npm - @delorenj/pjangler - Versions diffs - 1.4.2 → 1.4.3 - Mend

@delorenj/pjangler 1.4.2 → 1.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (39) hide show

package/templates/hermes-agent/template/.scripts/31-slack.sh CHANGED Viewed

@@ -8,6 +8,20 @@ INVOCATION_SLACK_BOT_TOKEN="${SLACK_BOT_TOKEN-}"
 INVOCATION_SLACK_APP_TOKEN="${SLACK_APP_TOKEN-}"
 INVOCATION_SLACK_ALLOWED_USERS="${SLACK_ALLOWED_USERS-}"
 INVOCATION_ENABLE_SLACK="${ENABLE_SLACK-${WIRE_SLACK-}}"
+# Copy invocation-only inputs, then immediately clear their exported form.
+# Resolving/sourcing _lib.sh executes PATH children; none may inherit channel
+# credentials (or accidentally treat the invocation policy as fleet state).
+unset SLACK_BOT_TOKEN SLACK_APP_TOKEN SLACK_ALLOWED_USERS ENABLE_SLACK WIRE_SLACK
+# Every channel write lands in the host-global profile root that 10-hermes-profile.sh
+# creates. When that step is deferred the root does not exist yet, so there is no
+# honest Slack state to record -- not even the disabled state, which is itself a
+# write into the profile. Defer with it. This guard must precede _lib.sh because that
+# library creates the role log and reads fleet configuration.
+if [[ "${SKIP_HOST_STATE:-0}" == "1" ]]; then
+  printf '%s\n' '[31] slack — DEFERRED (SKIP_HOST_STATE=1)' >&2
+  exit 0
+fi
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
@@ -23,29 +37,75 @@ fi
 ENABLE_SLACK="$INVOCATION_ENABLE_SLACK"
 unset INVOCATION_SLACK_BOT_TOKEN INVOCATION_SLACK_APP_TOKEN
-slack_yaml_update() {
-  python3 - "$ROLE_YAML" "$@" <<'PYEOF'
-import json
-import pathlib
-import re
-import sys
+PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
+profile_root_require_real "$PROFILE_HOME"
+RUNTIME="$ROLE_DIR/runtime"
+ENVF="$RUNTIME/.env"
+mkdir -p "$RUNTIME"
+[[ ! -L "$ENVF" ]] || die "refusing to write Slack credentials through symlink: $ENVF"
-path = pathlib.Path(sys.argv[1])
-updates = dict(zip(sys.argv[2::2], sys.argv[3::2]))
-text = path.read_text(encoding="utf-8")
-match = re.search(r"(?ms)^slack:\s*\n(?P<body>(?:^[ \t]+.*\n?)*)", text)
-if not match:
-    raise SystemExit(f"slack metadata block missing from {path}")
-body = match.group("body")
-for key, value in updates.items():
-    replacement = f"  {key}: {json.dumps(value)}"
-    body, count = re.subn(
-        rf"(?m)^\s+{re.escape(key)}:\s*.*$", lambda _: replacement, body, count=1
-    )
-    if count != 1:
-        raise SystemExit(f"Slack metadata key {key!r} missing from {path}")
-path.write_text(text[: match.start("body")] + body + text[match.end("body") :], encoding="utf-8")
-PYEOF
+slack_reconcile_existing() {
+  # Registry first, then the transaction helper's profile lock. The helper
+  # snapshots and validates both refs plus role metadata inside this window.
+  local rc=0
+  fleet_lock_acquire
+  trap 'fleet_lock_release' EXIT
+  channel_transaction_slack_existing "$PROFILE_HOME" "$ENVF" || rc=$?
+  fleet_lock_release
+  trap - EXIT
+  return "$rc"
+}
+slack_defer_if_unconfigured() {
+  # Prepare and, when already verified, reconcile under one registry-lock
+  # window. The helpers independently take the profile lock second.
