@inkeep/agents-work-apps 0.50.5 → 0.51.0

package/dist/slack/dispatcher.js

@@ -4,7 +4,7 @@ import { getSlackClient } from "./services/client.js";
 import { sendResponseUrlMessage } from "./services/events/utils.js";
 import { SLACK_SPAN_KEYS } from "./tracer.js";
 import { handleAppMention } from "./services/events/app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./services/events/block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./services/events/block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./services/events/modal-submission.js";
 import "./services/events/index.js";
 import "./services/index.js";
@@ -176,6 +176,29 @@ async function dispatchSlackEvent(eventType, payload, options, span) {
 						}
 					})());
 				}
+				if ((action.action_id === "tool_approval_approve" || action.action_id === "tool_approval_deny") && action.value) {
+					anyHandled = true;
+					const approved = action.action_id === "tool_approval_approve";
+					const slackUserId = payload.user?.id || "";
+					logger.info({
+						teamId,
+						actionId: action.action_id,
+						approved
+					}, `Handling block_action: ${action.action_id}`);
+					registerBackgroundWork(handleToolApproval({
+						actionValue: action.value,
+						approved,
+						teamId,
+						slackUserId,
+						responseUrl
+					}).catch((err) => {
+						const errorMessage = err instanceof Error ? err.message : String(err);
+						logger.error({
+							errorMessage,
+							actionId: action.action_id
+						}, "Failed to handle tool approval");
+					}).finally(() => flushTraces()));
+				}
 				if (action.action_id === "open_follow_up_modal" && action.value && triggerId) {
 					anyHandled = true;
 					logger.info({

package/dist/slack/i18n/strings.d.ts

@@ -45,6 +45,7 @@ declare const SlackStrings: {
   };
   readonly status: {
     readonly thinking: (agentName: string) => string;
+    readonly readingThread: (agentName: string) => string;
     readonly noAgentsAvailable: "No agents available";
     readonly noProjectsConfigured: "No projects configured. Set up projects in the dashboard.";
   };

package/dist/slack/i18n/strings.js

@@ -41,6 +41,7 @@ const SlackStrings = {
 	usage: { mentionEmpty: "*Include a message to use your Inkeep agent:*\n\n• `@Inkeep <message>` — Message the default agent (reply appears in a thread)\n• `@Inkeep <message>` in a thread — Includes thread as context\n• `@Inkeep` in a thread — Uses the full thread as context\n\nUse `/inkeep help` for all available commands." },
 	status: {
 		thinking: (agentName) => `_${agentName} is thinking..._`,
+		readingThread: (agentName) => `_${agentName} is reading this thread..._`,
 		noAgentsAvailable: "No agents available",
 		noProjectsConfigured: "No projects configured. Set up projects in the dashboard."
 	},

package/dist/slack/routes/users.js

@@ -131,12 +131,15 @@ app.openapi(createProtectedRoute({
 				tenantId
 			});
 		}
-		if (existingLink) logger.info({
-			slackUserId,
-			existingUserId: existingLink.inkeepUserId,
-			newUserId: inkeepUserId,
-			tenantId
-		}, "Slack user already linked, updating to new user");
+		if (existingLink) {
+			logger.info({
+				slackUserId,
+				existingUserId: existingLink.inkeepUserId,
+				newUserId: inkeepUserId,
+				tenantId
+			}, "Slack user already linked, updating to new user");
+			await deleteWorkAppSlackUserMapping(runDbClient_default)(tenantId, slackUserId, teamId, "work-apps-slack");
+		}
 		const slackUserMapping = await createWorkAppSlackUserMapping(runDbClient_default)({
 			tenantId,
 			clientId: "work-apps-slack",
@@ -162,10 +165,9 @@ app.openapi(createProtectedRoute({
 			tenantId
 		});
 	} catch (error) {
-		const errorMessage = error instanceof Error ? error.message : String(error);
-		if (errorMessage.includes("duplicate key") || errorMessage.includes("unique constraint")) {
-			logger.warn({ userId: body.userId }, "Slack user already linked");
-			return c.json({ error: "This Slack account is already linked to an Inkeep account." }, 409);
+		if (error instanceof Error && (error.message.includes("duplicate key") || error.message.includes("unique constraint")) || typeof error === "object" && error !== null && "cause" in error && typeof error.cause === "object" && error.cause?.code === "23505") {
+			logger.info({ userId: body.userId }, "Concurrent link resolved — mapping already exists");
+			return c.json({ success: true });
 		}
 		logger.error({
 			error,

