@cursor/july 0.1.49 → 0.1.51

package/skills/setup-slack/SKILL.md

@@ -1,34 +1,34 @@
 ---
 name: agentkit-setup-slack
 description: >-
-  Put an Agent SDK agent in Slack. Covers the required connection decision
-  (Cursor-hosted connection vs dedicated Socket Mode Slack app) with an
-  AskQuestion gate, then both setup paths end to end — cursorAccount
-  sign-in + smoke, or manifests, tokens, doctor, smoke test, and opt-in
-  Slack tool approvals (HITL). Read this skill when wiring Slack for an
-  Agent SDK project.
+  Wire Slack to an Agent SDK agent. Gate Cursor-hosted vs a dedicated
+  Socket Mode app, then finish that path: cursorAccount sign-in + smoke,
+  or slack create via the dashboard wizard, doctor, and optional HITL.
+  Use when adding Slack to an agent.
 ---
 
 # Setup Slack for the Agent SDK
 
 Use this skill when a human asks to wire Slack to an Agent SDK agent.
 
-There are **two ways to connect**, and they differ mostly in setup cost:
+There are **two ways to connect**:
 
 - **Path A — Cursor-hosted connection**
   (`slackChannel({ cursorAccount: true })`): rides the Cursor Slack
   integration already installed in the workspace. No Slack app, no
-  manifests, no tokens, no Slack admin. Live in minutes.
+  tokens, no Slack admin. Live in minutes.
 - **Path B — Dedicated Slack app** (Socket Mode): the agent's own bot
-  user, created from generated manifests with an `xoxb-…` + `xapp-…`
-  token pair. Required for channel watching, approval buttons, or a
-  distinct bot handle. When the workspace is enrolled in Cursor's
-  **Add to Slack** (feature gate + a workspace-manager consent),
-  `agent-sdk slack create` provisions all of it in one command.
+  user. `agent-sdk slack create` opens a signed-in Cursor dashboard
+  wizard; Slack consent and the bot name happen there. Tokens land in
+  `.env.local` and as deployment secrets. Required for channel watching,
+  approval buttons, or a distinct bot handle.
 
-**Do not generate manifests or ask for tokens until the decision below
-is made.** Defaulting into Path B buries the user in Slack admin work
-(two app creations, token minting, env wiring) they may not need.
+Do not generate manifests or ask anyone to paste tokens. Defaulting into
+Path B buries the user in Slack admin work they may not need.
+
+Existing DIY bots that already have `<PREFIX>_SLACK_BOT_TOKEN` and
+`_SLACK_APP_TOKEN` in `.env.local` keep working. Do not force them onto
+the wizard.
 
 ## Step 0 — Choose the connection (required gate)
 
@@ -36,8 +36,8 @@ Walk the user through the tradeoffs before touching files:
 
 | | A: Cursor-hosted | B: Dedicated Slack app |
 | --- | --- | --- |
-| Setup | Zero Slack admin — sign the host in (`agent-sdk login` / `CURSOR_API_KEY`) and serve | Enrolled in Cursor's Add to Slack: one `agent-sdk slack create` per env (app + install + tokens, signed-in host). Otherwise: a Slack admin creates **two** apps (dev + prod) from manifests, installs them, mints `xoxb-…` + `xapp-…` for each |
-| Prereq | Cursor Slack integration installed in the workspace and linked to the Cursor account | Permission to create Slack apps; token storage/rotation is on you |
+| Setup | Zero Slack admin: sign the host in (`agent-sdk login` / `CURSOR_API_KEY`) and serve | One `agent-sdk slack create` per env. Finish in the dashboard wizard (Slack consent + bot name). Tokens are never shown. |
+| Prereq | Cursor Slack integration installed in the workspace and linked to the Cursor account | Agent Serve access (`agent-sdk login`) and permission to approve a Slack app |
 | How users reach it | `@Cursor <AgentName> …`, DMs to @Cursor, replies in claimed threads | Its own bot user: @mention, DM, channel invites |
 | Identity | Posts as the Cursor app under the agent's name + icon | Own app name, avatar, and handle |
 | Channel watching (dispatch without a mention) | Not available | `engagement.channelPosts` allowlist |
@@ -45,7 +45,7 @@ Walk the user through the tradeoffs before touching files:
 | Reply delivery | Status while working, then one final post (no streaming edits) | Streaming replies with postMessage fallback |
 | Multi-agent hosts | Any number of agents, unique `agentName` each, no extra Slack apps | One Slack app + token pair **per agent** |
 