+  local prepare_rc=0 rc=0
+  fleet_lock_acquire
+  trap 'fleet_lock_release' EXIT
+  channel_transaction_slack_prepare_unconfigured \
+    "$PROFILE_HOME" "$ENVF" || prepare_rc=$?
+  case "$prepare_rc" in
+    0)
+      fleet_lock_release
+      trap - EXIT
+      return 2
+      ;;
+    3)
+      channel_transaction_slack_existing "$PROFILE_HOME" "$ENVF" || rc=$?
+      ;;
+    *)
+      die "Slack deferred-state preparation transaction failed"
+      ;;
+  esac
+  case "$rc" in
+    0)
+      fleet_lock_release
+      trap - EXIT
+      return 0
+      ;;
+    75)
+      die "Slack 1Password reference validation is temporarily unavailable; preserved existing verified wiring for retry"
+      ;;
+    *)
+      die "Slack verified wiring reconciliation transaction failed"
+      ;;
+  esac
+}
+slack_prepare_for_attempt() {
+  # A new profile becomes explicitly disabled before remote verification. A
+  # verified profile is a no-op so a failed rotation preserves active wiring.
+  local rc=0
+  fleet_lock_acquire
+  trap 'fleet_lock_release' EXIT
+  channel_transaction_slack_prepare_unconfigured \
+    "$PROFILE_HOME" "$ENVF" || rc=$?
+  fleet_lock_release
+  trap - EXIT
+  case "$rc" in
+    0|3) return 0 ;;
+    *) die "Slack deferred-state preparation transaction failed" ;;
+  esac
 }
 truthy() {
@@ -55,14 +115,48 @@ truthy() {
   esac
 }
+# Preserve and reconcile durable wiring across transient 1Password outages.
+# An explicit token is a rotation request. With no tokens, the complete current
+# ref/identity snapshot is taken only after registry -> profile locks are held.
+if [[ -z "${SLACK_BOT_TOKEN:-}" && -z "${SLACK_APP_TOKEN:-}" ]]; then
+  slack_reference_rc=0
+  slack_reconcile_existing || slack_reference_rc=$?
+  case "$slack_reference_rc" in
+    0)
+      log "[31] slack — existing verified 1Password wiring reconciled"
+      exit 0
+      ;;
+    2) ;;
+    75)
+      die "Slack 1Password reference validation is temporarily unavailable; preserved existing verified wiring for retry"
+      ;;
+    *)
+      die "Slack verified wiring reconciliation transaction failed"
+      ;;
+  esac
+fi
+# Establish explicit disabled state for a first-time credential attempt. The
+# registry -> profile lock recheck preserves any already-verified wiring and
+# prevents this preparation from racing a concurrent rotation.
+if [[ -n "${SLACK_BOT_TOKEN:-}" || -n "${SLACK_APP_TOKEN:-}" ]]; then
+  slack_prepare_for_attempt
+fi
 if [[ "${SKIP_SLACK:-0}" == "1" ]]; then
-  slack_yaml_update provisioning_status disabled
-  log "[31] slack — DISABLED (SKIP_SLACK=1)"
-  mark_done 31-slack
+  slack_defer_rc=0
+  slack_defer_if_unconfigured || slack_defer_rc=$?
+  if [[ $slack_defer_rc -eq 2 ]]; then
+    log "[31] slack — DEFERRED (SKIP_SLACK=1; no verified 1Password reference pair)"
+  else
+    log "[31] slack — existing verified 1Password wiring reconciled"
+  fi
   exit 0
 fi
-already_done 31-slack && { log "[31] slack already wired — skipping"; exit 0; }
+if already_done 31-slack; then
+  log "[31] existing completion marker preserved while Slack is reconciled"
+fi
 have_bot=0
 have_app=0
@@ -70,8 +164,13 @@ have_app=0
 [[ -n "$SLACK_APP_TOKEN" ]] && have_app=1
 if ! truthy "${ENABLE_SLACK:-0}" && (( ! have_bot && ! have_app )); then
-  slack_yaml_update provisioning_status deferred
-  log "[31] slack — deferred (opt in with ENABLE_SLACK=1 or supply both Slack tokens)"
+  slack_defer_rc=0
+  slack_defer_if_unconfigured || slack_defer_rc=$?
