@cursor/july 0.1.16 → 0.1.18

package/dist/internal/cli-slack.js

@@ -1,5 +1,7 @@
 /**
- * `agent-serve slack …` CLI — manifests, setup, doctor (Socket Mode).
+ * `agent-serve slack …` CLI — manifests, setup, doctor (Socket Mode), and
+ * managed provisioning (`create` / `destroy`) through Cursor's
+ * "Add to Slack" API (`slack-provision-client.ts`).
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -10,23 +12,56 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { mkdir, writeFile } from "node:fs/promises";
-import { basename, join, resolve as resolvePath } from "node:path";
-import { buildSlackManifestPair, formatSlackSetupGuide, initSlackChannel, runSlackDoctor, } from "../channels/slack/index.js";
+import { access, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, extname, join, resolve as resolvePath } from "node:path";
+import { buildSlackManifest, buildSlackManifestPair, envPrefixFromName, formatSlackSetupGuide, initSlackChannel, runSlackDoctor, slackEnvKeys, } from "../channels/slack/index.js";
+import { resolveDeployAuth } from "./cli-deploy.js";
+import { cursorExternalApiUrl } from "./cursor/credentials.js";
+import { slugFromDirectoryName } from "./deploy-client.js";
+import { describeError } from "./describe-error.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { loadAgentLocalEnv } from "./local-env.js";
+import { openBrowser } from "./open-browser.js";
+import { AgentServeSlackClient, SlackProvisionApiError, } from "./slack-provision-client.js";
 const SLACK_HELP = `agent-serve slack — Slack channel pack helpers (Socket Mode)
 
 Usage:
   agent-serve slack setup
+  agent-serve slack create    [--dir .] [--name NAME] [--slack-team T0123ABCD]
+                                [--prod] [--team <id>] [--icon URL-or-FILE]
+                                [--force] [--prefix PREFIX | --no-prefix] [--json]
+  agent-serve slack destroy   [--dir .] [--slack-team T0123ABCD] [--prod]
+                                [--team <id>] [--json]
+  agent-serve slack icon      <URL-or-FILE> [--dir .] [--slack-team T0123ABCD]
+                                [--prod] [--team <id>] [--json]
   agent-serve slack init      [--dir .] [--name NAME] [--prefix PREFIX | --no-prefix]
                                 [--channel-posts]
   agent-serve slack manifest --env dev|prod|both [--dir .] [--name NAME]
                                 [--print]
-  agent-serve slack doctor [--prefix PREFIX] [--json]
+  agent-serve slack doctor [--dir .] [--prefix PREFIX | --no-prefix] [--json]
+
+create/destroy/icon — Cursor "Add to Slack" managed provisioning:
+  create   One-command Path B setup: connects the Slack workspace (browser
+           consent) when needed, creates + installs this agent's dedicated
+           Socket Mode app from the generated manifest, writes the token
+           pair into <dir>/.env.local, then runs doctor (prose mode; --json
+           reports without the doctor pass). Requires
+           \`agent-serve login\` (or CURSOR_API_KEY) and the feature gate.
+           --prod provisions the prod app (default dev); --slack-team picks
+           the workspace when several are connected. --icon sets the app's
+           icon (best-effort: a bad icon warns, never fails the create).
+           A re-run refuses to overwrite manifest edits made by hand at
+           api.slack.com (manifest_drift); --force overwrites them.
+  destroy  Delete the provisioned Slack app for this agent (+env). Tokens
+           already in .env.local are left in place (they just stop working).
+  icon     Set the provisioned app's icon: an https image URL or a local
+           png/jpg/gif file (at most 512KB).