package/dist/slack/routes/workspaces.js

@@ -5,7 +5,7 @@ import { getSlackChannels, getSlackClient, revokeSlackToken } from "../services/
 import "../services/index.js";
 import { requireChannelMemberOrAdmin, requireWorkspaceAdmin } from "../middleware/permissions.js";
 import { OpenAPIHono, z } from "@hono/zod-openapi";
-import { deleteAllWorkAppSlackChannelAgentConfigsByTeam, deleteAllWorkAppSlackUserMappingsByTeam, deleteWorkAppSlackChannelAgentConfig, deleteWorkAppSlackWorkspaceByNangoConnectionId, findWorkAppSlackChannelAgentConfig, listWorkAppSlackChannelAgentConfigsByTeam, listWorkAppSlackUserMappingsByTeam, upsertWorkAppSlackChannelAgentConfig } from "@inkeep/agents-core";
+import { deleteAllWorkAppSlackChannelAgentConfigsByTeam, deleteAllWorkAppSlackUserMappingsByTeam, deleteWorkAppSlackChannelAgentConfig, deleteWorkAppSlackWorkspaceByNangoConnectionId, findWorkAppSlackChannelAgentConfig, findWorkAppSlackWorkspaceByTeamId, listWorkAppSlackChannelAgentConfigsByTeam, listWorkAppSlackUserMappingsByTeam, updateWorkAppSlackWorkspace, upsertWorkAppSlackChannelAgentConfig } from "@inkeep/agents-core";
 import { createProtectedRoute, inheritedWorkAppsAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/slack/routes/workspaces.ts
@@ -48,6 +48,7 @@ const ChannelAgentConfigSchema = z.object({
 	grantAccessToMembers: z.boolean().optional()
 });
 const WorkspaceSettingsSchema = z.object({ defaultAgent: ChannelAgentConfigSchema.optional() });
+const JoinFromWorkspaceSettingsSchema = z.object({ shouldAllowJoinFromWorkspace: z.boolean() });
 app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
@@ -222,6 +223,89 @@ app.openapi(createProtectedRoute({
 	}
 	return c.json({ success: true });
 });
+app.openapi(createProtectedRoute({
+	method: "get",
+	path: "/{teamId}/join-from-workspace",
+	summary: "Get Join From Workspace Setting",
+	description: "Get the join from workspace setting for the workspace",
+	operationId: "slack-get-join-from-workspace",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Workspaces"
+	],
+	permission: inheritedWorkAppsAuth(),
+	request: { params: z.object({ teamId: z.string() }) },
+	responses: {
+		200: {
+			description: "Join from workspace setting",
+			content: { "application/json": { schema: JoinFromWorkspaceSettingsSchema } }
+		},
+		404: { description: "Workspace not found" }
+	}
+}), async (c) => {
+	const { teamId } = c.req.valid("param");
+	const sessionTenantId = c.get("tenantId");
+	if (!sessionTenantId) return c.json({ error: "Unauthorized" }, 401);
+	const workspace = await findWorkAppSlackWorkspaceByTeamId(runDbClient_default)(sessionTenantId, teamId);
+	if (!workspace) return c.json({ shouldAllowJoinFromWorkspace: false });
+	return c.json({ shouldAllowJoinFromWorkspace: workspace.shouldAllowJoinFromWorkspace ?? false });
+});
+app.openapi(createProtectedRoute({
+	method: "put",
+	path: "/{teamId}/join-from-workspace",
+	summary: "Update Join From Workspace Setting",
+	description: "Enable or disable join from workspace for the workspace",
+	operationId: "slack-update-join-from-workspace",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Workspaces"
+	],
+	permission: requireWorkspaceAdmin(),
+	request: {
+		params: z.object({ teamId: z.string() }),
+		body: { content: { "application/json": { schema: JoinFromWorkspaceSettingsSchema } } }
+	},
+	responses: {
+		200: {
+			description: "Join from workspace setting updated",
+			content: { "application/json": { schema: z.object({ success: z.boolean() }) } }
+		},
+		401: { description: "Unauthorized" },
+		404: { description: "Workspace not found" },
+		500: { description: "Failed to update setting" }
+	}
+}), async (c) => {
+	const { teamId } = c.req.valid("param");
+	const { shouldAllowJoinFromWorkspace } = c.req.valid("json");
+	const sessionTenantId = c.get("tenantId");
+	if (!sessionTenantId) return c.json({ error: "Unauthorized" }, 401);
+	const workspace = await findWorkAppSlackWorkspaceByTeamId(runDbClient_default)(sessionTenantId, teamId);
+	if (!workspace) return c.json({ error: "Workspace not found" }, 404);
+	try {
+		if (!await updateWorkAppSlackWorkspace(runDbClient_default)(workspace.id, { shouldAllowJoinFromWorkspace })) {
+			logger.error({
+				teamId,
+				shouldAllowJoinFromWorkspace
+			}, "Failed to update join from workspace setting");
+			return c.json({ error: "Failed to update setting" }, 500);
+		}
+		logger.info({
+			teamId,
+			shouldAllowJoinFromWorkspace,
+			workspaceId: workspace.id
+		}, "Updated workspace join from workspace settings");
+		return c.json({ success: true });
+	} catch (error) {
+		logger.error({
+			teamId,
+			shouldAllowJoinFromWorkspace,
+			error
+		}, "Failed to update join from workspace setting");
+		return c.json({ error: "Failed to update setting" }, 500);
+	}
+});
 app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{teamId}",

package/dist/slack/services/blocks/index.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import * as slack_block_builder0 from "slack-block-builder";
 
 //#region src/slack/services/blocks/index.d.ts
@@ -63,6 +64,52 @@ interface AgentConfigSources {
   } | null;
 }
 declare function createStatusMessage(email: string, linkedAt: string, dashboardUrl: string, agentConfigs: AgentConfigSources): Readonly<slack_block_builder0.SlackMessageDto>;
+interface ToolApprovalButtonValue {
+  toolCallId: string;
+  conversationId: string;
+  projectId: string;
+  agentId: string;
+  slackUserId: string;
+  channel: string;
+  threadTs: string;
+  toolName: string;
+}
+declare const ToolApprovalButtonValueSchema: z.ZodObject<{
+  toolCallId: z.ZodString;
+  conversationId: z.ZodString;
+  projectId: z.ZodString;
+  agentId: z.ZodString;
+  slackUserId: z.ZodString;
+  channel: z.ZodString;
+  threadTs: z.ZodString;
+  toolName: z.ZodString;
+}, z.core.$strip>;
+declare function buildToolApprovalBlocks(params: {
+  toolName: string;
+  input?: Record<string, unknown>;
+  buttonValue: string;
+}): any[];
+declare function buildToolApprovalDoneBlocks(params: {
+  toolName: string;
+  approved: boolean;
+  actorUserId: string;
+}): {
+  type: string;
+  elements: {
+    type: string;
+    text: string;
+  }[];
+}[];
+declare function buildToolApprovalExpiredBlocks(params: {
+  toolName: string;
+}): {
+  type: string;
+  elements: {
+    type: string;
+    text: string;
+  }[];
+}[];
 declare function createJwtLinkMessage(linkUrl: string, expiresInMinutes: number): Readonly<slack_block_builder0.SlackMessageDto>;
+declare function createCreateInkeepAccountMessage(acceptUrl: string, expiresInMinutes: number): Readonly<slack_block_builder0.SlackMessageDto>;
 //#endregion
-export { AgentConfigSources, ContextBlockParams, FollowUpButtonParams, buildConversationResponseBlocks, buildFollowUpButton, createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };
+export { AgentConfigSources, ContextBlockParams, FollowUpButtonParams, ToolApprovalButtonValue, ToolApprovalButtonValueSchema, buildConversationResponseBlocks, buildFollowUpButton, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };

package/dist/slack/services/blocks/index.js

@@ -1,4 +1,5 @@
 import { SlackStrings } from "../../i18n/strings.js";
+import { z } from "zod";
 import { Blocks, Elements, Md, Message } from "slack-block-builder";
 