+  if [[ $slack_defer_rc -eq 2 ]]; then
+    log "[31] slack — deferred (opt in with ENABLE_SLACK=1 or supply both Slack tokens)"
+  else
+    log "[31] slack — existing verified 1Password wiring reconciled"
+  fi
   exit 0
 fi
@@ -92,8 +191,8 @@ fi
 [[ -n "$SLACK_BOT_TOKEN" && -n "$SLACK_APP_TOKEN" ]] \
   || die "Slack provisioning requires both SLACK_BOT_TOKEN and SLACK_APP_TOKEN"
-[[ "$SLACK_BOT_TOKEN" == xoxb-* ]] || die "SLACK_BOT_TOKEN must be a Bot User OAuth token (xoxb-...)"
-[[ "$SLACK_APP_TOKEN" == xapp-* ]] || die "SLACK_APP_TOKEN must be an App-Level Socket Mode token (xapp-...)"
+[[ "$SLACK_BOT_TOKEN" =~ ^xoxb-[A-Za-z0-9-]+$ ]] || die "SLACK_BOT_TOKEN must be a Bot User OAuth token (xoxb-...)"
+[[ "$SLACK_APP_TOKEN" =~ ^xapp-[A-Za-z0-9-]+$ ]] || die "SLACK_APP_TOKEN must be an App-Level Socket Mode token (xapp-...)"
 SLACK_ALLOWED_USERS="${SLACK_ALLOWED_USERS//[[:space:]]/}"
 if [[ -n "$SLACK_ALLOWED_USERS" && "$SLACK_ALLOWED_USERS" != "*" \
@@ -101,16 +200,14 @@ if [[ -n "$SLACK_ALLOWED_USERS" && "$SLACK_ALLOWED_USERS" != "*" \
   die "SLACK_ALLOWED_USERS must be '*' or comma-separated Slack member IDs"
 fi
-RUNTIME="$ROLE_DIR/runtime"
-ENVF="$RUNTIME/.env"
-mkdir -p "$RUNTIME"
-[[ ! -L "$ENVF" ]] || die "refusing to write Slack credentials through symlink: $ENVF"
 log "[31] verifying Slack bot identity via auth.test"
-auth_response=$(curl -fsS \
-  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
-  -H "Content-Type: application/x-www-form-urlencoded" \
-  -X POST "https://slack.com/api/auth.test") \
+auth_response="$({
+  printf '%s\n' 'url = "https://slack.com/api/auth.test"'
+  printf 'header = "Authorization: Bearer %s"\n' "$SLACK_BOT_TOKEN"
+  printf '%s\n' 'header = "Content-Type: application/x-www-form-urlencoded"'
+  printf '%s\n' 'request = "POST"' 'fail' 'silent' 'show-error' \
+    'connect-timeout = 10' 'max-time = 20' 'max-filesize = 1048576'
+} | curl --config -)" \
   || die "Slack auth.test request failed"
 identity=$(printf '%s' "$auth_response" | python3 -c '
@@ -124,27 +221,97 @@ if not data.get("ok"):
     safe = "".join(c for c in error if c.isalnum() or c in "_-.")[:80]
     raise SystemExit("Slack auth.test rejected the bot token ({})".format(safe or "unknown_error"))
 values = [data.get(k, "") for k in ("team_id", "team", "user_id", "bot_id", "user")]
-if not values[0] or not values[2]:
+if not values[0] or not values[2] or not values[3]:
     raise SystemExit("Slack auth.test response omitted required identity fields")
 print("\t".join(str(v).replace("\t", " ").replace("\n", " ") for v in values))
 ') || die "Slack bot identity verification failed"
 IFS=$'\t' read -r slack_team_id slack_team_name slack_bot_user_id slack_bot_id slack_bot_username <<< "$identity"
+# auth.test proves the bot installation/workspace, while bots.info provides the
+# authoritative Slack app identity for that bot.  Correlation requires the
+# app's users:read scope; missing scope is a hard, truthful deferred outcome.