-Decision shortcuts — skip the question when the request already decides:
+Decision shortcuts; skip the question when the request already decides:
 
 - Needs channel watching, Approve/Deny buttons, `onBlockAction`, or its
   own bot user / handle → **Path B**. Say which requirement forced it.
@@ -56,19 +56,19 @@ Decision shortcuts — skip the question when the request already decides:
 
 ### Collect the decision with AskQuestion
 
-Otherwise ask — one single-select question via the `AskQuestion` tool,
+Otherwise ask. One single-select question via the `AskQuestion` tool,
 recommended option first so one click accepts it:
 
 - **Cursor-hosted Slack connection (recommended)** — zero Slack setup;
   sign in and mention `@Cursor <AgentName>`. No channel watching or
   approval buttons.
 - **Dedicated Slack app (Socket Mode)** — own bot user, channel
-  watching, approval buttons; needs a Slack admin to create two apps
-  and mint tokens.
+  watching, approval buttons. `agent-sdk slack create` opens the
+  dashboard wizard.
 
 If `AskQuestion` is unavailable in your environment, or the user does
 not answer, **default to Path A (Cursor-hosted)**: state the assumption
-in one line and proceed. It is the reversible choice — a dedicated app
+in one line and proceed. It is the reversible choice. A dedicated app
 can be added later as a *second* channel file without losing anything.
 Never mix both in one channel definition: `cursorAccount: true` rejects
 `credentials` / `envPrefix` at construction.
@@ -80,8 +80,8 @@ threaded reply. No Slack app, no tokens, no manifests.
 
 ### A1 — Author the channel (agent)
 
-Write `agent/channels/slack.ts` by hand — do **not** run
-`agent-sdk slack init` (that scaffolds the Path B manifests + env):
+Write `agent/channels/slack.ts` by hand. Do not run `slack create` for
+this path:
 
 ```ts
 import { slackChannel } from "@cursor/july/channels/slack";
@@ -94,7 +94,7 @@ export default slackChannel({
 ```
 
 `agentName` defaults from the mount slug (PascalCase) and must be a
-single token — string literals with spaces fail typecheck; runtime
+single token. String literals with spaces fail typecheck; runtime
 values throw at construction/serve. Names must be unique on the host;
 an unmatched `@Cursor <name>` stays with Cursor's normal Slack agent.
 External senders (Slack Connect / guests / other workspaces) are
@@ -117,7 +117,7 @@ An unsigned host fails `serve` with a sign-in hint naming the channel.
    `@Cursor MyAgent <question>` (or DM @Cursor)
 2. Confirm a working status while the turn runs, then a threaded reply
    posted under the agent's name and icon
-3. Reply in the thread without re-mentioning — it stays with the agent
+3. Reply in the thread without re-mentioning; it stays with the agent
 
 ### Path A limits (enforced at construction)
 
@@ -135,109 +135,47 @@ cursor-account channel and add a Path B channel file beside it.
 
 ## Path B — Dedicated Slack app (Socket Mode)
 
-Goal:
-
-- Importable **dev** and **prod** Slack app manifests (Socket Mode on)
-- App-level Token (`xapp-…`, `connections:write`) + Bot token (`xoxb-…`)
-- No public Request URL (Socket Mode only)
-- Thread ↔ session via `continuationToken = channelId:threadTs`
-- One Slack app (token pair) **per agent** when serving multiple demos
-
-Update `.agent-serve/slack/setup-status.json` as you complete phases.
-
-### Provisioned variant — `agent-sdk slack create` (primary when enrolled)
-
-When the Slack workspace is enrolled in Cursor's **Add to Slack**
-(the provisioning feature gate plus a workspace-manager consent), one
-command collapses Phases 0–3 — manifest import, app creation, install,
-and token minting:
+Goal: one dedicated bot per agent, tokens in `.env.local`, local serve
+without a cloud deploy. The dashboard wizard is the only first-run.
 
 ```bash
-agent-sdk slack create --dir <agent>          # dev app (default)
-agent-sdk slack create --dir <agent> --prod   # prod app
+agent-sdk login
+agent-sdk slack create --dir .
 ```
 