 //#region src/slack/services/blocks/index.ts
@@ -34,24 +35,14 @@ function buildFollowUpButton(params) {
 * Shows the user's message, a divider, the agent response, context, and a Follow Up button.
 */
 function buildConversationResponseBlocks(params) {
-	const { userMessage, responseText, agentName, isError, followUpParams } = params;
-	const blocks = [
-		{
-			type: "context",
-			elements: [{
-				type: "mrkdwn",
-				text: `*You:* ${userMessage.length > 200 ? `${userMessage.slice(0, 200)}...` : userMessage}`
-			}]
-		},
-		{ type: "divider" },
-		{
-			type: "section",
-			text: {
-				type: "mrkdwn",
-				text: responseText
-			}
+	const { responseText, agentName, isError, followUpParams } = params;
+	const blocks = [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: responseText
 		}
-	];
+	}];
 	if (!isError) {
 		const contextBlock = createContextBlock({
 			agentName,
@@ -66,7 +57,7 @@ function buildConversationResponseBlocks(params) {
 	return blocks;
 }
 function createUpdatedHelpMessage() {
-	return Message().blocks(Blocks.Section().text(`${Md.bold(SlackStrings.help.title)}`), Blocks.Section().text(SlackStrings.help.publicSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.privateSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.otherCommands), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.docsLink)).buildToObject();
+	return Message().blocks(Blocks.Header().text(SlackStrings.help.title), Blocks.Section().text(SlackStrings.help.publicSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.privateSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.otherCommands), Blocks.Divider(), Blocks.Context().elements(SlackStrings.help.docsLink)).buildToObject();
 }
 function createAlreadyLinkedMessage(email, linkedAt, dashboardUrl) {
 	return Message().blocks(Blocks.Section().text(Md.bold("Already linked") + "\n\nYour Slack account is connected to Inkeep.\n\n" + Md.bold("Account:") + ` ${email}\n` + Md.bold("Linked:") + ` ${new Date(linkedAt).toLocaleDateString()}\n\nTo switch accounts, first run \`/inkeep unlink\``), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
@@ -84,9 +75,95 @@ function createStatusMessage(email, linkedAt, dashboardUrl, agentConfigs) {
 	else agentLine = `${Md.bold("Agent:")} None configured\n${Md.italic("Ask your admin to set up an agent in the dashboard.")}`;
 	return Message().blocks(Blocks.Section().text(Md.bold("Connected to Inkeep") + `\n\n${Md.bold("Account:")} ${email}\n${Md.bold("Linked:")} ${new Date(linkedAt).toLocaleDateString()}\n` + agentLine), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
 }
+const ToolApprovalButtonValueSchema = z.object({
+	toolCallId: z.string(),
+	conversationId: z.string(),
+	projectId: z.string(),
+	agentId: z.string(),
+	slackUserId: z.string(),
+	channel: z.string(),
+	threadTs: z.string(),
+	toolName: z.string()
+});
+function buildToolApprovalBlocks(params) {
+	const { toolName, input, buttonValue } = params;
+	const blocks = [{
+		type: "header",
+		text: {
+			type: "plain_text",
+			text: "Tool Approval Required",
+			emoji: false
+		}
+	}, {
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: `The agent wants to use \`${toolName}\`.`
+		}
+	}];
+	if (input && Object.keys(input).length > 0) {
+		const jsonStr = JSON.stringify(input, null, 2);
+		const truncated = jsonStr.length > 2900 ? `${jsonStr.slice(0, 2900)}…` : jsonStr;
+		blocks.push({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: `\`\`\`json\n${truncated}\n\`\`\``
+			}
+		});
+	}
+	blocks.push({ type: "divider" });
+	blocks.push({
+		type: "actions",
+		elements: [{
+			type: "button",
+			text: {
+				type: "plain_text",
+				text: "Approve",
+				emoji: false
+			},
+			style: "primary",
+			action_id: "tool_approval_approve",
+			value: buttonValue
+		}, {
+			type: "button",
+			text: {
+				type: "plain_text",
+				text: "Deny",
+				emoji: false
+			},
+			style: "danger",
+			action_id: "tool_approval_deny",
+			value: buttonValue
+		}]
+	});
+	return blocks;
+}
+function buildToolApprovalDoneBlocks(params) {
+	const { toolName, approved, actorUserId } = params;
+	return [{
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: approved ? `✅ Approved \`${toolName}\` · <@${actorUserId}>` : `❌ Denied \`${toolName}\` · <@${actorUserId}>`
+		}]
+	}];
+}
+function buildToolApprovalExpiredBlocks(params) {
+	return [{
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: `⏱️ Expired · \`${params.toolName}\``
+		}]
+	}];
+}
 function createJwtLinkMessage(linkUrl, expiresInMinutes) {
 	return Message().blocks(Blocks.Section().text(`${Md.bold("Link your Inkeep account")}\n\nConnect your Slack and Inkeep accounts to use Inkeep agents.`), Blocks.Actions().elements(Elements.Button().text("Link Account").url(linkUrl).actionId("link_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes.`)).buildToObject();
 }
+function createCreateInkeepAccountMessage(acceptUrl, expiresInMinutes) {
+	return Message().blocks(Blocks.Section().text(`${Md.bold("Create your Inkeep account")}\n\nYou've been invited to join Inkeep. Create an account to start using Inkeep agents in Slack.`), Blocks.Actions().elements(Elements.Button().text("Create Account").url(acceptUrl).actionId("create_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes.`)).buildToObject();
+}
 
 //#endregion
-export { buildConversationResponseBlocks, buildFollowUpButton, createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };
+export { ToolApprovalButtonValueSchema, buildConversationResponseBlocks, buildFollowUpButton, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };

package/dist/slack/services/commands/index.d.ts

@@ -2,7 +2,7 @@ import { SlackWorkspaceConnection } from "../nango.js";
 import { SlackCommandPayload, SlackCommandResponse } from "../types.js";
 
 //#region src/slack/services/commands/index.d.ts
-declare function handleLinkCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string): Promise<SlackCommandResponse>;
+declare function handleLinkCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string, botToken?: string): Promise<SlackCommandResponse>;
 declare function handleUnlinkCommand(payload: SlackCommandPayload, tenantId: string): Promise<SlackCommandResponse>;
 declare function handleStatusCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string): Promise<SlackCommandResponse>;
 declare function handleHelpCommand(): Promise<SlackCommandResponse>;

package/dist/slack/services/commands/index.js

@@ -4,22 +4,116 @@ import runDbClient_default from "../../../db/runDbClient.js";
 import { findWorkspaceConnectionByTeamId } from "../nango.js";
 import { resolveEffectiveAgent } from "../agent-resolution.js";
 import { SlackStrings } from "../../i18n/strings.js";
-import { createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "../blocks/index.js";
+import { createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "../blocks/index.js";
 import { getSlackClient } from "../client.js";
 import { extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "../events/utils.js";
 import { buildAgentSelectorModal } from "../modals.js";
-import { deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, flushTraces, getInProcessFetch, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
+import { createInvitationInDb, deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, findWorkAppSlackWorkspaceByTeamId, flushTraces, getInProcessFetch, getOrganizationMemberByEmail, getPendingInvitationsByEmail, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
 