+log "[31] resolving Slack bot app identity via bots.info"
+bot_info_response="$({
+  printf '%s\n' 'url = "https://slack.com/api/bots.info"'
+  printf 'header = "Authorization: Bearer %s"\n' "$SLACK_BOT_TOKEN"
+  printf '%s\n' 'header = "Content-Type: application/x-www-form-urlencoded"'
+  printf 'data = "bot=%s"\n' "$slack_bot_id"
+  printf '%s\n' 'request = "POST"' 'fail' 'silent' 'show-error' \
+    'connect-timeout = 10' 'max-time = 20' 'max-filesize = 1048576'
+} | curl --config -)" \
+  || die "Slack bots.info request failed; Slack remains deferred"
+slack_bot_app_id="$(printf '%s' "$bot_info_response" | python3 -c '
+import json, re, sys
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    raise SystemExit("Slack bots.info returned an invalid response")
+if not isinstance(data, dict) or not data.get("ok"):
+    error = str(data.get("error") if isinstance(data, dict) else "unknown_error")
+    if error == "missing_scope":
+        raise SystemExit(
+            "Slack bots.info requires users:read; add that bot scope, reinstall the app, and rerun"
+        )
+    safe = "".join(c for c in error if c.isalnum() or c in "_-." )[:80]
+    raise SystemExit("Slack bots.info rejected identity lookup ({})".format(safe or "unknown_error"))
+bot = data.get("bot")
+app_id = bot.get("app_id") if isinstance(bot, dict) else None
+if not isinstance(app_id, str) or not re.fullmatch(r"[A-Z][A-Z0-9]+", app_id):
+    raise SystemExit("Slack bots.info response omitted a valid bot.app_id")
+print(app_id)
+')" || die "Slack bot app identity verification failed; Slack remains deferred"
+# Socket Mode requires a separately authenticated app-level token. A valid bot
+# token says nothing about the xapp credential, so prove that credential can
+# open a connection before claiming ownership or persisting either secret. The
+# token and Slack's returned WebSocket URL stay on anonymous pipes: neither is
+# exposed through curl argv, child environments, logs, or durable files.
+log "[31] verifying Slack Socket Mode app token via apps.connections.open"
+slack_socket_app_id="$({
+  printf '%s\n' 'url = "https://slack.com/api/apps.connections.open"'
+  printf 'header = "Authorization: Bearer %s"\n' "$SLACK_APP_TOKEN"
+  printf '%s\n' 'header = "Content-Type: application/x-www-form-urlencoded"'
+  printf '%s\n' 'request = "POST"' 'fail' 'silent' 'show-error' \
+    'connect-timeout = 10' 'max-time = 20' 'max-filesize = 1048576'
+} | curl --config - | python3 -c '
+import json, re, sys
+from urllib.parse import parse_qs, urlparse
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    raise SystemExit("Slack apps.connections.open returned an invalid response")
+if not isinstance(data, dict) or not data.get("ok"):
+    error = str(data.get("error") if isinstance(data, dict) else "unknown_error")
+    safe = "".join(c for c in error if c.isalnum() or c in "_-." )[:80]
+    raise SystemExit("Slack apps.connections.open rejected the app token ({})".format(safe or "unknown_error"))
+url = data.get("url")
+if not isinstance(url, str):
+    raise SystemExit("Slack apps.connections.open response omitted a Socket Mode URL")
+parsed = urlparse(url)
+if parsed.scheme != "wss" or not parsed.netloc:
+    raise SystemExit("Slack apps.connections.open response omitted a valid Socket Mode URL")
+app_ids = parse_qs(parsed.query, keep_blank_values=True).get("app_id", [])
+if len(app_ids) != 1 or not re.fullmatch(r"[A-Z][A-Z0-9]+", app_ids[0]):
+    raise SystemExit("Slack Socket Mode URL omitted a valid app_id identity")
+print(app_ids[0])
+')" || die "Slack Socket Mode app-token verification failed; Slack remains deferred"
+[[ "$slack_bot_app_id" == "$slack_socket_app_id" ]] \
+  || die "Slack bot and Socket Mode tokens belong to different apps; Slack remains deferred"
