@indigoai-us/hq-cli 5.119.15 → 5.120.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.120.0] — 2026-09-18
+
+### Added
+
+- `hq agents provision` can reuse an existing Slack bot token through flags,
+  environment variables, or stdin. Socket Mode agents can also accept their
+  app-level token. HQ validates both tokens and the bot's required Slack scopes
+  before it creates the agent.
+
 ## [5.119.15] — 2026-09-18
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -3887,6 +3887,15 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--api-key-env <VAR>";
             readonly description: "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)";
+        }, {
+            readonly flags: "--slack-bot-token <xoxb-token>";
+            readonly description: "Reuse an existing Slack bot token; HQ_SLACK_BOT_TOKEN or --slack-tokens-stdin avoid shell history";
+        }, {
+            readonly flags: "--slack-app-token <xapp-token>";
+            readonly description: "Socket Mode app token for --provider agents-v2; HQ_SLACK_APP_TOKEN or --slack-tokens-stdin avoid shell history";
+        }, {
+            readonly flags: "--slack-tokens-stdin";
+            readonly description: "Read the bot token and optional app token from one or two stdin lines";
         }, {
             readonly flags: "--title <title>";
             readonly description: "Org-chart job title";

package/dist/command-catalog.generated.js

@@ -5025,6 +5025,18 @@ export const COMMAND_CATALOG = [
                         "flags": "--api-key-env <VAR>",
                         "description": "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)"
                     },
+                    {
+                        "flags": "--slack-bot-token <xoxb-token>",
+                        "description": "Reuse an existing Slack bot token; HQ_SLACK_BOT_TOKEN or --slack-tokens-stdin avoid shell history"
+                    },
+                    {
+                        "flags": "--slack-app-token <xapp-token>",
+                        "description": "Socket Mode app token for --provider agents-v2; HQ_SLACK_APP_TOKEN or --slack-tokens-stdin avoid shell history"
+                    },
+                    {
+                        "flags": "--slack-tokens-stdin",
+                        "description": "Read the bot token and optional app token from one or two stdin lines"
+                    },
                     {
                         "flags": "--title <title>",
                         "description": "Org-chart job title"

package/dist/commands/agents.d.ts

@@ -173,6 +173,9 @@ export interface ProvisionAgentInput {
     provider?: "codex" | "grok" | "claude" | "agents-v2";
     codexModel?: string;
     codexApiKey?: string;
+    /** Write-only Slack credentials, validated by hq-pro before creation. */
+    slackBotToken?: string;
+    slackAppToken?: string;
     idempotencyKey: string;
     title?: string;
     description?: string;
@@ -184,6 +187,21 @@ export interface ProvisionAgentInput {
     /** Funnel attribution: which client surface made the attempt. */
     surface?: AgentCreateSurface;
 }
+export interface ProvisionSlackTokenOptions {
+    slackBotToken?: string;
+    slackAppToken?: string;
+    slackTokensStdin?: boolean;
+}
+export interface ProvisionSlackTokens {
+    botToken: string;
+    appToken?: string;
+}
+/**
+ * Resolve write-only Slack credentials without printing them. Flags are useful
+ * for automation; HQ_SLACK_BOT_TOKEN/HQ_SLACK_APP_TOKEN and stdin avoid shell
+ * history. Multiple sources are rejected so the selected credential is clear.
+ */
+export declare function resolveProvisionSlackTokens(options: ProvisionSlackTokenOptions, environment?: Record<string, string | undefined>, readStdin?: () => Promise<string>): Promise<ProvisionSlackTokens | undefined>;
 /** Closed set shared with hq-pro's agent_create_* funnel contract. */
 export declare const CLI_AGENT_CREATE_SURFACE: "cli_agents_create";
 export type AgentCreateSurface = typeof CLI_AGENT_CREATE_SURFACE;