-`create` scaffolds `agent/channels/slack.ts` + the `.agent-serve/slack`
-files when missing (never overwriting existing ones), runs the browser
-consent flow when the workspace is not connected yet, provisions +
-installs the app, writes `<PREFIX>_SLACK_BOT_TOKEN` /
-`<PREFIX>_SLACK_APP_TOKEN` into `<dir>/.env.local` (replacing stale
-lines), and finishes with `doctor`. It needs a signed-in host
-(`agent-sdk login` / `CURSOR_API_KEY`). Pass `--slack-team <id>` when
-several workspaces are connected. If the install lands in
-`pending_admin_approval`, a Slack workspace admin must approve the
-printed link — then re-run `create` to finish and mint the tokens.
-`agent-sdk slack destroy` deletes the provisioned app (tokens left in
-`.env.local` simply stop working). Skip to Phase 4 when `create`
-succeeds — `dev`/`serve` load the agent's `.env.local` (real env wins).
-Note: re-running `create` rebuilds the app manifest from the command's
-flags, so any customization made outside the CLI resets to it.
-
-If the command reports the feature gate is not enabled (the workspace
-is not enrolled), fall back to the manual manifest-import flow below
-(Phases 0–3).
-
-### Phase 0 — Generate (agent)
-
-```bash
-pnpm exec tsx packages/agent-serve/src/bin/agent-serve.ts slack init \
-  --dir <agent> --name "My Agent"
-```
-
-Creates:
-
-- `agent/channels/slack.ts` with `envPrefix` from the directory name
-- `.agent-serve/slack/manifest.{dev,prod}.json`
-- `.agent-serve/slack/env.example` (`<PREFIX>_SLACK_BOT_TOKEN` / `_APP_TOKEN`)
-
-Use `--no-prefix` for the shared `SLACK_BOT_TOKEN` / `SLACK_APP_TOKEN` globals
-(single-agent only). Use `--prefix CUSTOM` to override the default prefix.
-
-These files deliberately omit `settings.managed_app_settings` — Slack accepts
-that block only from a manager app's user token, so it belongs to the
-`slack create` path, not to a manifest a human pastes in.
-
-### Phase 1 — Create apps (human)
+That opens the signed-in Cursor dashboard. Sign in as the same Cursor
+account that ran the command. Click **Add Slack to this agent**, approve
+Slack's consent screen, pick the bot name, and continue. The CLI waits
+and writes `<PREFIX>_SLACK_BOT_TOKEN` / `<PREFIX>_SLACK_APP_TOKEN` into
+`<dir>/.env.local`, then runs `doctor`. Token values never print.
 
-1. Open https://api.slack.com/apps → **Create New App** → **From a manifest**
-2. Paste `manifest.dev.json` → create the *dev* app
-3. Repeat with `manifest.prod.json` for prod
+`--prod` provisions the prod app (default is dev). `--name` / `--icon` /
+`--channel-posts` prefill the wizard. `--prefix` / `--no-prefix` set the
+env-var names.
 
-Stop and ask the human to complete this gate.
+If Slack asks a workspace admin to approve the app, keep the CLI
+running. Open Slack's **Request approval** page (the CLI prints the
+link; the same URL is **Send a reminder** after you submit). Managed
+install does not file the request. After an admin approves, click
+**Retry** in the wizard.
 
-### Phase 2 — Install + tokens (human)
+`create` scaffolds `agent/channels/slack.ts` when missing. Do not paste
+a manifest at api.slack.com. `slack init` is removed.
 
-For each app:
+Existing tokens in `.env.local` keep working. Skip the wizard for those
+agents unless you want a Cursor-managed app.
 
-1. **Install to Workspace** — copy Bot User OAuth Token (`xoxb-…`)
-2. **Basic Information → App-Level Tokens** — Create Token with scope `connections:write` → copy (`xapp-…`)
-
-### Phase 3 — Env (agent)
-
-Write into `.env.local` (dev app), using the keys from `env.example`:
-
-```bash
-MY_AGENT_SLACK_BOT_TOKEN=xoxb-…
-MY_AGENT_SLACK_APP_TOKEN=xapp-…
-```
+Then:
 
 ```bash
 agent-sdk slack doctor --prefix MY_AGENT
-```
-
-Stop when `app_token`, `connections_open`, `bot_token`, and `auth_test` are green.
-
-### Phase 4 — Serve + smoke (agent + human)
-
-```bash
 agent-sdk dev .
 ```
 
 Confirm log: `[agent-sdk/slack] Socket Mode connected`.
 
 When tokens are missing the channel logs
-`channel idle reason=missing credentials need=…` and `serve` continues — useful
-when mounting a folder of agents where only some have tokens.
+`channel idle reason=missing credentials need=…` and `serve` continues.
 