 # Reject credential reuse, token rotation onto an identity owned by another
 # agent, and credentials parked in shared env files. The scan, durable identity
 # claim, and profile credential write share one fleet-wide flock.
-export SLACK_BOT_TOKEN SLACK_APP_TOKEN SLACK_ALLOWED_USERS
 fleet_lock_acquire
 trap 'fleet_lock_release' EXIT
-python3 - "$REGISTRY_FILE" "$FLEET_ENV" "$ENVF" "$AGENT_ID" \
+python3 /dev/fd/3 "$REGISTRY_FILE" "$FLEET_ENV" "$ENVF" "$AGENT_ID" \
   "$slack_team_id" "$slack_bot_user_id" "$slack_bot_id" \
-  "$ROLE_DIR" "$PROFILE_NAME" "$slack_team_name" "$slack_bot_username" <<'PYEOF'
-import errno
+  "$ROLE_DIR" "$PROFILE_NAME" "$slack_team_name" "$slack_bot_username" \
+  3<<'PYEOF' <<<"${SLACK_BOT_TOKEN}"$'\n'"${SLACK_APP_TOKEN}"
 import os
 import pathlib
 import re
 import sys
-import tempfile
 try:
     import yaml  # type: ignore
 except ImportError:
@@ -163,8 +330,15 @@ except ImportError:
     team_name,
     bot_username,
 ) = sys.argv[1:]
-bot_token = os.environ["SLACK_BOT_TOKEN"]
-app_token = os.environ["SLACK_APP_TOKEN"]
+credential_lines = sys.stdin.read().splitlines()
+if len(credential_lines) != 2 or not all(credential_lines):
+    raise SystemExit("Slack ownership scan received an invalid credential pair")
+bot_token, app_token = credential_lines
+for metadata_path in (pathlib.Path("/proc/self/cmdline"), pathlib.Path("/proc/self/environ")):
+    if metadata_path.is_file():
+        metadata = metadata_path.read_bytes()
+        if any(secret.encode() in metadata for secret in (bot_token, app_token)):
+            raise SystemExit("Slack ownership scan detected credential exposure in process metadata")
 target = pathlib.Path(target_path).resolve(strict=False)
 def env_values(path):
@@ -230,127 +404,49 @@ for owner, path in owners:
     if values.get("SLACK_APP_TOKEN") == app_token:
         raise SystemExit(f"Slack app token is already assigned to {owner}")
-claim = agents.setdefault(agent_id, {})
-if not isinstance(claim, dict):
-    raise SystemExit(f"registry entry for {agent_id} is not a mapping")
-claim["role_dir"] = role_dir
-claim["profile_name"] = profile_name
-claim["slack"] = {
-    "provisioning_status": "verified",
-    "team_id": team_id,
-    "team_name": team_name,
-    "bot_user_id": user_id,
-    "bot_id": bot_id,
-    "bot_username": bot_username,
-}
-registry.parent.mkdir(parents=True, exist_ok=True)
-rendered = yaml.safe_dump(data, sort_keys=False)
-def fsync_parent(target):
-    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
-    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
-    try:
-        directory_fd = os.open(target.parent, flags)
-    except OSError as exc:
-        if exc.errno in unsupported:
-            return
-        raise
-    try:
-        try:
-            os.fsync(directory_fd)
-        except OSError as exc:
-            if exc.errno not in unsupported:
-                raise
-    finally:
-        os.close(directory_fd)
-fd, temporary = tempfile.mkstemp(prefix=f".{registry.name}.slack-", dir=registry.parent)
-try:
-    os.fchmod(fd, 0o600)
-    with os.fdopen(fd, "w", encoding="utf-8") as handle:
-        handle.write(rendered)
-        handle.flush()
-        os.fsync(handle.fileno())
-    os.replace(temporary, registry)
-    os.chmod(registry, 0o600)
-    fsync_parent(registry)
-except BaseException:
-    try:
-        os.unlink(temporary)
-    except FileNotFoundError:
-        pass
-    raise
+# Read-only by design. The channel transaction repeats the identity conflict
+# check under this same lock immediately before its recoverable registry write.