 
 Env tokens:
   single agent:  SLACK_BOT_TOKEN + SLACK_APP_TOKEN
   multi-agent:   <PREFIX>_SLACK_BOT_TOKEN + <PREFIX>_SLACK_APP_TOKEN
-                 (init defaults PREFIX from the directory name)
+                 (init/create default PREFIX from the directory name;
+                  doctor defaults to it too when those keys are set)
 
 See also: skills/setup-slack/SKILL.md
 `;
@@ -42,6 +77,12 @@ export function cmdSlack(subcommand, options) {
             case "setup":
                 process.stdout.write(formatSlackSetupGuide());
                 return 0;
+            case "create":
+                return cmdSlackCreate(options);
+            case "destroy":
+                return cmdSlackDestroy(options);
+            case "icon":
+                return cmdSlackIcon(options);
             case "init":
                 return cmdSlackInit(options);
             case "manifest":
@@ -96,7 +137,10 @@ function runManifest(options) {
         const env = (_a = options.env) !== null && _a !== void 0 ? _a : "both";
         const dir = resolvePath(options.dir);
         const name = (_b = options.name) !== null && _b !== void 0 ? _b : basename(dir);
-        const pair = buildSlackManifestPair(Object.assign({ name }, (options.channelPosts === true ? { channelPosts: true } : {})));
+        const pair = buildSlackManifestPair(Object.assign({ name, 
+            // These files are pasted into api.slack.com by hand, so they must not
+            // carry the manager-token-only managed_app_settings block.
+            managedByCursor: false }, (options.channelPosts === true ? { channelPosts: true } : {})));
         if (options.print) {
             if (env === "dev" || env === "both") {
                 process.stdout.write(`${JSON.stringify(pair.dev, null, 2)}\n`);
@@ -128,17 +172,759 @@ function runManifest(options) {
 }
 function runDoctor(options) {
     return __awaiter(this, void 0, void 0, function* () {
-        const result = yield runSlackDoctor(options.prefix === undefined ? {} : { envPrefix: options.prefix });
+        var _a;
+        const dir = resolvePath(options.dir);
+        // Tokens usually live in the agent's .env.local; real env still wins.
+        loadAgentLocalEnv(dir);
+        const envPrefix = resolveDoctorEnvPrefix(options, dir);
+        const doctor = (_a = options.doctorImpl) !== null && _a !== void 0 ? _a : runSlackDoctor;
+        const result = yield doctor(envPrefix === undefined ? {} : { envPrefix });
         if (options.json) {
             process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
         }
         else {
-            process.stdout.write(`env: ${result.envKeys.bot} / ${result.envKeys.app}\n`);
-            for (const check of result.checks) {
-                process.stdout.write(`${check.ok ? "ok" : "!!"}  ${check.id}: ${check.message}\n`);
-            }
-            process.stdout.write(result.ok ? "doctor: pass\n" : "doctor: fail\n");
+            process.stdout.write(renderDoctorReport(result));
         }
         return result.ok ? 0 : 1;
     });
 }
+/**
+ * --prefix / --no-prefix win; otherwise the directory-derived prefix
+ * create/init use, but only when one of its keys is set — unprefixed
+ * setups keep the bare SLACK_* default.
+ */
+function resolveDoctorEnvPrefix(options, dir) {
+    if (options.noPrefix === true) {
+        return undefined;
+    }
+    if (options.prefix !== undefined) {
+        return options.prefix;
+    }
+    const derived = envPrefixFromName(basename(dir));
+    const keys = slackEnvKeys(derived);
+    return process.env[keys.bot] !== undefined ||
+        process.env[keys.app] !== undefined
+        ? derived
+        : undefined;
+}
+// ============================================================================
+// create / destroy — Cursor "Add to Slack" managed provisioning
+// ============================================================================
+const DEFAULT_CONNECT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_CONNECT_POLL_TIMEOUT_MS = 5 * 60 * 1000;
+function resolveSlackAppTarget(options, err) {
+    var _a, _b;
+    if (options.env === "both" && options.prod !== true) {
+        err("Provisioning targets one env at a time; pass --prod for the prod app (default dev).\n");
+        return 1;
+    }
+    const env = options.prod === true || options.env === "prod" ? "prod" : "dev";
+    const dir = resolvePath(options.dir);
+    // Backend slug rule, mirrored so the error names the real problem
+    // instead of a generic 400.