 //#region src/slack/services/commands/index.ts
 const DEFAULT_CLIENT_ID = "work-apps-slack";
 const LINK_CODE_TTL_MINUTES = 10;
 const logger = getLogger("slack-commands");
-async function handleLinkCommand(payload, dashboardUrl, tenantId) {
+/**
+* Create an invitation for a Slack user who doesn't have an Inkeep account yet.
+* Returns the invitation ID and email so the caller can direct the user
+* to the accept-invitation page.
+*
+* Returns null if:
+* - Workspace doesn't have shouldAllowJoinFromWorkspace enabled
+* - User already has an Inkeep account (JWT link flow is sufficient)
+* - Service account is not configured
+*/
+async function tryAutoInvite(payload, tenantId, botToken) {
+	try {
+		if (!(await findWorkAppSlackWorkspaceByTeamId(runDbClient_default)(tenantId, payload.teamId))?.shouldAllowJoinFromWorkspace) return null;
+		const slackClient = getSlackClient(botToken);
+		let userEmail;
+		try {
+			userEmail = (await slackClient.users.info({ user: payload.userId })).user?.profile?.email;
+		} catch (error) {
+			logger.warn({
+				error,
+				userId: payload.userId
+			}, "Failed to get user info from Slack");
+			return null;
+		}
+		if (!userEmail) {
+			logger.warn({ userId: payload.userId }, "No email found in Slack user profile");
+			return null;
+		}
+		if (await getOrganizationMemberByEmail(runDbClient_default)(tenantId, userEmail)) {
+			logger.debug({
+				userId: payload.userId,
+				email: userEmail
+			}, "User already has Inkeep account, skipping auto-invite");
+			return null;
+		}
+		const existingInvitation = (await getPendingInvitationsByEmail(runDbClient_default)(userEmail)).find((inv) => inv.organizationId === tenantId);
+		if (existingInvitation) {
+			logger.info({
+				userId: payload.userId,
+				tenantId,
+				invitationId: existingInvitation.id,
+				email: userEmail
+			}, "Reusing existing pending invitation for Slack user");
+			return {
+				invitationId: existingInvitation.id,
+				email: userEmail
+			};
+		}
+		const invitation = await createInvitationInDb(runDbClient_default)({
+			organizationId: tenantId,
+			email: userEmail
+		});
+		logger.info({
+			userId: payload.userId,
+			tenantId,
+			invitationId: invitation.id,
+			email: userEmail
+		}, "Invitation created for Slack user without Inkeep account");
+		return {
+			invitationId: invitation.id,
+			email: userEmail
+		};
+	} catch (error) {
+		logger.warn({
+			error,
+			userId: payload.userId,
+			tenantId
+		}, "Auto-invite attempt failed");
+		return null;
+	}
+}
+async function handleLinkCommand(payload, dashboardUrl, tenantId, botToken) {
 	const existingLink = await findWorkAppSlackUserMapping(runDbClient_default)(tenantId, payload.userId, payload.teamId, DEFAULT_CLIENT_ID);
 	if (existingLink) return {
 		response_type: "ephemeral",
 		...createAlreadyLinkedMessage(existingLink.slackEmail || existingLink.slackUsername || "Unknown", existingLink.linkedAt, dashboardUrl)
 	};
+	if (botToken) {
+		const autoInvite = await tryAutoInvite(payload, tenantId, botToken);
+		if (autoInvite) {
+			const manageUiUrl = env.INKEEP_AGENTS_MANAGE_UI_URL || "http://localhost:3000";
+			const linkToken = await signSlackLinkToken({
+				tenantId,
+				slackTeamId: payload.teamId,
+				slackUserId: payload.userId,
+				slackEnterpriseId: payload.enterpriseId,
+				slackUsername: payload.userName
+			});
+			const linkReturnUrl = `/link?token=${encodeURIComponent(linkToken)}`;
+			const acceptUrl = `${manageUiUrl}/accept-invitation/${autoInvite.invitationId}?email=${encodeURIComponent(autoInvite.email)}&returnUrl=${encodeURIComponent(linkReturnUrl)}`;
+			logger.info({
+				invitationId: autoInvite.invitationId,
+				email: autoInvite.email
+			}, "Directing new user to accept-invitation page with link returnUrl");
+			return {
+				response_type: "ephemeral",
+				...createCreateInkeepAccountMessage(acceptUrl, LINK_CODE_TTL_MINUTES)
+			};
+		}
+	}
 	try {
 		const linkToken = await signSlackLinkToken({
 			tenantId,
@@ -363,7 +457,7 @@ async function handleCommand(payload) {
 	}, "Slack command received");
 	switch (subcommand) {
 		case "link":
-		case "connect": return handleLinkCommand(payload, dashboardUrl, tenantId);
+		case "connect": return handleLinkCommand(payload, dashboardUrl, tenantId, workspaceConnection.botToken);
 		case "status": return handleStatusCommand(payload, dashboardUrl, tenantId);
 		case "unlink":
 		case "logout":

package/dist/slack/services/events/app-mention.js

@@ -196,7 +196,7 @@ async function handleAppMention(params) {
 				thinkingMessageTs = (await slackClient.chat.postMessage({
 					channel,
 					thread_ts: threadTs,
-					text: `_${agentDisplayName} is reading this thread..._`
+					text: SlackStrings.status.readingThread(agentDisplayName)
 				})).ts || void 0;
 				const conversationId$1 = generateSlackConversationId({
 					teamId,
@@ -274,7 +274,7 @@ Respond naturally as if you're joining the conversation to help.`;
 			thinkingMessageTs = (await slackClient.chat.postMessage({
 				channel,
 				thread_ts: replyThreadTs,
-				text: `_${agentDisplayName} is preparing a response..._`
+				text: SlackStrings.status.thinking(agentDisplayName)
 			})).ts || void 0;
 			const conversationId = generateSlackConversationId({
 				teamId,