 PYEOF
-# Atomically replace only the Slack fields in the profile-local runtime file.
-# Secrets stay out of argv and are never written to root .env or fleet.env.
-python3 - "$ENVF" <<'PYEOF'
-import errno
-import json
-import os
-import pathlib
-import re
-import tempfile
-path = pathlib.Path(__import__("sys").argv[1])
-if path.is_symlink():
-    raise SystemExit(f"refusing to write Slack credentials through symlink: {path}")
-path.parent.mkdir(parents=True, exist_ok=True)
-text = path.read_text(encoding="utf-8") if path.exists() else ""
-for key in ("SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS"):
-    text = re.sub(rf"(?m)^\s*(?:export\s+)?#?\s*{key}\s*=.*(?:\n|$)", "", text)
-values = {key: os.environ.get(key, "") for key in (
-    "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS"
-)}
-text = text.rstrip("\n")
-if text:
-    text += "\n"
-text += "".join(f"{key}={json.dumps(value)}\n" for key, value in values.items())
-def fsync_parent(target):
-    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
-    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
-    try:
-        directory_fd = os.open(target.parent, flags)
-    except OSError as exc:
-        if exc.errno in unsupported:
-            return
-        raise
-    try:
-        try:
-            os.fsync(directory_fd)
-        except OSError as exc:
-            if exc.errno not in unsupported:
-                raise
-    finally:
-        os.close(directory_fd)
-fd, temporary = tempfile.mkstemp(prefix=".env.slack-", dir=path.parent)
-try:
-    os.fchmod(fd, 0o600)
-    with os.fdopen(fd, "w", encoding="utf-8") as handle:
-        handle.write(text)
-        handle.flush()
-        os.fsync(handle.fileno())
-    os.replace(temporary, path)
-    os.chmod(path, 0o600)
-    fsync_parent(path)
-except BaseException:
-    try:
-        os.unlink(temporary)
-    except FileNotFoundError:
-        pass
-    raise
-PYEOF
+# Stage both credentials in one new 1Password item, verify both fields, then
+# switch both profile refs with one atomic delta update.  A failed rotation
+# leaves the previously active pair untouched.
+ONEPASSWORD_ITEM_PREFIX="${HERMES_ONEPASSWORD_ITEM_PREFIX:-$(config_get fleet.onepassword_item_prefix 'hermes-agent')}"
+slack_stage="$(stage_onepassword_secret_pair \
+  "${ONEPASSWORD_ITEM_PREFIX}-${AGENT_ID}-slack-credentials" \
+  slack_bot_token "$SLACK_BOT_TOKEN" \
+  slack_app_token "$SLACK_APP_TOKEN")" \
+  || die "Slack credential pair could not be staged and verified in 1Password"
+if [[ "$slack_stage" != *$'\n'*$'\n'* ]]; then
+  die "Slack credential-pair storage returned an invalid reference set"
+fi
+slack_staged_item_id="${slack_stage%%$'\n'*}"
+slack_pair_references="${slack_stage#*$'\n'}"
+slack_bot_reference="${slack_pair_references%%$'\n'*}"
+slack_app_reference="${slack_pair_references#*$'\n'}"
+[[ "$slack_app_reference" != *$'\n'* ]] \
+  || die "Slack credential-pair storage returned too many references"
 unset SLACK_BOT_TOKEN SLACK_APP_TOKEN
-slack_yaml_update \
-  provisioning_status verified \
-  team_id "$slack_team_id" \
-  team_name "$slack_team_name" \
-  bot_user_id "$slack_bot_user_id" \
-  bot_id "$slack_bot_id" \
-  bot_username "$slack_bot_username"
+slack_transaction_exit() {
+  local rc=$?