+    const slug = slugFromDirectoryName(basename(dir));
+    if (slug === undefined || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(slug)) {
+        err(`Could not derive a valid app slug from the directory name ${JSON.stringify(basename(dir))} (slugs start with a letter or digit; lowercase letters, digits, '-', '_'); rename the directory or pass --dir <agent>.\n`);
+        return 1;
+    }
+    const name = (_a = options.name) !== null && _a !== void 0 ? _a : basename(dir);
+    const envPrefix = options.noPrefix === true
+        ? undefined
+        : ((_b = options.prefix) !== null && _b !== void 0 ? _b : envPrefixFromName(basename(dir)));
+    return { dir, name, slug, env, envPrefix, envKeys: slackEnvKeys(envPrefix) };
+}
+function errStream(options) {
+    var _a;
+    return (_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text));
+}
+const SLACK_ICON_MAX_BYTES = 524288;
+const SLACK_ICON_URL_MAX_LENGTH = 3000;
+const SLACK_ICON_CONTENT_TYPES = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+};
+function resolveSlackIconSource(raw, err) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (raw.startsWith("https://")) {
+            if (raw.length > SLACK_ICON_URL_MAX_LENGTH) {
+                err(`Icon URLs must be at most ${SLACK_ICON_URL_MAX_LENGTH} characters (got ${raw.length}).\n`);
+                return 1;
+            }
+            return { kind: "url", url: raw };
+        }
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)) {
+            err(`Icon URLs must be https (got ${JSON.stringify(raw)}).\n`);
+            return 1;
+        }
+        const path = resolvePath(raw);
+        const contentType = SLACK_ICON_CONTENT_TYPES[extname(path).toLowerCase()];
+        if (contentType === undefined) {
+            err(`Icon files must be .png, .jpg/.jpeg, or .gif (got ${JSON.stringify(basename(path))}).\n`);
+            return 1;
+        }
+        let data;
+        try {
+            data = yield readFile(path);
+        }
+        catch (error) {
+            err(`Could not read the icon file ${path}: ${describeError(error)}\n`);
+            return 1;
+        }
+        if (data.length > SLACK_ICON_MAX_BYTES) {
+            err(`Icon files must be at most ${SLACK_ICON_MAX_BYTES} bytes (${path} is ${data.length}).\n`);
+            return 1;
+        }
+        return { kind: "file", base64: data.toString("base64"), contentType, path };
+    });
+}
+function toSlackAppIconInput(source) {
+    return source.kind === "url"
+        ? { url: source.url }
+        : { base64: source.base64, contentType: source.contentType };
+}
+/**
+ * URL icons ride the provision request; file icons post to the icon
+ * endpoint afterwards. Best-effort: failures warn, never fail the create.
+ */
+function applySlackCreateIcon(ctx, source, result) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (source === undefined) {
+            return undefined;
+        }
+        let failure;
+        if (source.kind === "url") {
+            if (result.iconStatus !== "set") {
+                failure = "Slack did not accept the icon URL";
+            }
+        }
+        else {
+            try {
+                yield ctx.client.setAppIcon({
+                    teamId: ctx.teamId,
+                    slackAppId: result.appId,
+                    icon: toSlackAppIconInput(source),
+                });
+            }
+            catch (error) {
+                failure = describeError(error);
+            }
+        }
+        if (failure === undefined) {
+            return "set";
+        }
+        const retryWith = source.kind === "url" ? source.url : source.path;
+        ctx.err(`warning: setting the Slack app icon failed: ${failure}\nRetry with \`${CLI} slack icon ${retryWith}\`.\n`);
+        return "failed";
+    });
+}
+/**
+ * Credentials → provisioning client → team id, sharing the deploy CLI's
+ * resolution (stored login / CURSOR_API_KEY, `--team` override, GetMe
+ * default-team fallback). Returns an exit code (error already rendered)
+ * on failure.
+ */
+function prepareProvision(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((text) => void process.stdout.write(text));
+        const err = errStream(options);
+        const auth = yield resolveDeployAuth({
+            team: options.team,
+            apiKey: options.apiKey,
+            fetchImpl: options.fetchImpl,
+            err,
+        });
+        if (typeof auth === "number") {
+            return auth;
+        }
+        // Provisioning routes live on the external API host beside deploys.