 Human:
 
@@ -249,6 +187,15 @@ Human:
    - `session start …`
    - `reply delivered via postMessage|stream …`
 
+The dashboard lists a first-run agent as **Not deployed yet**. Local
+serve does not need a hosted engine. The next `agent-sdk deploy` (or
+dashboard **Deploy**) injects the stored secrets.
+
+A second `slack create` for the same agent and env overwrites that Slack
+app. It keeps the Slack app id and replaces the manifest and tokens.
+`agent-sdk slack destroy` deletes the provisioned app. Tokens left in
+`.env.local` simply stop working.
+
 ## Features (defaults ON)
 
 - Chat streaming (`chat.startStream` / `appendStream` / `stopStream`) with postMessage fallback (Path B; Path A posts one final reply)
@@ -262,7 +209,7 @@ If a Slack API is unavailable (`method_not_found` / `missing_scope`), the pack f
 
 ## Engagement: mentions by default, channel watch opt-in (Path B only)
 
-The pack dispatches only on `app_mention` + DMs unless told otherwise —
+The pack dispatches only on `app_mention` + DMs unless told otherwise:
 summoned, never proactive. To watch channels (dispatch on new posts without
 a mention), opt in explicitly:
 
@@ -279,9 +226,9 @@ export default slackChannel({
 });
 ```
 
-Requirements: generate manifests with `slack init --channel-posts` (or add
-`message.channels` / `message.groups` events + re-import), and invite the
-bot to each watched channel. Posts mentioning the bot stay on the
+Pass `--channel-posts` on `slack create` so the wizard-built app
+subscribes to `message.channels` / `message.groups`. Invite the bot to
+each watched channel. Posts mentioning the bot stay on the
 `app_mention` path; watch sessions reuse the thread-scoped principal with an
 `engagement: "channel_post"` attribute, so a later mention continues the
 thread. `engagement.mentions` / `engagement.directMessages` can be set to
@@ -290,7 +237,7 @@ thread. `engagement.mentions` / `engagement.directMessages` can be set to
 ## Tool approvals over Slack (opt-in HITL, Path B only)
 
 Tools with `needsApproval` park until a human approves or denies. To route
-that through Slack, set `toolApprovals: true` on `slackChannel` — it posts
+that through Slack, set `toolApprovals: true` on `slackChannel`. It posts
 Block Kit Approve/Deny cards and routes Socket Mode `interactive` clicks
 back to the parked call:
 
@@ -303,10 +250,9 @@ export default slackChannel({
 
 Requirements and caveats:
 
-- The Slack app manifest needs **interactivity** enabled
-  (`buildSlackManifest({ interactivity: true })`; `toolApprovals: true`
-  implies the Socket Mode routing, but the app must allow it). Re-import
-  the manifest after changing this.
+- The Slack app needs **interactivity** enabled. The wizard turns this
+  on when `toolApprovals` is in play; `buildSlackManifest({ interactivity: true })`
+  is the same switch for existing apps.
 - Composing by hand: spread `buildToolApprovalEvents({ credentials })` into
   `events` **and** set `interactivity: true` on the channel.
 - Cards show **redacted / truncated** args (Block Kit limits); execution
@@ -323,27 +269,23 @@ Requirements and caveats:
 ## Notes
 
 - Dev and prod are **separate Slack apps** (separate tokens) on Path B.
-  Path A has no per-env app split — the host's Cursor account decides
+  Path A has no per-env app split; the host's Cursor account decides
   where it relays.
-- Socket Mode / the Cursor relay are outbound only — no Events HTTP /
+- Socket Mode / the Cursor relay are outbound only. No Events HTTP /
   Request URL path on either connection.
-- Do not `await waitForCompletion()` inside Slack dispatch handlers — the pack uses `waitUntil`.
+- Do not `await waitForCompletion()` inside Slack dispatch handlers. The pack uses `waitUntil`.
 - Do not share one token pair across multiple agents in the same process.
 
 ## CLI reference
 
-`slack create` / `destroy` / `init` / `manifest` / `doctor` are Path B
-tooling; Path A needs only `login`.
+Path B tooling is `create` / `destroy` / `icon` / `doctor`. Path A needs
+only `login`. `slack setup` prints this chooser. `slack init` hard-errors.
 