+  trap - EXIT
+  if [[ -n "${slack_staged_item_id:-}" ]]; then
+    delete_staged_onepassword_item "$slack_staged_item_id" >/dev/null 2>&1 \
+      || warn "    staged Slack item cleanup failed; archive manually by immutable item id"
+  fi
+  fleet_lock_release
+  exit "$rc"
+}
+trap slack_transaction_exit EXIT
+channel_transaction_slack \
+  "$PROFILE_HOME" "$ENVF" "$slack_bot_reference" "$slack_app_reference" \
+  "$slack_team_id" "$slack_team_name" "$slack_bot_user_id" \
+  "$slack_bot_id" "$slack_bot_username" "$SLACK_ALLOWED_USERS" \
+  || die "Slack local credential transaction failed"
+slack_staged_item_id=""
 fleet_lock_release
 trap - EXIT
@@ -359,4 +455,3 @@ if [[ -z "$SLACK_ALLOWED_USERS" ]]; then
   warn "    Slack is wired but denies all inbound users until SLACK_ALLOWED_USERS is set"
 fi
 log "    verified Slack bot $slack_bot_username in $slack_team_name (profile-local credentials)"
-mark_done 31-slack

package/templates/hermes-agent/template/.scripts/40-plane.sh CHANGED Viewed

@@ -1,6 +1,19 @@
 #!/usr/bin/env bash
-# Create a Plane project in the configured workspace (one project per agent).
-# Workspace + base URL come from role.yaml / config.toml (see _lib.sh).
+# Bind this agent to its Plane board — WITHOUT inventing a board identifier.
+#
+# The identifier is Plane's to assign. This step never mints one. It resolves
+# the board through providers/plane.sh and persists ONLY the identifier Plane
+# reports back; if Plane reports none, it dies loudly rather than writing a
+# guess into role.yaml.
+#
+# Resolution order:
+#   1. The repo-root .project.json binding (the SOT) — read back live.
+#   2. Otherwise a repo-named board lookup, falling back to creation.
+#
+# Proposing an identifier for a BRAND-NEW board is legitimate, but it may only
+# come from explicit configuration (PLANE_IDENTIFIER, or an already-recorded
+# role.yaml plane.identifier). Full new-board provisioning with the
+# .project.json transaction lives in 42-ticket-provider.sh.
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
@@ -10,42 +23,38 @@ already_done 40-plane && { log "[40] plane already set up — skipping"; exit 0;
 [[ -n "$PLANE_API_KEY" ]] || { warn "[40] PLANE_API_KEY not set; skipping. set PLANE_33GOD_API_KEY and re-run ./.scripts/40-plane.sh"; exit 0; }
-# Build the 5-char identifier: <repo[0..2]><role[0..1]> uppercased
-RAW=$(printf '%s%s' "${REPO:0:3}" "${ROLE:0:2}" | tr -cd '[:alnum:]' | tr '[:lower:]' '[:upper:]')
-while (( ${#RAW} < 3 )); do RAW="${RAW}X"; done
-IDENT="${RAW:0:5}"
-# Project name = display_name (already smart-cased: "Bloodbank PM", "Hermes-Agent Dev").