+        return {
+            client: new AgentServeSlackClient({
+                backendUrl: cursorExternalApiUrl(),
+                apiKey: auth.apiKey,
+                fetchImpl: options.fetchImpl,
+            }),
+            teamId: auth.teamId,
+            json: options.json === true,
+            out,
+            err,
+            openBrowserImpl: (_b = options.openBrowserImpl) !== null && _b !== void 0 ? _b : openBrowser,
+            pollIntervalMs: (_c = options.connectPollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_CONNECT_POLL_INTERVAL_MS,
+            pollTimeoutMs: (_d = options.connectPollTimeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_CONNECT_POLL_TIMEOUT_MS,
+        };
+    });
+}
+/** "Name (T0123ABCD)", or the bare id when the backend has no name. */
+function formatWorkspace(workspace) {
+    var _a;
+    const name = (_a = workspace.slackTeamName) !== null && _a !== void 0 ? _a : "";
+    return name === ""
+        ? workspace.slackTeamId
+        : `${name} (${workspace.slackTeamId})`;
+}
+function matchConnectedWorkspace(workspaces, wait) {
+    const candidates = wait.slackTeamId === undefined
+        ? workspaces
+        : workspaces.filter((workspace) => workspace.slackTeamId === wait.slackTeamId);
+    if (wait.notConnectedAt === undefined) {
+        return candidates[0];
+    }
+    return candidates.find((workspace) => workspace.connectedAt !== wait.notConnectedAt);
+}
+/**
+ * Mint the browser consent URL, open it, and poll `GET /status` until the
+ * awaited workspace shows up (or the poll times out). Returns the
+ * connected workspace, or an exit code with the error already rendered.
+ */
+function runConnectFlow(ctx, wait) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let url;
+        try {
+            url = yield ctx.client.connect(ctx.teamId);
+        }
+        catch (error) {
+            return renderSlackApiError(error, ctx.err);
+        }
+        ctx.err(`\nConnect your Slack workspace to Cursor — approve in the browser:\n\n  ${url}\n\n` +
+            `After approving in Slack you land on cursor.com, which links the workspace to your Cursor account — sign in there if the browser is not already signed in as you.\n\n` +
+            `(waiting for the Slack consent to complete, up to ${Math.round(ctx.pollTimeoutMs / 60000)} minutes)\n`);
+        ctx.openBrowserImpl(url);
+        const deadline = Date.now() + ctx.pollTimeoutMs;
+        let lastPollFailure;
+        for (;;) {
+            let workspace;
+            let sleepMs = ctx.pollIntervalMs;
+            try {
+                const status = yield ctx.client.status(ctx.teamId);
+                workspace = matchConnectedWorkspace(status.workspaces, wait);
+                lastPollFailure = undefined;
+            }
+            catch (error) {
+                // Transient poll failures must not abort a minted consent flow; only
+                // a still-failing poll at the deadline surfaces the error.
+                if (Date.now() >= deadline) {
+                    return renderSlackApiError(error, ctx.err);
+                }
+                const failure = describeError(error);
+                if (failure !== lastPollFailure) {
+                    lastPollFailure = failure;
+                    ctx.err(`(status poll failed, retrying: ${failure})\n`);
+                }
+                if (error instanceof SlackProvisionApiError &&
+                    error.retryAfterSeconds !== undefined) {
+                    // Respect backend backpressure instead of hammering at the poll rate.
+                    sleepMs = Math.max(sleepMs, error.retryAfterSeconds * 1000);
+                }
+            }
+            if (workspace !== undefined) {
+                ctx.err(`Connected Slack workspace ${workspace.slackTeamId}.\n`);
+                return workspace;
+            }
+            if (Date.now() >= deadline) {
+                ctx.err(`Timed out waiting for the Slack workspace connection. The consent link stays valid for ~10 minutes — approve it, finish the sign-in on cursor.com, then re-run \`${CLI} slack create\`.\n`);
+                return 1;
+            }
+            yield sleep(sleepMs);
+        }
+    });
+}
+export function cmdSlackCreate(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const target = resolveSlackAppTarget(options, errStream(options));
+        if (typeof target === "number") {
+            return target;
+        }
+        // Resolved before any network I/O so a bad path/type/size fails fast.
+        let iconSource;
+        if (options.icon !== undefined) {
+            const resolved = yield resolveSlackIconSource(options.icon, errStream(options));
+            if (typeof resolved === "number") {
+                return resolved;
+            }
+            iconSource = resolved;
+        }
+        const ctx = yield prepareProvision(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        // Workspace: --slack-team wins; one → use it; none → connect; several → ask.
