .replace(/\\\\[^\s]+/g, "[path]")
+    .replace(/\s+/g, " ")
+    .trim();
+  if (scrubbed.length <= SLACK_TURN_FAILURE_MAX_CHARS) {
+    return scrubbed;
+  }
+  return `${scrubbed.slice(0, SLACK_TURN_FAILURE_MAX_CHARS - 1)}…`;
+}
+
 function resolveLoadingMessages(
   loadingMessages: readonly string[] | undefined
 ): string[] {
@@ -434,10 +465,7 @@ export function buildDefaultEvents(
       if (state.channelId === null || state.threadTs === null) {
         return;
       }
-      // Do not echo engine/tool error text into Slack — it can leak
-      // paths, tokens, or other sensitive detail to workspace members.
-      const errorText =
-        "I hit an error while handling your request. Please try again or rephrase.";
+      const errorText = formatSlackTurnFailureMessage(event.data.message);
 
       let delivered = false;
       if (state.streamTs !== null && state.streamTs !== "") {