package/dist/slack/services/events/block-actions.d.ts

@@ -3,6 +3,17 @@
  * Handlers for Slack block action events (button clicks, selections, etc.)
  * and message shortcuts
  */
+/**
+ * Handle tool approval/denial button clicks.
+ * Called when a user clicks "Approve" or "Deny" on a tool approval message.
+ */
+declare function handleToolApproval(params: {
+  actionValue: string;
+  approved: boolean;
+  teamId: string;
+  slackUserId: string;
+  responseUrl?: string;
+}): Promise<void>;
 /**
  * Handle opening the agent selector modal when user clicks "Select Agent" button
  */
@@ -37,4 +48,4 @@ declare function handleMessageShortcut(params: {
   responseUrl?: string;
 }): Promise<void>;
 //#endregion
-export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal };
+export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval };

package/dist/slack/services/events/block-actions.js

@@ -1,10 +1,13 @@
+import { env } from "../../../env.js";
 import { getLogger } from "../../../logger.js";
 import { findWorkspaceConnectionByTeamId } from "../nango.js";
 import { SlackStrings } from "../../i18n/strings.js";
+import { ToolApprovalButtonValueSchema, buildToolApprovalDoneBlocks } from "../blocks/index.js";
 import { getSlackClient } from "../client.js";
-import { fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "./utils.js";
+import { fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, getChannelAgentConfig, sendResponseUrlMessage } from "./utils.js";
 import { buildAgentSelectorModal, buildFollowUpModal, buildMessageShortcutModal } from "../modals.js";
 import { SLACK_SPAN_KEYS, SLACK_SPAN_NAMES, setSpanWithError, tracer } from "../../tracer.js";
+import { getInProcessFetch, signSlackUserToken } from "@inkeep/agents-core";
 
 //#region src/slack/services/events/block-actions.ts
 /**
@@ -13,6 +16,127 @@ import { SLACK_SPAN_KEYS, SLACK_SPAN_NAMES, setSpanWithError, tracer } from "../
 */
 const logger = getLogger("slack-block-actions");
 /**
+* Handle tool approval/denial button clicks.
+* Called when a user clicks "Approve" or "Deny" on a tool approval message.
+*/
+async function handleToolApproval(params) {
+	return tracer.startActiveSpan(SLACK_SPAN_NAMES.TOOL_APPROVAL, async (span) => {
+		const { actionValue, approved, teamId, slackUserId, responseUrl } = params;
+		span.setAttribute(SLACK_SPAN_KEYS.TEAM_ID, teamId);
+		span.setAttribute(SLACK_SPAN_KEYS.USER_ID, slackUserId);
+		try {
+			const buttonValue = ToolApprovalButtonValueSchema.parse(JSON.parse(actionValue));
+			const { toolCallId, conversationId, projectId, agentId, toolName } = buttonValue;
+			span.setAttribute(SLACK_SPAN_KEYS.CONVERSATION_ID, conversationId);
+			const workspaceConnection = await findWorkspaceConnectionByTeamId(teamId);
+			if (!workspaceConnection?.botToken) {
+				logger.error({ teamId }, "No bot token for tool approval");
+				span.end();
+				return;
+			}
+			const tenantId = workspaceConnection.tenantId;
+			const slackClient = getSlackClient(workspaceConnection.botToken);
+			if (slackUserId !== buttonValue.slackUserId) {
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: "Only the user who started this conversation can approve or deny this action."
+				}).catch((e) => logger.warn({ error: e }, "Failed to send ownership error notification"));
+				span.end();
+				return;
+			}
+			const existingLink = await findCachedUserMapping(tenantId, slackUserId, teamId);
+			if (!existingLink) {
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: "You need to link your Inkeep account first. Use `/inkeep link`."
+				}).catch((e) => logger.warn({ error: e }, "Failed to send not-linked notification"));
+				span.end();
+				return;
+			}
+			const slackUserToken = await signSlackUserToken({
+				inkeepUserId: existingLink.inkeepUserId,
+				tenantId,
+				slackTeamId: teamId,
+				slackUserId
+			});
+			const apiUrl = env.INKEEP_AGENTS_API_URL || "http://localhost:3002";
+			const approvalResponse = await getInProcessFetch()(`${apiUrl}/run/api/chat`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${slackUserToken}`,
+					"x-inkeep-project-id": projectId,
+					"x-inkeep-agent-id": agentId
+				},
+				body: JSON.stringify({
+					conversationId,
+					messages: [{
+						role: "tool",
+						parts: [{
+							type: "tool-call",
+							toolCallId,
+							state: "approval-responded",
+							approval: {
+								id: toolCallId,
+								approved
+							}
+						}]
+					}]
+				})
+			});
+			if (!approvalResponse.ok) {
+				const errorBody = await approvalResponse.text().catch(() => "");
+				logger.error({
+					status: approvalResponse.status,
+					errorBody,
+					toolCallId,
+					conversationId
+				}, "Tool approval API call failed");
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: `Failed to ${approved ? "approve" : "deny"} \`${toolName}\`. Please try again.`
+				}).catch((e) => logger.warn({ error: e }, "Failed to send approval error notification"));
+				span.end();
+				return;
+			}
+			if (responseUrl) await sendResponseUrlMessage(responseUrl, {
+				text: approved ? `✅ Approved \`${toolName}\`` : `❌ Denied \`${toolName}\``,
+				replace_original: true,
+				blocks: buildToolApprovalDoneBlocks({
+					toolName,
+					approved,
+					actorUserId: slackUserId
+				})
+			}).catch((e) => logger.warn({ error: e }, "Failed to update approval message"));
+			logger.info({
+				toolCallId,
+				conversationId,
+				approved,
+				slackUserId
+			}, "Tool approval processed");
+			span.end();
+		} catch (error) {
+			if (error instanceof Error) setSpanWithError(span, error);
+			logger.error({
+				error,
+				teamId,
+				slackUserId
+			}, "Failed to handle tool approval");
+			if (responseUrl) await sendResponseUrlMessage(responseUrl, {
+				text: "Something went wrong processing your request. Please try again.",
+				response_type: "ephemeral"
+			}).catch((e) => logger.warn({ error: e }, "Failed to send error notification"));
+			span.end();
+		}
+	});
+}
+/**
 * Handle opening the agent selector modal when user clicks "Select Agent" button
 */
 async function handleOpenAgentSelectorModal(params) {
@@ -262,4 +386,4 @@ async function handleMessageShortcut(params) {
 }
 