+        let status;
+        try {
+            status = yield ctx.client.status(ctx.teamId);
+        }
+        catch (error) {
+            return renderSlackApiError(error, ctx.err);
+        }
+        let workspace;
+        if (options.slackTeam !== undefined) {
+            workspace = status.workspaces.find((candidate) => candidate.slackTeamId === options.slackTeam);
+        }
+        else if (status.workspaces.length === 1) {
+            workspace = status.workspaces[0];
+        }
+        else if (status.workspaces.length > 1) {
+            ctx.err(`Multiple Slack workspaces are connected:\n` +
+                status.workspaces
+                    .map((candidate) => `  - ${formatWorkspace(candidate)} (Slack user ${candidate.slackUserId}, connected ${candidate.connectedAt})\n`)
+                    .join("") +
+                `Pass --slack-team <id> to pick one.\n`);
+            return 1;
+        }
+        if (workspace === undefined) {
+            const connected = yield runConnectFlow(ctx, {
+                slackTeamId: options.slackTeam,
+            });
+            if (typeof connected === "number") {
+                return connected;
+            }
+            workspace = connected;
+        }
+        let wrote;
+        try {
+            wrote = yield scaffoldSlackChannelFiles(options, target);
+        }
+        catch (error) {
+            ctx.err(`${describeError(error)}\n`);
+            return 1;
+        }
+        if (wrote.length > 0 && !ctx.json) {
+            ctx.err(`Scaffolded the Slack channel: ${wrote.join(", ")}\n`);
+        }
+        // A re-run rebuilds this manifest from flags, so backend-side
+        // customizations reset to it (documented in the skill).
+        const manifest = buildSlackManifest({
+            name: target.name,
+            env: target.env,
+            channelPosts: options.channelPosts === true,
+        });
+        const manifestJson = JSON.stringify(manifest);
+        // One connect-and-retry for not_connected / insufficient_scopes /
+        // manager_reauth_required (all fixed by a fresh consent grant).
+        let result;
+        let connectRetried = false;
+        for (;;) {
+            try {
+                result = yield ctx.client.provisionApp({
+                    teamId: ctx.teamId,
+                    slackTeamId: workspace.slackTeamId,
+                    slug: target.slug,
+                    env: target.env,
+                    manifest: manifestJson,
+                    icon: (iconSource === null || iconSource === void 0 ? void 0 : iconSource.kind) === "url" ? { url: iconSource.url } : undefined,
+                    force: options.force === true ? true : undefined,
+                });
+                break;
+            }
+            catch (error) {
+                if (error instanceof SlackProvisionApiError &&
+                    (error.code === "not_connected" ||
+                        error.code === "insufficient_scopes" ||
+                        error.code === "manager_reauth_required") &&
+                    !connectRetried) {
+                    connectRetried = true;
+                    // All three codes arrive holding a row that GET /status already
+                    // lists, so the poll waits for a fresh grant instead of re-matching
+                    // that row.
+                    const wait = {
+                        slackTeamId: workspace.slackTeamId,
+                        notConnectedAt: workspace.connectedAt,
+                    };
+                    if (error.code === "insufficient_scopes") {
+                        ctx.err(`The Slack connection is missing scopes provisioning needs; approving the consent link again grants them.\n`);
+                    }
+                    else if (error.code === "manager_reauth_required") {
+                        ctx.err(`Slack revoked Cursor's authorization for workspace ${workspace.slackTeamId}; re-approving the consent link restores it.\n`);
+                    }
+                    else {
+                        ctx.err(`The Slack workspace is not connected to Cursor; starting the connect flow.\n`);
+                    }
+                    const connected = yield runConnectFlow(ctx, wait);
+                    if (typeof connected === "number") {
+                        return connected;
+                    }
+                    workspace = connected;
+                    continue;
+                }
+                return renderCreateProvisionError(error, ctx.err);
+            }
+        }
+        const iconStatus = yield applySlackCreateIcon(ctx, iconSource, result);
+        if (result.status === "pending_admin_approval") {
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify({
+                    ok: false,
+                    appId: result.appId,
+                    status: result.status,
+                    slackTeamId: workspace.slackTeamId,
+                    envKeys: target.envKeys,
+                    wrote,
+                    oauthAuthorizeUrl: (_a = result.oauthAuthorizeUrl) !== null && _a !== void 0 ? _a : null,
+                    iconStatus,
+                }, null, 2)}\n`);
+            }
+            else {
+                ctx.err(`The Slack app was created (app ${result.appId}), but installing it needs a Slack workspace-admin approval.\n` +
+                    (result.oauthAuthorizeUrl === undefined
+                        ? ""
+                        : `\n  Approve it (or send this to a workspace admin):\n\n    ${result.oauthAuthorizeUrl}\n\n`) +
+                    `Once an admin approves the app, re-run \`${CLI} slack create\` to finish the install and mint the tokens.\n`);
+            }
+            return 1;
+        }
+        // Tokens come back exactly once and are never printed.