 ```bash
 agent-sdk slack setup
-agent-sdk slack create --dir .                     # provision via Add to Slack (dev app)
+agent-sdk slack create --dir .                     # dashboard wizard (dev app)
 agent-sdk slack create --dir . --prod              # prod app
 agent-sdk slack create --dir . --slack-team T0123ABCD
 agent-sdk slack destroy --dir . [--prod] [--slack-team T0123ABCD]
-agent-sdk slack init --dir . --name "My Agent"
-agent-sdk slack init --dir . --no-prefix
-agent-sdk slack init --dir . --channel-posts   # + message.channels/groups events
-agent-sdk slack manifest --env both
 agent-sdk slack doctor --prefix MY_AGENT
 ```

package/src/bin/agent-serve.ts

@@ -44,6 +44,7 @@ import {
   cmdSessions,
   cmdTrajectory,
 } from "../internal/cli-ax.js";
+import { ensureCursorLogin } from "../internal/cli-cursor.js";
 import {
   cmdDelete,
   cmdDeploy,
@@ -150,11 +151,12 @@ Usage:
   ${CLI} github      <subcommand> …
 
 Commands:
-  serve       Serve agents under /<slug>/... (index at /). On a TTY, press
-              Enter to restart (re-executes this process so agent code, evals,
-              and Vite reload).
+  serve       Serve agents under /<slug>/... (index at /). Runs \`${CLI} login\`
+              when unsigned. On a TTY, press Enter to restart (re-executes this
+              process so agent code, evals, and Vite reload).
   dev         Local development: same as \`${CLI} serve --dev\` (manual
               schedule/reminder dispatch, unsigned GitHub loopback, Vite HMR).
+              Also runs \`${CLI} login\` when unsigned.
   chat        Interactive REPL against a running server (follow-ups keep the
               session + continuation token). Optional --message seeds the first
               turn then stays open on a TTY. --session reattaches (looks up the
@@ -271,8 +273,8 @@ Commands:
   secrets     Manage deployment secrets: set (names only by default: hidden
               prompt or piped stdin; NAME=VALUE requires --from-argv), list
               (names + createdAt; never values), unset.
-  slack       Slack channel pack: create/destroy/icon (Cursor Add to Slack
-              provisioning), init, manifests, doctor (see slack help).
+  slack       Slack channel pack: create/destroy/icon (dashboard wizard),
+              doctor (see slack help).
   github      GitHub webhook pack: forward live deliveries, events, doctor
               (wraps \`gh webhook forward\`; see github help).
 
@@ -1264,17 +1266,32 @@ async function main(argv: string[]): Promise<number> {
         noSchedules: values["no-schedules"] === true,
       };
 
-      const start = async (): Promise<AgentServeHandle> => {
+      const start = async (): Promise<
+        | { kind: "ready"; handle: AgentServeHandle }
+        | { kind: "login-failed"; exitCode: number }
+      > => {
         loadLocalEnv();
+        // Model turns need a Cursor credential. Prompt login before listen
+        // so the first playground turn does not fail with a late auth error.
+        const loginExit = await ensureCursorLogin({
+          apiKey: values["api-key"],
+        });
+        if (loginExit !== 0) {
+          return { kind: "login-failed", exitCode: loginExit };
+        }
         const next = await serve(serveDir, serveOptions);
         printServeBanner(next, bannerOpts);
         if (enterToRestart) {
           process.stdout.write(style.dim("  press Enter to restart\n"));
         }
-        return next;
+        return { kind: "ready", handle: next };
       };
 
-      const handle = await start();
+      const started = await start();
+      if (started.kind === "login-failed") {
+        return started.exitCode;
+      }
+      const handle = started.handle;
       let closing = false;
       let restartRequested = false;
 
@@ -1502,7 +1519,7 @@ function printServeBanner(
   }
   // `/` is only mounted when the playground host home is enabled.
   if (!opts.noPlayground) {
-    process.stdout.write(`  home        ${c.cyan(handle.url + "/")}\n`);
+    process.stdout.write(`  home        ${c.cyan(`${handle.url}/`)}\n`);
   }
   // Dev is playground-first (Vite proxies the API). Keep API/route detail for
   // plain `serve`, where operators often curl the HTTP surface directly.

package/src/channels/slack/init.ts

@@ -6,7 +6,6 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