 //#endregion
-export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal };
+export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval };

package/dist/slack/services/events/index.d.ts

@@ -1,6 +1,6 @@
 import { InlineSelectorMetadata, handleAppMention } from "./app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./modal-submission.js";
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./utils.js";
 import { StreamResult, streamAgentResponse } from "./streaming.js";
-export { type InlineSelectorMetadata, SlackErrorType, type StreamResult, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };
+export { type InlineSelectorMetadata, SlackErrorType, type StreamResult, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };

package/dist/slack/services/events/index.js

@@ -1,7 +1,7 @@
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./utils.js";
 import { streamAgentResponse } from "./streaming.js";
 import { handleAppMention } from "./app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./modal-submission.js";
 
-export { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };
+export { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };

package/dist/slack/services/events/streaming.d.ts

@@ -20,7 +20,7 @@ declare function streamAgentResponse(params: {
   agentId: string;
   question: string;
   agentName: string;
-  conversationId?: string;
+  conversationId: string;
 }): Promise<StreamResult>;
 //#endregion
 export { StreamResult, streamAgentResponse };

package/dist/slack/services/events/streaming.js

@@ -1,6 +1,6 @@
 import { env } from "../../../env.js";
 import { getLogger } from "../../../logger.js";
-import { createContextBlock } from "../blocks/index.js";
+import { buildToolApprovalBlocks, buildToolApprovalExpiredBlocks, createContextBlock } from "../blocks/index.js";
 import { SlackErrorType, classifyError, extractApiErrorMessage, getUserFriendlyErrorMessage } from "./utils.js";
 import { SLACK_SPAN_KEYS, SLACK_SPAN_NAMES, setSpanWithError, tracer } from "../../tracer.js";
 import { getInProcessFetch } from "@inkeep/agents-core";
@@ -50,6 +50,10 @@ async function streamAgentResponse(params) {
 			projectId
 		}, "Starting streaming agent response");
 		const abortController = new AbortController();
+		const abortPromise = new Promise((_, reject) => {
+			abortController.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("Stream timeout")), { once: true });
+		});
+		let reader;
 		const timeoutId = setTimeout(() => {
 			logger.warn({
 				channel,
@@ -177,7 +181,7 @@ async function streamAgentResponse(params) {
 				errorMessage
 			};
 		}
-		const reader = response.body.getReader();
+		reader = response.body.getReader();
 		const decoder = new TextDecoder();
 		let buffer = "";
 		let fullText = "";
@@ -187,10 +191,11 @@ async function streamAgentResponse(params) {
 			recipient_user_id: slackUserId,
 			thread_ts: threadTs
 		});
+		const pendingApprovalMessages = [];
 		try {
 			let agentCompleted = false;
 			while (true) {
-				const { done, value } = await reader.read();
+				const { done, value } = await Promise.race([reader.read(), abortPromise]);
 				if (done) break;
 				buffer += decoder.decode(value, { stream: true });
 				const lines = buffer.split("\n");
@@ -208,6 +213,43 @@ async function streamAgentResponse(params) {
 							}
 							continue;
 						}
+						if (data.type === "tool-approval-request" && conversationId) {
+							const toolName = data.toolName || "Tool";
+							const toolCallId = data.toolCallId;
+							const input = data.input;
+							const buttonValue = {
+								toolCallId,
+								conversationId,
+								projectId,
+								agentId,
+								slackUserId,
+								channel,
+								threadTs,
+								toolName
+							};
+							const approvalPost = await slackClient.chat.postMessage({
+								channel,
+								thread_ts: threadTs,
+								text: `Tool approval required: \`${toolName}\``,
+								blocks: buildToolApprovalBlocks({
+									toolName,
+									input,
+									buttonValue: JSON.stringify(buttonValue)
+								})
+							}).catch((e) => {
+								logger.warn({
+									error: e,
+									toolCallId
+								}, "Failed to post tool approval message");
+								return null;
+							});
+							if (approvalPost?.ts) pendingApprovalMessages.push({
+								messageTs: approvalPost.ts,
+								toolName
+							});
+							clearTimeout(timeoutId);
+							continue;
+						}
 						if (data.type === "text-start" || data.type === "text-end") continue;
 						if (data.type === "text-delta" && data.delta) {
 							fullText += data.delta;
@@ -256,7 +298,17 @@ async function streamAgentResponse(params) {
 			return { success: true };
 		} catch (streamError) {
 			clearTimeout(timeoutId);
+			reader?.cancel().catch(() => {});
 			if (streamError instanceof Error) setSpanWithError(span, streamError);
+			for (const { messageTs, toolName } of pendingApprovalMessages) await slackClient.chat.update({
+				channel,
+				ts: messageTs,
+				text: `⏱️ Expired · \`${toolName}\``,
+				blocks: buildToolApprovalExpiredBlocks({ toolName })
+			}).catch((e) => logger.warn({
+				error: e,
+				messageTs
+			}, "Failed to expire approval message"));
 			if (fullText.length > 0) {
 				span.setAttribute(SLACK_SPAN_KEYS.CONTENT_ALREADY_DELIVERED, true);
 				logger.warn({
@@ -275,6 +327,22 @@ async function streamAgentResponse(params) {
 				span.end();
 				return { success: true };
 			}
+			if (pendingApprovalMessages.length > 0) {
+				for (const { toolName } of pendingApprovalMessages) await slackClient.chat.postMessage({
+					channel,
+					thread_ts: threadTs,
+					text: `Approval for \`${toolName}\` has expired.`
+				}).catch((e) => logger.warn({ error: e }, "Failed to send approval expired notification"));
+				await withTimeout(streamer.stop(), CLEANUP_TIMEOUT_MS, "streamer.stop-cleanup").catch((e) => logger.warn({ error: e }, "Failed to stop streamer during error cleanup"));
+				if (thinkingMessageTs) try {
+					await slackClient.chat.delete({
+						channel,
+						ts: thinkingMessageTs
+					});
+				} catch {}
+				span.end();
+				return { success: true };
+			}
 			logger.error({ streamError }, "Error during Slack streaming");
 			await withTimeout(streamer.stop(), CLEANUP_TIMEOUT_MS, "streamer.stop-cleanup").catch((e) => logger.warn({ error: e }, "Failed to stop streamer during error cleanup"));
 			if (thinkingMessageTs) try {