+        const envEntries = [{ key: target.envKeys.bot, value: result.botToken }];
+        if (result.appToken !== undefined) {
+            envEntries.push({ key: target.envKeys.app, value: result.appToken });
+        }
+        const envFile = join(target.dir, ".env.local");
+        try {
+            yield upsertEnvFile(envFile, envEntries);
+            if (yield ensureEnvLocalGitignored(target.dir)) {
+                wrote.push(".gitignore (+.env.local)");
+            }
+        }
+        catch (error) {
+            ctx.err(`Could not write ${envFile}: ${describeError(error)}\n`);
+            return 1;
+        }
+        wrote.push(".env.local");
+        for (const { key, value } of envEntries) {
+            process.env[key] = value;
+        }
+        if (result.appToken === undefined) {
+            ctx.err(`warning: Slack did not return an app-level token, so ${target.envKeys.app} was not written (an existing value was left as-is and may belong to an older app); re-run \`${CLI} slack create\` to recover it.\n`);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({
+                ok: true,
+                appId: result.appId,
+                status: result.status,
+                slackTeamId: workspace.slackTeamId,
+                envKeys: target.envKeys,
+                wrote,
+                iconStatus,
+            }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Provisioned the ${target.env} Slack app for ${target.slug} (app ${result.appId}) in workspace ${workspace.slackTeamId}.\n` +
+            `  wrote ${envEntries.map((entry) => entry.key).join(" + ")} to ${envFile}\n\n`);
+        const doctor = (_b = options.doctorImpl) !== null && _b !== void 0 ? _b : runSlackDoctor;
+        const doctorResult = yield doctor(target.envPrefix === undefined ? {} : { envPrefix: target.envPrefix });
+        ctx.out(renderDoctorReport(doctorResult));
+        ctx.out(`\nNext steps:\n` +
+            `  1. ${CLI} dev ${options.dir}\n` +
+            `  2. In Slack, invite @${manifest.features.bot_user.display_name} to a channel and @mention it (or DM it).\n`);
+        return 0;
+    });
+}
+/**
+ * Resolve the one provisioned app for (slug, env[, --slack-team]) from
+ * `GET /status`. Returns an exit code with the error already rendered
+ * when zero or several apps match.
+ */
+function resolveProvisionedApp(ctx, target, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let status;
+        try {
+            status = yield ctx.client.status(ctx.teamId);
+        }
+        catch (error) {
+            return renderSlackApiError(error, ctx.err);
+        }
+        const sameSlug = status.apps.filter((app) => app.slug === target.slug);
+        let candidates = sameSlug.filter((app) => app.env === target.env);
+        if (options.slackTeam !== undefined) {
+            candidates = candidates.filter((app) => app.slackTeamId === options.slackTeam);
+        }
+        if (candidates.length === 0) {
+            ctx.err(`No provisioned ${target.env} Slack app for "${target.slug}"${options.slackTeam === undefined
+                ? ""
+                : ` in workspace ${options.slackTeam}`} (team ${ctx.teamId}).\n` +
+                (sameSlug.length === 0
+                    ? ""
+                    : `Provisioned apps for this agent:\n${formatAppList(sameSlug)}`));
+            return 1;
+        }
+        if (candidates.length > 1) {
+            ctx.err(`Multiple provisioned Slack apps match "${target.slug}" (${target.env}):\n` +
+                formatAppList(candidates) +
+                `Pass --slack-team <id> to pick one.\n`);
+            return 1;
+        }
+        return candidates[0];
+    });
+}
+export function cmdSlackDestroy(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const target = resolveSlackAppTarget(options, errStream(options));
+        if (typeof target === "number") {
+            return target;
+        }
+        const ctx = yield prepareProvision(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const app = yield resolveProvisionedApp(ctx, target, options);
+        if (typeof app === "number") {
+            return app;
+        }
+        try {
+            yield ctx.client.deleteApp({
+                teamId: ctx.teamId,
+                slackAppId: app.slackAppId,
+            });
+        }
+        catch (error) {
+            return renderSlackApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({
+                ok: true,
+                deleted: true,