 import { PACKAGE_NAME } from "../../internal/distribution.js";
 import { envPrefixFromName, slackEnvKeys } from "./credentials.js";
-import { buildSlackManifestPair } from "./manifest.js";
 
 export interface InitSlackOptions {
   dir: string;
@@ -20,9 +19,8 @@ export interface InitSlackOptions {
    */
   envPrefix?: string;
   /**
-   * Subscribe the generated manifests to `message.channels` +
-   * `message.groups` for the opt-in channel watch
-   * (`engagement.channelPosts` on `slackChannel`).
+   * Subscribe the generated app to `message.channels` + `message.groups`
+   * for the opt-in channel watch (`engagement.channelPosts`).
    */
   channelPosts?: boolean;
 }
@@ -38,7 +36,6 @@ export async function initSlackChannel(
   options: InitSlackOptions
 ): Promise<InitSlackResult> {
   const rootDir = resolve(options.dir);
-  const name = options.name ?? basename(rootDir);
   const envPrefix =
     options.envPrefix === ""
       ? undefined
@@ -46,29 +43,22 @@ export async function initSlackChannel(
   const envKeys = slackEnvKeys(envPrefix);
   const written: string[] = [];
 
-  const write = async (rel: string, contents: string): Promise<void> => {
-    const abs = join(rootDir, rel);
-    await mkdir(join(abs, ".."), { recursive: true });
-    await writeFile(abs, contents, { flag: "wx" });
-    written.push(rel);
-  };
-
+  const abs = join(rootDir, "agent/channels/slack.ts");
+  await mkdir(join(abs, ".."), { recursive: true });
   const envPrefixLine =
     envPrefix === undefined
       ? ""
       : `  envPrefix: ${JSON.stringify(envPrefix)},\n`;
-
-  await write(
-    "agent/channels/slack.ts",
+  await writeFile(
+    abs,
     `import { slackChannel } from "${PACKAGE_NAME}/channels/slack";
 
 /**
  * Slack channel (Socket Mode).
  *
  * Tokens: ${envKeys.bot} + ${envKeys.app}
- * (see .agent-serve/slack/env.example).
  *
- * Full setup: agent-serve slack setup
+ * Full setup: agent-serve slack create --dir .
  */
 export default slackChannel({
 ${envPrefixLine}  // Streaming and thinking steps default to true.
@@ -77,61 +67,10 @@ ${envPrefixLine}  // Streaming and thinking steps default to true.
     { title: "Status", message: "What are you working on?" },
   ],
 });
-`
-  );
-
-  const pair = buildSlackManifestPair({
-    name,
-    // Scaffolded for hand-import at api.slack.com; managed_app_settings is
-    // settable only with the manager app's user token.
-    managedByCursor: false,
-    ...(options.description === undefined
-      ? {}
-      : { description: options.description }),
-    ...(options.channelPosts === true ? { channelPosts: true } : {}),
-  });
-
-  await write(
-    ".agent-serve/slack/manifest.dev.json",
-    `${JSON.stringify(pair.dev, null, 2)}\n`
-  );
-  await write(
-    ".agent-serve/slack/manifest.prod.json",
-    `${JSON.stringify(pair.prod, null, 2)}\n`
-  );
-
-  await write(
-    ".agent-serve/slack/env.example",
-    `# Copy to .env.local (or export in your shell). Use the *dev* Slack app
-# for local development; use the Prod app tokens in deployment secrets.
-#
-# Multi-agent serve needs a distinct Slack app (and token pair) per agent.
-
-${envKeys.bot}=xoxb-...
-${envKeys.app}=xapp-...
-`
-  );
-
-  await write(
-    ".agent-serve/slack/setup-status.json",
-    `${JSON.stringify(
-      {
-        updatedAt: new Date().toISOString(),
-        envPrefix: envPrefix ?? null,
-        envKeys,
-        phases: {
-          generate: true,
-          createApps: false,
-          install: false,
-          env: false,
-          serve: false,
-          smoke: false,
-        },
-      },
-      null,
-      2
-    )}\n`
+`,
+    { flag: "wx" }
   );
+  written.push("agent/channels/slack.ts");
 
   return { rootDir, files: written, envPrefix, envKeys };
 }

package/src/channels/slack/manifest.ts

@@ -1,8 +1,8 @@
 /**
- * Generate importable Slack app manifests (dev + prod).
+ * Generate Slack app manifests (dev + prod) for Cursor-managed provision.
  *
- * Import at https://api.slack.com/apps -> Create New App -> From a manifest.
- * Always Socket Mode — no Events Request URL.
+ * Always Socket Mode. No Events Request URL. Humans do not paste these
+ * at api.slack.com; `slack create` sends them through the dashboard wizard.
  *
  * Mirrored by backend/server/src/agentServe/agentServeSlackManifest.ts (the
  * backend cannot import this published package); keep the twins in lockstep.