-# Plane forbids hyphens in names — substitute spaces.
-NAME="${DISPLAY_NAME//-/ }"
-log "[40] creating plane project '$NAME' [$IDENT]"
-# Check for existing project with this identifier
-EXISTING=$(curl -sS "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/?per_page=200" \
-  -H "X-API-Key: $PLANE_API_KEY" \
-  | python3 -c "
-import sys, json
-d = json.load(sys.stdin)
-ident = '$IDENT'
-for p in d.get('results', []):
-    if (p.get('identifier') or '').upper() == ident:
-        print(p['id']); break")
-if [[ -n "$EXISTING" ]]; then
-  log "    plane project $IDENT already exists (id=$EXISTING) — reusing"
-  PROJECT_ID="$EXISTING"
+PLANE_ADAPTER="$(dirname "$0")/providers/plane.sh"
+[[ -x "$PLANE_ADAPTER" ]] || die "[40] missing Plane adapter: $PLANE_ADAPTER"
+# The board belongs to the REPO, not to this role. display_name carries the
+# role suffix ("Holocene PM") and must never become the board name — that is
+# how role-suffixed duplicate boards get created. Matches 42-ticket-provider.sh.
+NAME="$(printf '%s' "$REPO" | tr '_-' '  ' | python3 -c 'import sys; print(" ".join(w[:1].upper()+w[1:] for w in sys.stdin.read().split()))')"
+# Identifier PROPOSAL, used only in a create request and never persisted as
+# though it were confirmed. Explicit configuration only — never derived from
+# the repo or role strings.
+PROPOSED_IDENT="${PLANE_IDENTIFIER:-$(yaml_get plane.identifier)}"
+# 1. Prefer the recorded .project.json binding and read it back live.
+OUT="$("$PLANE_ADAPTER" resolve 2>/dev/null || true)"
+if [[ -n "$OUT" ]]; then
+  log "[40] resolving plane board from the .project.json binding"
 else
-  RESP=$(curl -sS -X POST "$PLANE_BASE/api/v1/workspaces/$PLANE_WORKSPACE/projects/" \
-    -H "X-API-Key: $PLANE_API_KEY" \
-    -H "Content-Type: application/json" \
-    -d "$(python3 -c "import json,sys; print(json.dumps({'name': sys.argv[1], 'identifier': sys.argv[2], 'description': sys.argv[3]}))" \
-        "$NAME" "$IDENT" "Hermes agent board for $AGENT_ID")")
-  PROJECT_ID=$(echo "$RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id') or '')")
-  [[ -n "$PROJECT_ID" ]] || die "plane create failed: $RESP"
-  log "    plane project created id=$PROJECT_ID"
+  log "[40] no bound board — resolving/creating repo board '$NAME'${PROPOSED_IDENT:+ (proposed identifier $PROPOSED_IDENT)}"
+  OUT="$("$PLANE_ADAPTER" create_board "$NAME" "$PROPOSED_IDENT" "Hermes agent board for $AGENT_ID")" \
+    || die "[40] plane board resolution failed for '$NAME'"
 fi
-yaml_set plane.identifier "$IDENT"
+PROJECT_ID="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("board_id","") or "")')"
+LIVE_IDENTIFIER="$(printf '%s' "$OUT" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("identifier","") or "")')"
+[[ -n "$PROJECT_ID" ]] || die "[40] plane returned no board id: $OUT"
+[[ -n "$LIVE_IDENTIFIER" ]] \
+  || die "[40] plane returned no authoritative identifier — refusing to persist a guess: $OUT"
+log "    plane board id=$PROJECT_ID identifier=$LIVE_IDENTIFIER (authoritative, read back from Plane)"
+yaml_set plane.identifier "$LIVE_IDENTIFIER"
 echo "$PROJECT_ID" > "$ROLE_DIR/.scripts/.plane-project-id"
 mark_done 40-plane