@eliya-oss/agent-slack 0.1.8 → 0.1.9

package/.agents/cli-api.md

@@ -55,6 +55,7 @@ Auth behavior:
 - Browser login uses Agent Slack's public Slack app.
 - Development and self-hosted OAuth can use Slack app credentials. The **Client ID** and **Client Secret** come from the Slack app's **Basic Information > App Credentials** section.
 - OAuth opens the Slack OAuth URL in the default browser by default. Use `--no-open` to print the URL only, or `--auth-url-out PATH` for headless agents.
+- Distributed Slack apps use an HTTPS relay redirect URI. The relay forwards Slack's `code` and `state` to the local callback.
 - PKCE uses `user_scope=...`; OAuth with app credentials uses `scope=...` for bot scopes.
 - Default local callback: `http://localhost:45454/oauth/slack/callback`.
 - Stores profiles outside the project directory. The default store is `~/.config/agent-slack/profiles.json`; set `AGENT_SLACK_TOKEN_STORE=keychain` on macOS to keep token secrets in Keychain and only profile metadata on disk.

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @eliya-oss/agent-slack
 
+## 0.1.9
+
+### Patch Changes
+
+- Support hosted HTTPS OAuth redirect relays for distributed Slack apps.
+
 ## 0.1.8
 
 ### Patch Changes

package/dist/adapters/localhost-oauth/NodeLocalhostOAuthFlow.js

@@ -15,10 +15,14 @@ export class NodeLocalhostOAuthFlow {
         const redirectHost = env.AGENT_SLACK_OAUTH_REDIRECT_HOST ?? env.SLK_OAUTH_REDIRECT_HOST;
         const redirectPort = env.AGENT_SLACK_OAUTH_REDIRECT_PORT ?? env.SLK_OAUTH_REDIRECT_PORT;
         const redirectPath = env.AGENT_SLACK_OAUTH_REDIRECT_PATH ?? env.SLK_OAUTH_REDIRECT_PATH;
+        const slackRedirectUri = env.AGENT_SLACK_OAUTH_REDIRECT_URI ?? env.AGENT_SLACK_OAUTH_PUBLIC_REDIRECT_URI;
+        const localCallbackUri = env.AGENT_SLACK_OAUTH_LOCAL_CALLBACK_URI;
         const timeoutMs = env.AGENT_SLACK_OAUTH_TIMEOUT_MS ?? env.SLK_OAUTH_TIMEOUT_MS;
         return new NodeLocalhostOAuthFlow({
             authorizeUrl: env.AGENT_SLACK_OAUTH_AUTHORIZE_URL ?? env.SLK_SLACK_OAUTH_AUTHORIZE_URL ?? (emulatorBaseUrl === undefined ? "https://slack.com/oauth/v2/authorize" : `${emulatorBaseUrl}/oauth/v2/authorize`),
             tokenUrl: env.AGENT_SLACK_OAUTH_ACCESS_URL ?? env.SLK_SLACK_OAUTH_ACCESS_URL ?? (apiBaseUrl === undefined ? "https://slack.com/api/oauth.v2.access" : `${apiBaseUrl.replace(/\/?$/, "/")}oauth.v2.access`),
+            ...(slackRedirectUri === undefined ? {} : { defaultSlackRedirectUri: slackRedirectUri }),
+            ...(localCallbackUri === undefined ? {} : { defaultLocalCallbackUri: localCallbackUri }),
             ...(redirectHost === undefined ? {} : { defaultRedirectHost: redirectHost }),
             ...(redirectPort === undefined ? {} : { defaultRedirectPort: Number(redirectPort) }),
             ...(redirectPath === undefined ? {} : { defaultRedirectPath: redirectPath }),
@@ -30,15 +34,20 @@ export class NodeLocalhostOAuthFlow {
         const codeVerifier = input.pkce === true ? randomBytes(32).toString("base64url") : undefined;
         const timeoutMs = input.timeoutMs ?? this.options.defaultTimeoutMs ?? 120_000;
         const server = createServer();
-        const started = await listen(server, input.redirectUri, {
+        const slackRedirectUri = input.redirectUri ?? this.options.defaultSlackRedirectUri;
+        const localCallbackUri = input.localCallbackUri ??
+            this.options.defaultLocalCallbackUri ??
+            (slackRedirectUri !== undefined && isLocalCallbackUri(slackRedirectUri) ? slackRedirectUri : undefined);
+        const started = await listen(server, localCallbackUri, {
             host: this.options.defaultRedirectHost ?? defaultRedirectHost,
             port: this.options.defaultRedirectPort ?? defaultRedirectPort,
             path: this.options.defaultRedirectPath ?? "/oauth/slack/callback"
         });
+        const redirectUri = slackRedirectUri ?? started.redirectUri;
         const authorizationUrl = buildAuthorizationUrl({
             authorizeUrl: this.options.authorizeUrl,
             clientId: input.clientId,
-            redirectUri: started.redirectUri,
+            redirectUri,
             scopes: input.scopes,
             userScopes: input.userScopes,
             state,
@@ -85,7 +94,7 @@ export class NodeLocalhostOAuthFlow {
                         clientId: input.clientId,
                         clientSecret: input.clientSecret,
                         codeVerifier,
-                        redirectUri: started.redirectUri
+                        redirectUri
                     });
                     const profile = toAuthProfile(input.profileName, access, input.pkce === true ? "user" : "bot");
                     response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end("<html><body>Slack auth complete. You can close this tab.</body></html>");
@@ -124,6 +133,13 @@ const listen = (server, redirectUri, fallback) => new Promise((resolve, reject)
 });
 const defaultRedirectHost = "localhost";
 const defaultRedirectPort = 45454;
+const isLocalCallbackUri = (value) => {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" && (parsed.hostname === "localhost" ||
+        parsed.hostname === "127.0.0.1" ||
+        parsed.hostname === "[::1]" ||
+        parsed.hostname === "::1");
+};
 const buildAuthorizationUrl = (input) => {
     const url = new URL(input.authorizeUrl);
     url.searchParams.set("client_id", input.clientId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eliya-oss/agent-slack",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Slack context CLI for AI agents.",
   "type": "module",
   "packageManager": "pnpm@11.9.0",