package/dist/slack/services/events/utils.d.ts

@@ -11,9 +11,9 @@ declare function findCachedUserMapping(tenantId: string, slackUserId: string, te
   id: string;
   createdAt: string;
   updatedAt: string;
+  slackUserId: string;
   tenantId: string;
   clientId: string;
-  slackUserId: string;
   slackTeamId: string;
   slackEnterpriseId: string | null;
   inkeepUserId: string;

package/dist/slack/services/events/utils.js

@@ -239,9 +239,12 @@ async function resolveChannelAgentConfig(teamId, channelId, workspace) {
 async function sendResponseUrlMessage(responseUrl, message) {
 	try {
 		const payload = { text: message.text };
-		if (message.replace_original) payload.replace_original = true;
+		if (message.replace_original === true) payload.replace_original = true;
 		else if (message.delete_original) payload.delete_original = true;
-		else if (message.response_type) payload.response_type = message.response_type;
+		else {
+			payload.replace_original = false;
+			if (message.response_type) payload.response_type = message.response_type;
+		}
 		if (message.blocks) payload.blocks = message.blocks;
 		logger.info({
 			hasBlocks: !!message.blocks,

package/dist/slack/services/index.d.ts

@@ -1,11 +1,11 @@
 import { AgentResolutionParams, ResolvedAgentConfig, getAgentConfigSources, resolveEffectiveAgent } from "./agent-resolution.js";
-import { AgentConfigSources, ContextBlockParams, FollowUpButtonParams, buildConversationResponseBlocks, buildFollowUpButton, createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "./blocks/index.js";
+import { AgentConfigSources, ContextBlockParams, FollowUpButtonParams, ToolApprovalButtonValue, ToolApprovalButtonValueSchema, buildConversationResponseBlocks, buildFollowUpButton, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "./blocks/index.js";
 import { checkUserIsChannelMember, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackTeamInfo, getSlackUserInfo, postMessage, postMessageInThread, revokeSlackToken } from "./client.js";
 import { DefaultAgentConfig, SlackWorkspaceConnection, WorkspaceInstallData, clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createConnectSession, deleteWorkspaceInstallation, findWorkspaceConnectionByTeamId, getConnectionAccessToken, getSlackIntegrationId, getSlackNango, getWorkspaceDefaultAgentFromNango, listWorkspaceInstallations, setWorkspaceDefaultAgent, storeWorkspaceInstallation, updateConnectionMetadata } from "./nango.js";
 import { SlackCommandPayload, SlackCommandResponse } from "./types.js";
 import { handleAgentPickerCommand, handleCommand, handleHelpCommand, handleLinkCommand, handleQuestionCommand, handleStatusCommand, handleUnlinkCommand } from "./commands/index.js";
 import { InlineSelectorMetadata, handleAppMention } from "./events/app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./events/block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./events/block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./events/modal-submission.js";
 import { AgentOption, BuildAgentSelectorModalParams, BuildMessageShortcutModalParams, FollowUpModalMetadata, ModalMetadata, buildAgentSelectorModal, buildFollowUpModal, buildMessageShortcutModal } from "./modals.js";
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./events/utils.js";
@@ -13,4 +13,4 @@ import { StreamResult, streamAgentResponse } from "./events/streaming.js";
 import "./events/index.js";
 import { parseSlackCommandBody, parseSlackEventBody, verifySlackRequest } from "./security.js";
 import { getBotTokenForTeam, setBotTokenForTeam } from "./workspace-tokens.js";
-export { AgentConfigSources, AgentOption, AgentResolutionParams, BuildAgentSelectorModalParams, BuildMessageShortcutModalParams, ContextBlockParams, DefaultAgentConfig, FollowUpButtonParams, FollowUpModalMetadata, InlineSelectorMetadata, ModalMetadata, ResolvedAgentConfig, SlackCommandPayload, SlackCommandResponse, SlackErrorType, SlackWorkspaceConnection, StreamResult, WorkspaceInstallData, buildAgentSelectorModal, buildConversationResponseBlocks, buildFollowUpButton, buildFollowUpModal, buildMessageShortcutModal, checkIfBotThread, checkUserIsChannelMember, classifyError, clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createAlreadyLinkedMessage, createConnectSession, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage, deleteWorkspaceInstallation, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, findWorkspaceConnectionByTeamId, generateSlackConversationId, getAgentConfigSources, getBotTokenForTeam, getChannelAgentConfig, getConnectionAccessToken, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackIntegrationId, getSlackNango, getSlackTeamInfo, getSlackUserInfo, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, getWorkspaceDefaultAgentFromNango, handleAgentPickerCommand, handleAppMention, handleCommand, handleFollowUpSubmission, handleHelpCommand, handleLinkCommand, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleQuestionCommand, handleStatusCommand, handleUnlinkCommand, listWorkspaceInstallations, markdownToMrkdwn, parseSlackCommandBody, parseSlackEventBody, postMessage, postMessageInThread, resolveEffectiveAgent, revokeSlackToken, sendResponseUrlMessage, setBotTokenForTeam, setWorkspaceDefaultAgent, storeWorkspaceInstallation, streamAgentResponse, updateConnectionMetadata, verifySlackRequest };
+export { AgentConfigSources, AgentOption, AgentResolutionParams, BuildAgentSelectorModalParams, BuildMessageShortcutModalParams, ContextBlockParams, DefaultAgentConfig, FollowUpButtonParams, FollowUpModalMetadata, InlineSelectorMetadata, ModalMetadata, ResolvedAgentConfig, SlackCommandPayload, SlackCommandResponse, SlackErrorType, SlackWorkspaceConnection, StreamResult, ToolApprovalButtonValue, ToolApprovalButtonValueSchema, WorkspaceInstallData, buildAgentSelectorModal, buildConversationResponseBlocks, buildFollowUpButton, buildFollowUpModal, buildMessageShortcutModal, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, checkIfBotThread, checkUserIsChannelMember, classifyError, clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createAlreadyLinkedMessage, createConnectSession, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage, deleteWorkspaceInstallation, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, findWorkspaceConnectionByTeamId, generateSlackConversationId, getAgentConfigSources, getBotTokenForTeam, getChannelAgentConfig, getConnectionAccessToken, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackIntegrationId, getSlackNango, getSlackTeamInfo, getSlackUserInfo, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, getWorkspaceDefaultAgentFromNango, handleAgentPickerCommand, handleAppMention, handleCommand, handleFollowUpSubmission, handleHelpCommand, handleLinkCommand, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleQuestionCommand, handleStatusCommand, handleToolApproval, handleUnlinkCommand, listWorkspaceInstallations, markdownToMrkdwn, parseSlackCommandBody, parseSlackEventBody, postMessage, postMessageInThread, resolveEffectiveAgent, revokeSlackToken, sendResponseUrlMessage, setBotTokenForTeam, setWorkspaceDefaultAgent, storeWorkspaceInstallation, streamAgentResponse, updateConnectionMetadata, verifySlackRequest };

package/dist/slack/services/index.js

@@ -1,16 +1,16 @@
 import { clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createConnectSession, deleteWorkspaceInstallation, findWorkspaceConnectionByTeamId, getConnectionAccessToken, getSlackIntegrationId, getSlackNango, getWorkspaceDefaultAgentFromNango, listWorkspaceInstallations, setWorkspaceDefaultAgent, storeWorkspaceInstallation, updateConnectionMetadata } from "./nango.js";
 import { getAgentConfigSources, resolveEffectiveAgent } from "./agent-resolution.js";
-import { buildConversationResponseBlocks, buildFollowUpButton, createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "./blocks/index.js";
+import { ToolApprovalButtonValueSchema, buildConversationResponseBlocks, buildFollowUpButton, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "./blocks/index.js";
 import { checkUserIsChannelMember, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackTeamInfo, getSlackUserInfo, postMessage, postMessageInThread, revokeSlackToken } from "./client.js";
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./events/utils.js";
 import { buildAgentSelectorModal, buildFollowUpModal, buildMessageShortcutModal } from "./modals.js";
 import { handleAgentPickerCommand, handleCommand, handleHelpCommand, handleLinkCommand, handleQuestionCommand, handleStatusCommand, handleUnlinkCommand } from "./commands/index.js";
 import { streamAgentResponse } from "./events/streaming.js";
 import { handleAppMention } from "./events/app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./events/block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./events/block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./events/modal-submission.js";
 import "./events/index.js";
 import { parseSlackCommandBody, parseSlackEventBody, verifySlackRequest } from "./security.js";
 import { getBotTokenForTeam, setBotTokenForTeam } from "./workspace-tokens.js";
 
-export { SlackErrorType, buildAgentSelectorModal, buildConversationResponseBlocks, buildFollowUpButton, buildFollowUpModal, buildMessageShortcutModal, checkIfBotThread, checkUserIsChannelMember, classifyError, clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createAlreadyLinkedMessage, createConnectSession, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage, deleteWorkspaceInstallation, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, findWorkspaceConnectionByTeamId, generateSlackConversationId, getAgentConfigSources, getBotTokenForTeam, getChannelAgentConfig, getConnectionAccessToken, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackIntegrationId, getSlackNango, getSlackTeamInfo, getSlackUserInfo, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, getWorkspaceDefaultAgentFromNango, handleAgentPickerCommand, handleAppMention, handleCommand, handleFollowUpSubmission, handleHelpCommand, handleLinkCommand, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleQuestionCommand, handleStatusCommand, handleUnlinkCommand, listWorkspaceInstallations, markdownToMrkdwn, parseSlackCommandBody, parseSlackEventBody, postMessage, postMessageInThread, resolveEffectiveAgent, revokeSlackToken, sendResponseUrlMessage, setBotTokenForTeam, setWorkspaceDefaultAgent, storeWorkspaceInstallation, streamAgentResponse, updateConnectionMetadata, verifySlackRequest };
+export { SlackErrorType, ToolApprovalButtonValueSchema, buildAgentSelectorModal, buildConversationResponseBlocks, buildFollowUpButton, buildFollowUpModal, buildMessageShortcutModal, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, checkIfBotThread, checkUserIsChannelMember, classifyError, clearWorkspaceConnectionCache, computeWorkspaceConnectionId, createAlreadyLinkedMessage, createConnectSession, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage, deleteWorkspaceInstallation, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, findWorkspaceConnectionByTeamId, generateSlackConversationId, getAgentConfigSources, getBotTokenForTeam, getChannelAgentConfig, getConnectionAccessToken, getSlackChannelInfo, getSlackChannels, getSlackClient, getSlackIntegrationId, getSlackNango, getSlackTeamInfo, getSlackUserInfo, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, getWorkspaceDefaultAgentFromNango, handleAgentPickerCommand, handleAppMention, handleCommand, handleFollowUpSubmission, handleHelpCommand, handleLinkCommand, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleQuestionCommand, handleStatusCommand, handleToolApproval, handleUnlinkCommand, listWorkspaceInstallations, markdownToMrkdwn, parseSlackCommandBody, parseSlackEventBody, postMessage, postMessageInThread, resolveEffectiveAgent, revokeSlackToken, sendResponseUrlMessage, setBotTokenForTeam, setWorkspaceDefaultAgent, storeWorkspaceInstallation, streamAgentResponse, updateConnectionMetadata, verifySlackRequest };

package/dist/slack/tracer.d.ts

@@ -15,6 +15,7 @@ declare const SLACK_SPAN_NAMES: {
   readonly OPEN_FOLLOW_UP_MODAL: "slack.open_follow_up_modal";
   readonly PROJECT_SELECT_UPDATE: "slack.project_select_update";
   readonly CALL_AGENT_API: "slack.call_agent_api";
+  readonly TOOL_APPROVAL: "slack.tool_approval";
 };
 declare const SLACK_SPAN_KEYS: {
   readonly TEAM_ID: "slack.team_id";

package/dist/slack/tracer.js

@@ -13,7 +13,8 @@ const SLACK_SPAN_NAMES = {
 	OPEN_AGENT_SELECTOR_MODAL: "slack.open_agent_selector_modal",
 	OPEN_FOLLOW_UP_MODAL: "slack.open_follow_up_modal",
 	PROJECT_SELECT_UPDATE: "slack.project_select_update",
-	CALL_AGENT_API: "slack.call_agent_api"
+	CALL_AGENT_API: "slack.call_agent_api",
+	TOOL_APPROVAL: "slack.tool_approval"
 };
 const SLACK_SPAN_KEYS = {
 	TEAM_ID: "slack.team_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-work-apps",
-  "version": "0.50.5",
+  "version": "0.51.0",
   "description": "First party integrations for Inkeep Agents",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -33,7 +33,7 @@
     "jose": "^6.1.0",
     "minimatch": "^10.1.1",
     "slack-block-builder": "^2.8.0",
-    "@inkeep/agents-core": "0.50.5"
+    "@inkeep/agents-core": "0.51.0"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",