@eliya-oss/agent-slack 0.1.7 → 0.1.9

package/.agents/cli-api.md

@@ -52,9 +52,10 @@ Auth behavior:
 
 - Primary setup: `agent-slack auth login` uses the bundled Agent Slack public Client ID, opens Slack in the browser with PKCE, and stores a local Slack profile.
 - Users can also provide an existing Slack bot token with `--token`.
-- A normal user should not create a Slack app or provide client credentials.
-- Developer fallback: OAuth mode can use Slack app credentials. The **Client ID** and **Client Secret** come from the Slack app's **Basic Information > App Credentials** section.
+- Browser login uses Agent Slack's public Slack app.
+- Development and self-hosted OAuth can use Slack app credentials. The **Client ID** and **Client Secret** come from the Slack app's **Basic Information > App Credentials** section.
 - OAuth opens the Slack OAuth URL in the default browser by default. Use `--no-open` to print the URL only, or `--auth-url-out PATH` for headless agents.
+- Distributed Slack apps use an HTTPS relay redirect URI. The relay forwards Slack's `code` and `state` to the local callback.
 - PKCE uses `user_scope=...`; OAuth with app credentials uses `scope=...` for bot scopes.
 - Default local callback: `http://localhost:45454/oauth/slack/callback`.
 - Stores profiles outside the project directory. The default store is `~/.config/agent-slack/profiles.json`; set `AGENT_SLACK_TOKEN_STORE=keychain` on macOS to keep token secrets in Keychain and only profile metadata on disk.

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @eliya-oss/agent-slack
 
+## 0.1.9
+
+### Patch Changes
+
+- Support hosted HTTPS OAuth redirect relays for distributed Slack apps.
+
+## 0.1.8
+
+### Patch Changes
+
+- Keep README auth onboarding focused on browser login and clean up auth help copy.
+
 ## 0.1.7
 
 ### Patch Changes

package/README.md

@@ -1,13 +1,11 @@
 <div align="center">
 
-# Agent Slack
+# agent-slack
 
 Slack context for AI agents via the `agent-slack` CLI.
 Short alias: `aslk`.
 
-```bash
-npm install -g @eliya-oss/agent-slack
-```
+<pre align="center">npm install -g @eliya-oss/agent-slack</pre>
 
 <img src="./assets/terminal.webp" alt="Agent Slack terminal screenshot" width="820">
 
@@ -25,28 +23,11 @@ agent-slack api call conversations.info --payload '{"channel":"C123"}' --json
 
 ## Auth
 
-Browser login:
-
 ```bash
 agent-slack auth login
 ```
 
-Agent Slack opens Slack in the browser with PKCE and stores a local Slack profile. Users do not create Slack apps or handle Slack client secrets.
-
-Token setup:
-
-```bash
-agent-slack auth login --token "$SLACK_BOT_TOKEN" --scopes channels:read,channels:history,users:read
-```
-
-Developer/self-hosted fallback:
-
-1. Create a Slack app at <https://api.slack.com/apps>.
-2. Add the needed scopes under **OAuth & Permissions**.
-3. Install it to your workspace and copy the bot token.
-4. Run `agent-slack auth login --token "$SLACK_BOT_TOKEN" --scopes ...`.
-
-OAuth with `--client-id` and `--client-secret` is only for development and self-hosted setups.
+Opens Slack in your browser and stores a local profile for future commands.
 
 ## Skill
 
@@ -63,3 +44,11 @@ Project docs live in `.agents/`.
 ## License
 
 MIT
+
+## Sponsors
+
+<p align="center">
+	<a href="https://github.com/sponsors/Newbie012">
+		<img src="https://cdn.jsdelivr.net/gh/newbie012/sponsors/sponsors.svg">
+	</a>
+</p>