package/dist/commands/agents.js

@@ -242,6 +242,51 @@ export function slugifyAgentName(name) {
         .replace(/[^a-z0-9]+/g, "-")
         .replace(/^-+|-+$/g, "");
 }
+async function readProvisionSlackTokensFromStdin() {
+    let value = "";
+    for await (const chunk of process.stdin)
+        value += String(chunk);
+    return value;
+}
+function parseProvisionSlackTokensFromStdin(value) {
+    const lines = value
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length < 1 || lines.length > 2) {
+        throw new Error("--slack-tokens-stdin expects one line with the bot token and an optional second line with the Socket Mode app token.");
+    }
+    return { botToken: lines[0], ...(lines[1] ? { appToken: lines[1] } : {}) };
+}
+/**
+ * Resolve write-only Slack credentials without printing them. Flags are useful
+ * for automation; HQ_SLACK_BOT_TOKEN/HQ_SLACK_APP_TOKEN and stdin avoid shell
+ * history. Multiple sources are rejected so the selected credential is clear.
+ */
+export async function resolveProvisionSlackTokens(options, environment = process.env, readStdin = readProvisionSlackTokensFromStdin) {
+    const optionBotToken = options.slackBotToken?.trim();
+    const optionAppToken = options.slackAppToken?.trim();
+    const environmentBotToken = environment.HQ_SLACK_BOT_TOKEN?.trim();
+    const environmentAppToken = environment.HQ_SLACK_APP_TOKEN?.trim();
+    const hasFlagOrEnvironment = Boolean(optionBotToken || optionAppToken || environmentBotToken || environmentAppToken);
+    if (options.slackTokensStdin) {
+        if (hasFlagOrEnvironment) {
+            throw new Error("Use --slack-tokens-stdin or the Slack token flags/environment variables, not both.");
+        }
+        return parseProvisionSlackTokensFromStdin(await readStdin());
+    }
+    if ((optionBotToken || optionAppToken) && (environmentBotToken || environmentAppToken)) {
+        throw new Error("Use Slack token flags or HQ_SLACK_BOT_TOKEN/HQ_SLACK_APP_TOKEN, not both.");
+    }
+    const botToken = optionBotToken || environmentBotToken;
+    const appToken = optionAppToken || environmentAppToken;
+    if (!botToken && !appToken)
+        return undefined;
+    if (!botToken) {
+        throw new Error("A Slack app token requires a Slack bot token.");
+    }
+    return { botToken, ...(appToken ? { appToken } : {}) };
+}
 /** Closed set shared with hq-pro's agent_create_* funnel contract. */
 export const CLI_AGENT_CREATE_SURFACE = "cli_agents_create";
 /** Read hq-pro's company-specific creation prices and capacities. */
@@ -1132,6 +1177,9 @@ export function registerAgentsCommand(program) {
         .option("--model <model>", "Brain model, for example gpt-5.5 or grok-4.6")
         .option("--auth-mode <mode>", "Auth: subscription | apiKey (default subscription)", "subscription")
         .option("--api-key-env <VAR>", "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)")
+        .option("--slack-bot-token <xoxb-token>", "Reuse an existing Slack bot token; HQ_SLACK_BOT_TOKEN or --slack-tokens-stdin avoid shell history")
+        .option("--slack-app-token <xapp-token>", "Socket Mode app token for --provider agents-v2; HQ_SLACK_APP_TOKEN or --slack-tokens-stdin avoid shell history")
+        .option("--slack-tokens-stdin", "Read the bot token and optional app token from one or two stdin lines")
         .option("--title <title>", "Org-chart job title")
         .option("--description <text>", "Short description / bio")
         .option("--size <size>", "Agent box size: basic | power | dev (omitted keeps the current default)")
@@ -1150,6 +1198,13 @@ export function registerAgentsCommand(program) {
                 process.exit(1);
             }
             const provider = explicitProvider ?? (opts.model ? "agents-v2" : undefined);
+            const slackTokens = await resolveProvisionSlackTokens(opts);
+            if (slackTokens?.appToken && provider !== "agents-v2") {
+                throw new Error("A Slack app token can only be supplied with --provider agents-v2 for Socket Mode.");
+            }
+            if (slackTokens && provider === "agents-v2" && !slackTokens.appToken) {
+                throw new Error("--provider agents-v2 requires a Slack app token when reusing a Slack bot token.");
+            }
             // claude is subscription-only on hq-pro (rejectIncompatibleProviderAuthMode
             // returns AGENT_PROVIDER_INCOMPATIBLE_WITH_AUTH_MODE). Catch it here so the
             // operator gets a direct message instead of a 400 from the control plane
@@ -1202,6 +1257,10 @@ export function registerAgentsCommand(program) {
                     ...(provider ? { provider } : {}),
                     ...(opts.model ? { codexModel: opts.model } : {}),
                     ...(codexApiKey ? { codexApiKey } : {}),
+                    ...(slackTokens ? { slackBotToken: slackTokens.botToken } : {}),
+                    ...(slackTokens?.appToken
+                        ? { slackAppToken: slackTokens.appToken }
+                        : {}),
                     idempotencyKey,
                     ...(opts.title ? { title: opts.title } : {}),
                     ...(opts.description ? { description: opts.description } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.119.15",
+  "version": "5.120.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {