@inkeep/agents-work-apps 0.50.1 → 0.50.4

package/dist/slack/routes/users.js

@@ -2,8 +2,9 @@ import { getLogger } from "../../logger.js";
 import runDbClient_default from "../../db/runDbClient.js";
 import { createConnectSession } from "../services/nango.js";
 import "../services/index.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { createWorkAppSlackUserMapping, deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingByInkeepUserId, verifySlackLinkToken } from "@inkeep/agents-core";
+import { createProtectedRoute, inheritedWorkAppsAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/slack/routes/users.ts
 /**
@@ -29,7 +30,7 @@ function isAuthorizedForUser(c, requestedUserId) {
 	return false;
 }
 const app = new OpenAPIHono();
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/link-status",
 	summary: "Check Link Status",
@@ -40,6 +41,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { query: z.object({
 		slackUserId: z.string(),
 		slackTeamId: z.string(),
@@ -67,7 +69,7 @@ app.openapi(createRoute({
 	});
 	return c.json({ linked: false });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/link/verify-token",
 	summary: "Verify Link Token",
@@ -78,6 +80,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { body: { content: { "application/json": { schema: z.object({
 		token: z.string().min(1),
 		userId: z.string().min(1),
@@ -171,7 +174,7 @@ app.openapi(createRoute({
 		return c.json({ error: "Failed to verify link. Please try again." }, 500);
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/connect",
 	summary: "Create Nango Connect Session",
@@ -182,6 +185,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { body: { content: { "application/json": { schema: z.object({
 		userId: z.string().describe("Inkeep user ID"),
 		userEmail: z.string().optional().describe("User email"),
@@ -217,7 +221,7 @@ app.openapi(createRoute({
 	if (!session) return c.json({ error: "Failed to create session" }, 500);
 	return c.json(session);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/disconnect",
 	summary: "Disconnect User",
@@ -228,6 +232,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { body: { content: { "application/json": { schema: z.object({
 		userId: z.string().optional().describe("Inkeep user ID"),
 		slackUserId: z.string().optional().describe("Slack user ID"),
@@ -285,7 +290,7 @@ app.openapi(createRoute({
 		return c.json({ error: "Failed to disconnect" }, 500);
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/status",
 	summary: "Get Connection Status",
@@ -296,6 +301,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { query: z.object({ userId: z.string().describe("Inkeep user ID") }) },
 	responses: {
 		200: {

package/dist/slack/routes/workspaces.js

@@ -4,8 +4,9 @@ import { clearWorkspaceConnectionCache, computeWorkspaceConnectionId, deleteWork
 import { getSlackChannels, getSlackClient, revokeSlackToken } from "../services/client.js";
 import "../services/index.js";
 import { requireChannelMemberOrAdmin, requireWorkspaceAdmin } from "../middleware/permissions.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { deleteAllWorkAppSlackChannelAgentConfigsByTeam, deleteAllWorkAppSlackUserMappingsByTeam, deleteWorkAppSlackChannelAgentConfig, deleteWorkAppSlackWorkspaceByNangoConnectionId, findWorkAppSlackChannelAgentConfig, listWorkAppSlackChannelAgentConfigsByTeam, listWorkAppSlackUserMappingsByTeam, upsertWorkAppSlackChannelAgentConfig } from "@inkeep/agents-core";
+import { createProtectedRoute, inheritedWorkAppsAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/slack/routes/workspaces.ts
 /**
@@ -39,30 +40,15 @@ function verifyTenantOwnership(c, workspaceTenantId) {
 	return sessionTenantId === workspaceTenantId;
 }
 const app = new OpenAPIHono();
-app.use("/:teamId/settings", async (c, next) => {
-	if (c.req.method === "PUT") return requireWorkspaceAdmin()(c, next);
-	return next();
-});
-app.use("/:teamId", async (c, next) => {
-	if (c.req.method === "DELETE") return requireWorkspaceAdmin()(c, next);
-	return next();
-});
-app.use("/:teamId/channels/:channelId/settings", async (c, next) => {
-	if (c.req.method === "PUT" || c.req.method === "DELETE") return requireChannelMemberOrAdmin()(c, next);
-	return next();
-});
-app.use("/:teamId/test-message", async (c, next) => {
-	if (c.req.method === "POST") return requireWorkspaceAdmin()(c, next);
-	return next();
-});
 const ChannelAgentConfigSchema = z.object({
 	projectId: z.string(),
 	agentId: z.string(),
 	agentName: z.string().optional(),
-	projectName: z.string().optional()
+	projectName: z.string().optional(),
+	grantAccessToMembers: z.boolean().optional()
 });
 const WorkspaceSettingsSchema = z.object({ defaultAgent: ChannelAgentConfigSchema.optional() });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Workspaces",
@@ -73,6 +59,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: inheritedWorkAppsAuth(),
 	responses: { 200: {
 		description: "List of workspaces",
 		content: { "application/json": { schema: z.object({ workspaces: z.array(z.object({
@@ -111,7 +98,7 @@ app.openapi(createRoute({
 		return c.json({ workspaces: [] });
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}",
 	summary: "Get Workspace",
@@ -122,6 +109,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { params: z.object({ teamId: z.string() }) },
 	responses: {
 		200: {
@@ -155,7 +143,7 @@ app.openapi(createRoute({
 		defaultAgent
 	});
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}/settings",
 	summary: "Get Workspace Settings",
@@ -166,6 +154,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { params: z.object({ teamId: z.string() }) },
 	responses: { 200: {
 		description: "Workspace settings",
@@ -188,7 +177,7 @@ app.openapi(createRoute({
 	};
 	return c.json({ defaultAgent });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{teamId}/settings",
 	summary: "Update Workspace Settings",
@@ -199,6 +188,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: requireWorkspaceAdmin(),
 	request: {
 		params: z.object({ teamId: z.string() }),
 		body: { content: { "application/json": { schema: WorkspaceSettingsSchema } } }
@@ -232,7 +222,7 @@ app.openapi(createRoute({
 	}
 	return c.json({ success: true });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{teamId}",
 	summary: "Uninstall Workspace",
@@ -243,6 +233,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: requireWorkspaceAdmin(),
 	request: { params: z.object({ teamId: z.string() }) },
 	responses: {
 		200: {
@@ -301,7 +292,7 @@ app.openapi(createRoute({
 		return c.json({ error: "Failed to uninstall workspace" }, 500);
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}/channels",
 	summary: "List Channels",
@@ -312,6 +303,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: {
 		params: z.object({ teamId: z.string() }),
 		query: z.object({
@@ -369,7 +361,8 @@ app.openapi(createRoute({
 				agentConfig: config ? {
 					projectId: config.projectId,
 					agentId: config.agentId,
-					agentName: config.agentName || void 0
+					agentName: config.agentName || void 0,
+					grantAccessToMembers: config.grantAccessToMembers
 				} : void 0
 			};
 		});
@@ -385,7 +378,7 @@ app.openapi(createRoute({
 		return c.json({ error: "Failed to list channels" }, 500);
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}/channels/{channelId}/settings",
 	summary: "Get Channel Settings",
@@ -396,6 +389,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { params: z.object({
 		teamId: z.string(),
 		channelId: z.string()
@@ -424,11 +418,12 @@ app.openapi(createRoute({
 		agentConfig: config ? {
 			projectId: config.projectId,
 			agentId: config.agentId,
-			agentName: config.agentName || void 0
+			agentName: config.agentName || void 0,
+			grantAccessToMembers: config.grantAccessToMembers
 		} : void 0
 	});
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{teamId}/channels/{channelId}/settings",
 	summary: "Set Channel Default Agent",
@@ -439,6 +434,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: requireChannelMemberOrAdmin(),
 	request: {
 		params: z.object({
 			teamId: z.string(),
@@ -478,6 +474,7 @@ app.openapi(createRoute({
 		projectId: body.agentConfig.projectId,
 		agentId: body.agentConfig.agentId,
 		agentName: body.agentConfig.agentName,
+		grantAccessToMembers: body.agentConfig.grantAccessToMembers ?? true,
 		enabled: true
 	});
 	logger.info({
@@ -490,11 +487,7 @@ app.openapi(createRoute({
 		configId: config.id
 	});
 });
-app.use("/:teamId/channels/bulk", async (c, next) => {
-	if (c.req.method === "PUT" || c.req.method === "DELETE") return requireWorkspaceAdmin()(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{teamId}/channels/bulk",
 	summary: "Bulk Set Channel Agents",
@@ -505,6 +498,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: requireWorkspaceAdmin(),
 	request: {
 		params: z.object({ teamId: z.string() }),
 		body: { content: { "application/json": { schema: z.object({
@@ -567,6 +561,7 @@ app.openapi(createRoute({
 				projectId: body.agentConfig.projectId,
 				agentId: body.agentConfig.agentId,
 				agentName: body.agentConfig.agentName,
+				grantAccessToMembers: body.agentConfig.grantAccessToMembers ?? true,
 				enabled: true
 			});
 			updated++;
@@ -591,7 +586,7 @@ app.openapi(createRoute({
 		errors: errors.length > 0 ? errors : void 0
 	});
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{teamId}/channels/bulk",
 	summary: "Bulk Remove Channel Configs",
@@ -602,6 +597,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: requireWorkspaceAdmin(),
 	request: {
 		params: z.object({ teamId: z.string() }),
 		body: { content: { "application/json": { schema: z.object({ channelIds: z.array(z.string()).min(1) }) } } }
@@ -638,7 +634,7 @@ app.openapi(createRoute({
 		removed
 	});
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{teamId}/channels/{channelId}/settings",
 	summary: "Remove Channel Config",
@@ -649,6 +645,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Channels"
 	],
+	permission: requireChannelMemberOrAdmin(),
 	request: { params: z.object({
 		teamId: z.string(),
 		channelId: z.string()
@@ -673,7 +670,7 @@ app.openapi(createRoute({
 	}, "Removed channel agent config");
 	return c.json({ success: deleted });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}/users",
 	summary: "List Linked Users",
@@ -684,6 +681,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Users"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { params: z.object({ teamId: z.string() }) },
 	responses: { 200: {
 		description: "List of linked users",
@@ -723,7 +721,7 @@ app.openapi(createRoute({
 		lastUsedAt: link.lastUsedAt || void 0
 	})) });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{teamId}/health",
 	summary: "Check Workspace Health",
@@ -734,6 +732,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: inheritedWorkAppsAuth(),
 	request: { params: z.object({ teamId: z.string() }) },
 	responses: {
 		200: {
@@ -819,7 +818,7 @@ app.openapi(createRoute({
 		});
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/{teamId}/test-message",
 	summary: "Send Test Message",
@@ -830,6 +829,7 @@ app.openapi(createRoute({
 		"Slack",
 		"Workspaces"
 	],
+	permission: requireWorkspaceAdmin(),
 	request: {
 		params: z.object({ teamId: z.string() }),
 		body: { content: { "application/json": { schema: z.object({
@@ -859,7 +859,7 @@ app.openapi(createRoute({
 	}, 404);
 	try {
 		const slackClient = getSlackClient(workspace.botToken);
-		const testMessage = message || "✅ *Test message from Inkeep*\n\nYour Slack integration is working correctly!";
+		const testMessage = message || "*Test message from Inkeep*\n\nYour Slack integration is working correctly.";
 		const result = await slackClient.chat.postMessage({
 			channel: channelId,
 			text: testMessage,

package/dist/slack/services/agent-resolution.d.ts

@@ -11,6 +11,7 @@ interface ResolvedAgentConfig {
   agentId: string;
   agentName?: string;
   source: 'channel' | 'workspace' | 'none';
+  grantAccessToMembers: boolean;
 }
 interface AgentResolutionParams {
   tenantId: string;

package/dist/slack/services/agent-resolution.js

@@ -37,7 +37,8 @@ async function resolveEffectiveAgent(params) {
 				projectId: channelConfig.projectId,
 				agentId: channelConfig.agentId,
 				agentName: channelConfig.agentName || void 0,
-				source: "channel"
+				source: "channel",
+				grantAccessToMembers: channelConfig.grantAccessToMembers
 			};
 		}
 	}
@@ -52,7 +53,8 @@ async function resolveEffectiveAgent(params) {
 			projectId: workspaceConfig.projectId,
 			agentId: workspaceConfig.agentId,
 			agentName: workspaceConfig.agentName,
-			source: "workspace"
+			source: "workspace",
+			grantAccessToMembers: workspaceConfig.grantAccessToMembers ?? true
 		};
 	}
 	logger.debug({
@@ -78,7 +80,8 @@ async function getAgentConfigSources(params) {
 			projectId: config.projectId,
 			agentId: config.agentId,
 			agentName: config.agentName || void 0,
-			source: "channel"
+			source: "channel",
+			grantAccessToMembers: config.grantAccessToMembers
 		};
 	}
 	const wsConfig = await getWorkspaceDefaultAgentFromNango(teamId);
@@ -86,7 +89,8 @@ async function getAgentConfigSources(params) {
 		projectId: wsConfig.projectId,
 		agentId: wsConfig.agentId,
 		agentName: wsConfig.agentName,
-		source: "workspace"
+		source: "workspace",
+		grantAccessToMembers: wsConfig.grantAccessToMembers ?? true
 	};
 	return {
 		channelConfig,

package/dist/slack/services/blocks/index.js

@@ -3,7 +3,7 @@ import { Blocks, Elements, Md, Message } from "slack-block-builder";
 
 //#region src/slack/services/blocks/index.ts
 function createErrorMessage(message) {
-	return Message().blocks(Blocks.Section().text(`❌ ${message}`)).buildToObject();
+	return Message().blocks(Blocks.Section().text(message)).buildToObject();
 }
 function createContextBlock(params) {
 	const { agentName, isPrivate = false } = params;
@@ -40,7 +40,7 @@ function buildConversationResponseBlocks(params) {
 			type: "context",
 			elements: [{
 				type: "mrkdwn",
-				text: `💬 *You:* ${userMessage.length > 200 ? `${userMessage.slice(0, 200)}...` : userMessage}`
+				text: `*You:* ${userMessage.length > 200 ? `${userMessage.slice(0, 200)}...` : userMessage}`
 			}]
 		},
 		{ type: "divider" },
@@ -69,27 +69,23 @@ function createUpdatedHelpMessage() {
 	return Message().blocks(Blocks.Section().text(`${Md.bold(SlackStrings.help.title)}`), Blocks.Section().text(SlackStrings.help.publicSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.privateSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.otherCommands), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.docsLink)).buildToObject();
 }
 function createAlreadyLinkedMessage(email, linkedAt, dashboardUrl) {
-	return Message().blocks(Blocks.Section().text(Md.bold("✅ Already Linked!") + "\n\nYour Slack account is already connected to Inkeep.\n\n" + Md.bold("Inkeep Account:") + ` ${email}\n` + Md.bold("Linked:") + ` ${new Date(linkedAt).toLocaleDateString()}\n\nTo switch accounts, first run \`/inkeep unlink\``), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
+	return Message().blocks(Blocks.Section().text(Md.bold("Already linked") + "\n\nYour Slack account is connected to Inkeep.\n\n" + Md.bold("Account:") + ` ${email}\n` + Md.bold("Linked:") + ` ${new Date(linkedAt).toLocaleDateString()}\n\nTo switch accounts, first run \`/inkeep unlink\``), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
 }
 function createUnlinkSuccessMessage() {
-	return Message().blocks(Blocks.Section().text(Md.bold("✅ Account Unlinked") + "\n\nYour Slack account has been disconnected from Inkeep.\n\nTo use Inkeep agents again, run `/inkeep link` to connect a new account.")).buildToObject();
+	return Message().blocks(Blocks.Section().text(Md.bold("Account unlinked") + "\n\nYour Slack account has been disconnected from Inkeep.\n\nRun `/inkeep link` to connect a new account.")).buildToObject();
 }
 function createNotLinkedMessage() {
-	return Message().blocks(Blocks.Section().text(Md.bold("❌ Not Linked") + "\n\nYour Slack account is not connected to Inkeep.\n\nRun `/inkeep link` to connect your account.")).buildToObject();
+	return Message().blocks(Blocks.Section().text(Md.bold("Not linked") + "\n\nYour Slack account is not connected to Inkeep. Run `/inkeep link` to connect.")).buildToObject();
 }
 function createStatusMessage(email, linkedAt, dashboardUrl, agentConfigs) {
 	const { effective } = agentConfigs;
 	let agentLine;
 	if (effective) agentLine = `${Md.bold("Agent:")} ${effective.agentName || effective.agentId}`;
 	else agentLine = `${Md.bold("Agent:")} None configured\n${Md.italic("Ask your admin to set up an agent in the dashboard.")}`;
-	return Message().blocks(Blocks.Section().text(Md.bold("✅ Connected to Inkeep") + `\n\n${Md.bold("Account:")} ${email}\n${Md.bold("Linked:")} ${new Date(linkedAt).toLocaleDateString()}\n` + agentLine), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
+	return Message().blocks(Blocks.Section().text(Md.bold("Connected to Inkeep") + `\n\n${Md.bold("Account:")} ${email}\n${Md.bold("Linked:")} ${new Date(linkedAt).toLocaleDateString()}\n` + agentLine), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
 }
 function createJwtLinkMessage(linkUrl, expiresInMinutes) {
-	return Message().blocks(Blocks.Section().text(`${Md.bold("🔗 Link your Inkeep account")}\n\nConnect your Slack and Inkeep accounts to unlock AI-powered assistance:`), Blocks.Section().text(`${Md.bold("What you can do after linking:")}\n• Ask questions with \`/inkeep [question]\` or \`@Inkeep\`
-• Get personalized responses from AI agents
-• Set your own default agent preferences`), Blocks.Section().text(`${Md.bold("How to link:")}\n1. Click the button below
-2. Sign in to Inkeep (or create an account)
-3. Done! Come back here and start asking questions`), Blocks.Actions().elements(Elements.Button().text("🔗 Link Account").url(linkUrl).actionId("link_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes`)).buildToObject();
+	return Message().blocks(Blocks.Section().text(`${Md.bold("Link your Inkeep account")}\n\nConnect your Slack and Inkeep accounts to use Inkeep agents.`), Blocks.Actions().elements(Elements.Button().text("Link Account").url(linkUrl).actionId("link_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes.`)).buildToObject();
 }
 
 //#endregion

package/dist/slack/services/commands/index.js

@@ -6,9 +6,9 @@ import { resolveEffectiveAgent } from "../agent-resolution.js";
 import { SlackStrings } from "../../i18n/strings.js";
 import { createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "../blocks/index.js";
 import { getSlackClient } from "../client.js";
-import { fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "../events/utils.js";
+import { extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "../events/utils.js";
 import { buildAgentSelectorModal } from "../modals.js";
-import { deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, flushTraces, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
+import { deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, flushTraces, getInProcessFetch, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
 
 //#region src/slack/services/commands/index.ts
 const DEFAULT_CLIENT_ID = "work-apps-slack";
@@ -232,28 +232,34 @@ async function handleQuestionCommand(payload, question, _dashboardUrl, tenantId)
 		id: resolvedAgent.agentId,
 		name: resolvedAgent.agentName || null,
 		projectId: resolvedAgent.projectId
-	}, question, userTenantId).catch((error) => {
+	}, question, userTenantId, {
+		slackAuthorized: resolvedAgent.grantAccessToMembers,
+		slackAuthSource: resolvedAgent.source === "none" ? void 0 : resolvedAgent.source,
+		slackChannelId: payload.channelId,
+		slackAuthorizedProjectId: resolvedAgent.projectId
+	}).catch((error) => {
 		logger.error({ error }, "Background execution promise rejected");
 	}).finally(() => flushTraces());
 	const waitUntil = await getWaitUntil();
 	if (waitUntil) waitUntil(questionWork);
 	return {};
 }
-async function executeAgentInBackground(payload, existingLink, targetAgent, question, tenantId) {
+async function executeAgentInBackground(payload, existingLink, targetAgent, question, tenantId, channelAuth) {
 	try {
 		const slackUserToken = await signSlackUserToken({
 			inkeepUserId: existingLink.inkeepUserId,
 			tenantId,
 			slackTeamId: payload.teamId,
 			slackUserId: payload.userId,
-			slackEnterpriseId: payload.enterpriseId
+			slackEnterpriseId: payload.enterpriseId,
+			...channelAuth
 		});
 		const apiBaseUrl = env.INKEEP_AGENTS_API_URL || "http://localhost:3002";
 		const controller = new AbortController();
 		const timeout = setTimeout(() => controller.abort(), 3e4);
 		let response;
 		try {
-			response = await fetch(`${apiBaseUrl}/run/api/chat`, {
+			response = await getInProcessFetch()(`${apiBaseUrl}/run/api/chat`, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
@@ -295,9 +301,11 @@ async function executeAgentInBackground(payload, existingLink, targetAgent, ques
 				agentId: targetAgent.id,
 				projectId: targetAgent.projectId
 			}, "Run API call failed");
+			const apiMessage = extractApiErrorMessage(errorText);
+			const errorMessage = apiMessage ? `*Error.* ${apiMessage}` : `Failed to run agent: ${response.status} ${response.statusText}`;
 			await sendResponseUrlMessage(payload.responseUrl, {
 				response_type: "ephemeral",
-				text: `Failed to run agent: ${response.status} ${response.statusText}`
+				text: errorMessage
 			});
 		} else {
 			const result = await response.json();