package/dist/adapters/localhost-oauth/NodeLocalhostOAuthFlow.js

@@ -15,10 +15,14 @@ export class NodeLocalhostOAuthFlow {
         const redirectHost = env.AGENT_SLACK_OAUTH_REDIRECT_HOST ?? env.SLK_OAUTH_REDIRECT_HOST;
         const redirectPort = env.AGENT_SLACK_OAUTH_REDIRECT_PORT ?? env.SLK_OAUTH_REDIRECT_PORT;
         const redirectPath = env.AGENT_SLACK_OAUTH_REDIRECT_PATH ?? env.SLK_OAUTH_REDIRECT_PATH;
+        const slackRedirectUri = env.AGENT_SLACK_OAUTH_REDIRECT_URI ?? env.AGENT_SLACK_OAUTH_PUBLIC_REDIRECT_URI;
+        const localCallbackUri = env.AGENT_SLACK_OAUTH_LOCAL_CALLBACK_URI;
         const timeoutMs = env.AGENT_SLACK_OAUTH_TIMEOUT_MS ?? env.SLK_OAUTH_TIMEOUT_MS;
         return new NodeLocalhostOAuthFlow({
             authorizeUrl: env.AGENT_SLACK_OAUTH_AUTHORIZE_URL ?? env.SLK_SLACK_OAUTH_AUTHORIZE_URL ?? (emulatorBaseUrl === undefined ? "https://slack.com/oauth/v2/authorize" : `${emulatorBaseUrl}/oauth/v2/authorize`),
             tokenUrl: env.AGENT_SLACK_OAUTH_ACCESS_URL ?? env.SLK_SLACK_OAUTH_ACCESS_URL ?? (apiBaseUrl === undefined ? "https://slack.com/api/oauth.v2.access" : `${apiBaseUrl.replace(/\/?$/, "/")}oauth.v2.access`),
+            ...(slackRedirectUri === undefined ? {} : { defaultSlackRedirectUri: slackRedirectUri }),
+            ...(localCallbackUri === undefined ? {} : { defaultLocalCallbackUri: localCallbackUri }),
             ...(redirectHost === undefined ? {} : { defaultRedirectHost: redirectHost }),
             ...(redirectPort === undefined ? {} : { defaultRedirectPort: Number(redirectPort) }),
             ...(redirectPath === undefined ? {} : { defaultRedirectPath: redirectPath }),
@@ -30,15 +34,20 @@ export class NodeLocalhostOAuthFlow {
         const codeVerifier = input.pkce === true ? randomBytes(32).toString("base64url") : undefined;
         const timeoutMs = input.timeoutMs ?? this.options.defaultTimeoutMs ?? 120_000;
         const server = createServer();
-        const started = await listen(server, input.redirectUri, {
+        const slackRedirectUri = input.redirectUri ?? this.options.defaultSlackRedirectUri;
+        const localCallbackUri = input.localCallbackUri ??
+            this.options.defaultLocalCallbackUri ??
+            (slackRedirectUri !== undefined && isLocalCallbackUri(slackRedirectUri) ? slackRedirectUri : undefined);
+        const started = await listen(server, localCallbackUri, {
             host: this.options.defaultRedirectHost ?? defaultRedirectHost,
             port: this.options.defaultRedirectPort ?? defaultRedirectPort,
             path: this.options.defaultRedirectPath ?? "/oauth/slack/callback"
         });
+        const redirectUri = slackRedirectUri ?? started.redirectUri;
         const authorizationUrl = buildAuthorizationUrl({
             authorizeUrl: this.options.authorizeUrl,
             clientId: input.clientId,
-            redirectUri: started.redirectUri,
+            redirectUri,
             scopes: input.scopes,
             userScopes: input.userScopes,
             state,
@@ -85,7 +94,7 @@ export class NodeLocalhostOAuthFlow {
                         clientId: input.clientId,
                         clientSecret: input.clientSecret,
                         codeVerifier,
-                        redirectUri: started.redirectUri
+                        redirectUri
                     });
                     const profile = toAuthProfile(input.profileName, access, input.pkce === true ? "user" : "bot");
                     response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end("<html><body>Slack auth complete. You can close this tab.</body></html>");
@@ -124,6 +133,13 @@ const listen = (server, redirectUri, fallback) => new Promise((resolve, reject)
 });
 const defaultRedirectHost = "localhost";
 const defaultRedirectPort = 45454;
+const isLocalCallbackUri = (value) => {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" && (parsed.hostname === "localhost" ||
+        parsed.hostname === "127.0.0.1" ||
+        parsed.hostname === "[::1]" ||
+        parsed.hostname === "::1");
+};
 const buildAuthorizationUrl = (input) => {
     const url = new URL(input.authorizeUrl);
     url.searchParams.set("client_id", input.clientId);

package/dist/cli/metadata.js

@@ -326,21 +326,20 @@ const renderAuthLoginHelp = () => [
     "Browser login",
     "  agent-slack auth login",
     "",
-    "  Opens Slack in the browser with PKCE and stores a local Slack profile.",
-    "  The CLI never stores a Slack app secret.",
+    "  Opens Slack in the browser and stores a local Slack profile.",
     "",
-    "Token setup",
+    "Headless setup",
     "  agent-slack auth login --token \"$SLACK_BOT_TOKEN\" --scopes channels:read,channels:history,users:read",
     "",
     "  Stores an existing bot token as a local Slack profile.",
     "",
-    "Developer fallback: Slack app credentials",
+    "Development and self-hosted OAuth",
     "  agent-slack auth login --oauth --client-id \"$SLACK_CLIENT_ID\" --client-secret \"$SLACK_CLIENT_SECRET\"",
     "",
     "Options",
     "  --profile NAME          Save as a named profile.",
     "  --token TOKEN           Store an existing Slack bot token.",
-    "  --scopes LIST           Scopes to request (PKCE) or record (token setup).",
+    "  --scopes LIST           Scopes to request or record.",
     "  --user-scopes LIST      User scopes to request during OAuth.",
     "  --oauth                 Use Slack OAuth with app credentials.",
     "  --client-id VALUE       Override the Slack app Client ID.",
@@ -350,8 +349,8 @@ const renderAuthLoginHelp = () => [
     "  --json                  Emit machine-readable JSON.",
     "",
     "Notes",
-    "  Normal users should not create a Slack app or handle client credentials.",
-    "  App credentials are only for development and self-hosted setups.",
+    "  Browser login uses PKCE with Agent Slack's public Slack app.",
+    "  App credentials are for development and self-hosted setups.",
     ""
 ].join("\n");
 export const renderCompletion = (shell) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eliya-oss/agent-slack",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Slack context CLI for AI agents.",
   "type": "module",
   "packageManager": "pnpm@11.9.0",

package/skills/agent-slack/SKILL.md

@@ -24,9 +24,9 @@ Browser login:
 agent-slack auth login
 ```
 
-Agent Slack opens Slack in the browser with PKCE and stores a local Slack profile. Users should not create a Slack app or handle `client-id`/`client-secret`.
+Agent Slack opens Slack in the browser and stores a local Slack profile.
 
-Token setup:
+Headless setup with an existing bot token:
 
 ```bash
 agent-slack auth login --token "$SLACK_BOT_TOKEN" --scopes channels:read,channels:history,users:read --json
@@ -34,7 +34,7 @@ agent-slack auth login --token "$SLACK_BOT_TOKEN" --scopes channels:read,channel
 
 This stores an existing Slack bot token as a local profile.
 
-Developer/self-hosted fallback:
+Development and self-hosted OAuth:
 
 1. Create or open a Slack app at https://api.slack.com/apps.
 2. Go to **OAuth & Permissions**, add the needed bot scopes, install the app to the workspace, and copy the bot token.
@@ -44,7 +44,7 @@ Developer/self-hosted fallback:
 agent-slack auth login --oauth --client-id "$SLACK_CLIENT_ID" --client-secret "$SLACK_CLIENT_SECRET" --json
 ```
 
-Treat Slack app creation and client credentials as an advanced developer fallback only.
+Use Slack app credentials only when the user explicitly asks for development or self-hosted OAuth setup.
 
 ## Common Commands