+                appId: app.slackAppId,
+                slackTeamId: app.slackTeamId,
+                slug: target.slug,
+                env: target.env,
+            }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Deleted the ${target.env} Slack app for ${target.slug} (app ${app.slackAppId}) from workspace ${app.slackTeamId}.\n` +
+            `Tokens in .env.local were left in place — ${target.envKeys.bot} / ${target.envKeys.app} are now inert; remove them whenever you like.\n`);
+        return 0;
+    });
+}
+export function cmdSlackIcon(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const err = errStream(options);
+        if (options.iconSource === undefined) {
+            err(`Usage: ${CLI} slack icon <https-url-or-file> [--dir .] [--slack-team T0123ABCD] [--prod] [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const source = yield resolveSlackIconSource(options.iconSource, err);
+        if (typeof source === "number") {
+            return source;
+        }
+        const target = resolveSlackAppTarget(options, err);
+        if (typeof target === "number") {
+            return target;
+        }
+        const ctx = yield prepareProvision(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const app = yield resolveProvisionedApp(ctx, target, options);
+        if (typeof app === "number") {
+            return app;
+        }
+        try {
+            yield ctx.client.setAppIcon({
+                teamId: ctx.teamId,
+                slackAppId: app.slackAppId,
+                icon: toSlackAppIconInput(source),
+            });
+        }
+        catch (error) {
+            return renderSlackApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({
+                ok: true,
+                appId: app.slackAppId,
+                slackTeamId: app.slackTeamId,
+                slug: target.slug,
+                env: target.env,
+                iconStatus: "set",
+            }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Set the icon for the ${target.env} Slack app for ${target.slug} (app ${app.slackAppId}).\n`);
+        return 0;
+    });
+}
+function formatAppList(apps) {
+    return apps
+        .map((app) => `  - ${app.slackAppId} (${app.env}) in workspace ${app.slackTeamId} — ${app.installStatus}\n`)
+        .join("");
+}
+/**
+ * Scaffold the channel files when the channel file is absent. Existing
+ * files are never overwritten: initSlackChannel writes with `wx`, and
+ * EEXIST means "already scaffolded" (provisioning builds its manifest in
+ * memory and does not need the on-disk copies).
+ */
+function scaffoldSlackChannelFiles(options, target) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const channelFile = "agent/channels/slack.ts";
+        if (yield fileExists(join(target.dir, channelFile))) {
+            return [];
+        }
+        try {
+            // Pass the resolved name/prefix so the channel file and the env keys
+            // share one derivation.
+            const result = yield initSlackChannel({
+                dir: target.dir,
+                name: target.name,
+                envPrefix: (_a = target.envPrefix) !== null && _a !== void 0 ? _a : "",
+                channelPosts: options.channelPosts,
+            });
+            return result.files;
+        }
+        catch (error) {
+            if (isErrnoException(error) && error.code === "EEXIST") {
+                // The channel file is written first, so it exists by the time a
+                // later pre-existing file aborts the scaffold.
+                return (yield fileExists(join(target.dir, channelFile)))
+                    ? [channelFile]
+                    : [];
+            }
+            throw error;
+        }
+    });
+}
+/**
+ * Append `KEY=value` lines to an env file, replacing every existing line
+ * for the same key instead of appending duplicates. Creates the file when
+ * missing.
+ */
+function upsertEnvFile(path, entries) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let existing = "";
+        try {
+            existing = yield readFile(path, "utf8");
+        }
+        catch (error) {
+            if (!isErrnoException(error) || error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        const lines = existing === "" ? [] : existing.replace(/\r?\n$/, "").split(/\r?\n/);
+        // A stale `export KEY=…` line would shadow or duplicate the bare line
+        // under some loaders; treat both spellings as the same entry.
+        const matchesKey = (line, key) => line.startsWith(`${key}=`) || line.startsWith(`export ${key}=`);
+        for (const { key, value } of entries) {
+            const next = `${key}=${value}`;
+            let replaced = false;
+            for (let i = 0; i < lines.length;) {
+                if (!matchesKey((_a = lines[i]) !== null && _a !== void 0 ? _a : "", key)) {
+                    i += 1;
+                    continue;
+                }
+                if (replaced) {
+                    lines.splice(i, 1);
+                    continue;
+                }
+                lines[i] = next;
+                replaced = true;
+                i += 1;
+            }
+            if (!replaced) {
+                lines.push(next);
+            }
+        }
+        // writeFile's mode only applies on create; clamp pre-existing files too.
+        yield writeFile(path, `${lines.join("\n")}\n`, { mode: 0o600 });
+        yield chmod(path, 0o600);
+    });
+}
+/**
+ * Ensure the agent directory's .gitignore covers .env.local (create or
+ * append). A bare `.env` line does not count — that pattern matches only
+ * the file literally named .env.
+ */
+function ensureEnvLocalGitignored(dir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const path = join(dir, ".gitignore");
+        let existing = "";
+        try {
+            existing = yield readFile(path, "utf8");
+        }
+        catch (error) {
+            if (!isErrnoException(error) || error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        const covered = existing
+            .split(/\r?\n/)
+            .some((line) => /^\.env(\.local\*?|\.\*|\*)$/.test(line.trim()));
+        if (covered) {
+            return false;
+        }
+        const next = existing === "" || existing.endsWith("\n")
+            ? `${existing}.env.local\n`
+            : `${existing}\n.env.local\n`;
+        yield writeFile(path, next);
+        return true;
+    });
+}
+function renderDoctorReport(result) {
+    let text = `env: ${result.envKeys.bot} / ${result.envKeys.app}\n`;
+    for (const check of result.checks) {
+        text += `${check.ok ? "ok" : "!!"}  ${check.id}: ${check.message}\n`;
+    }
+    text += result.ok ? "doctor: pass\n" : "doctor: fail\n";
+    return text;
+}
+/**
+ * Actionable rendering for `POST /apps` failures the create flow does not
+ * retry itself (the connect-and-retry codes are handled by the caller).
+ */
+function renderCreateProvisionError(error, err) {
+    var _a;
+    if (!(error instanceof SlackProvisionApiError)) {
+        throw error;
+    }
+    switch (error.code) {
+        case "app_conflict":
+            err(`${error.message}\nA concurrent \`${CLI} slack create\` for this agent won the race; re-run create to pick up that app.\n`);
+            return 1;
+        case "app_cap_reached":
+            err(`${error.message}\nDelete unused apps with \`${CLI} slack destroy\`, then re-run create.\n`);
+            return 1;
+        case "ratelimited":
+            err(`${error.message}\nRe-run \`${CLI} slack create\` after the wait.\n`);
+            return 1;
+        case "invalid_app_id":
+            err(`${error.message}\nThe provisioned Slack app seems to have been deleted outside Cursor. Run \`${CLI} slack destroy\` to drop the stale record, then re-run \`${CLI} slack create\`.\n`);
+            return 1;
+        case "manifest_drift":
+            err(`${error.message}\n` +
+                ((_a = error.changedPaths) !== null && _a !== void 0 ? _a : []).map((path) => `  - ${path}\n`).join("") +
+                `Re-run \`${CLI} slack create --force\` to overwrite those edits.\n`);
+            return 1;
+        default:
+            return renderSlackApiError(error, err);
+    }
+}
+function renderSlackApiError(error, err) {
+    if (!(error instanceof SlackProvisionApiError)) {
+        throw error;
+    }
+    err(error.code === "manager_reauth_required"
+        ? // There is no standalone connect command: create runs the consent
+            // flow before provisioning.
+            `${error.message}\nRe-approve the Slack consent by re-running \`${CLI} slack create\`, which reconnects the workspace first.\n`
+        : `${error.message}\n`);
+    return 1;
+}
+function fileExists(path) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield access(path);
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+function isErrnoException(error) {
+    return error instanceof Error && "code" in error;
+}
+function sleep(ms) {
+    return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}