package/dist/slack/services/dev-config.d.ts

@@ -0,0 +1,23 @@
+import { DefaultAgentConfig } from "./nango.js";
+
+//#region src/slack/services/dev-config.d.ts
+interface SlackDevConfig {
+  devId: string;
+  appId: string;
+  clientId: string;
+  clientSecret: string;
+  signingSecret: string;
+  appToken: string;
+  botToken: string;
+  teamId: string;
+  teamName: string;
+  configRefreshToken?: string;
+  metadata?: Record<string, string>;
+}
+declare function isSlackDevMode(): boolean;
+declare function loadSlackDevConfig(): SlackDevConfig | null;
+declare function getDevDefaultAgent(config: SlackDevConfig | null): DefaultAgentConfig | null;
+declare function resetDevConfigCache(): void;
+declare function saveSlackDevConfig(config: SlackDevConfig): boolean;
+//#endregion
+export { SlackDevConfig, getDevDefaultAgent, isSlackDevMode, loadSlackDevConfig, resetDevConfigCache, saveSlackDevConfig };

package/dist/slack/services/dev-config.js

@@ -0,0 +1,91 @@
+import { env } from "../../env.js";
+import { getLogger } from "../../logger.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, parse } from "node:path";
+
+//#region src/slack/services/dev-config.ts
+const logger = getLogger("slack-dev-config");
+const DEV_CONFIG_FILENAME = ".slack-dev.json";
+const CACHE_TTL_MS = 5e3;
+let cachedConfig = null;
+let cacheExpiresAt = 0;
+let resolvedConfigPath;
+function findDevConfigPath() {
+	let dir = process.cwd();
+	while (true) {
+		const candidate = join(dir, DEV_CONFIG_FILENAME);
+		if (existsSync(candidate)) return candidate;
+		const parent = dirname(dir);
+		if (parent === dir || parse(dir).root === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+function getDevConfigPath() {
+	if (resolvedConfigPath !== void 0) return resolvedConfigPath;
+	resolvedConfigPath = findDevConfigPath();
+	return resolvedConfigPath;
+}
+let devModeChecked = false;
+let devModeResult = false;
+function isSlackDevMode() {
+	if (devModeChecked) return devModeResult;
+	devModeResult = env.ENVIRONMENT === "development" && getDevConfigPath() !== null;
+	devModeChecked = true;
+	return devModeResult;
+}
+function loadSlackDevConfig() {
+	if (cachedConfig && Date.now() < cacheExpiresAt) return cachedConfig;
+	const configPath = getDevConfigPath();
+	if (!configPath) return null;
+	try {
+		const raw = readFileSync(configPath, "utf-8");
+		cachedConfig = JSON.parse(raw);
+		cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+		return cachedConfig;
+	} catch (error) {
+		logger.error({
+			error,
+			configPath
+		}, "Failed to read .slack-dev.json");
+		return null;
+	}
+}
+function getDevDefaultAgent(config) {
+	if (!config?.metadata?.default_agent) return null;
+	try {
+		return JSON.parse(config.metadata.default_agent);
+	} catch (error) {
+		logger.warn({
+			error,
+			rawValue: config.metadata.default_agent
+		}, "Failed to parse default_agent metadata as JSON - check .slack-dev.json format");
+		return null;
+	}
+}
+function resetDevConfigCache() {
+	cachedConfig = null;
+	cacheExpiresAt = 0;
+	resolvedConfigPath = void 0;
+	devModeChecked = false;
+	devModeResult = false;
+}
+function saveSlackDevConfig(config) {
+	const configPath = getDevConfigPath();
+	if (!configPath) return false;
+	try {
+		writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+		cachedConfig = config;
+		cacheExpiresAt = Date.now() + CACHE_TTL_MS;
+		return true;
+	} catch (error) {
+		logger.error({
+			error,
+			configPath
+		}, "Failed to write .slack-dev.json");
+		return false;
+	}
+}
+
+//#endregion
+export { getDevDefaultAgent, isSlackDevMode, loadSlackDevConfig, resetDevConfigCache, saveSlackDevConfig };