@inkeep/agents-work-apps 0.50.6 → 0.52.0

package/dist/slack/services/blocks/index.js

@@ -1,4 +1,5 @@
 import { SlackStrings } from "../../i18n/strings.js";
+import { z } from "zod";
 import { Blocks, Elements, Md, Message } from "slack-block-builder";
 
 //#region src/slack/services/blocks/index.ts
@@ -34,24 +35,14 @@ function buildFollowUpButton(params) {
 * Shows the user's message, a divider, the agent response, context, and a Follow Up button.
 */
 function buildConversationResponseBlocks(params) {
-	const { userMessage, responseText, agentName, isError, followUpParams } = params;
-	const blocks = [
-		{
-			type: "context",
-			elements: [{
-				type: "mrkdwn",
-				text: `*You:* ${userMessage.length > 200 ? `${userMessage.slice(0, 200)}...` : userMessage}`
-			}]
-		},
-		{ type: "divider" },
-		{
-			type: "section",
-			text: {
-				type: "mrkdwn",
-				text: responseText
-			}
+	const { responseText, agentName, isError, followUpParams } = params;
+	const blocks = [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: responseText
 		}
-	];
+	}];
 	if (!isError) {
 		const contextBlock = createContextBlock({
 			agentName,
@@ -66,7 +57,7 @@ function buildConversationResponseBlocks(params) {
 	return blocks;
 }
 function createUpdatedHelpMessage() {
-	return Message().blocks(Blocks.Section().text(`${Md.bold(SlackStrings.help.title)}`), Blocks.Section().text(SlackStrings.help.publicSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.privateSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.otherCommands), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.docsLink)).buildToObject();
+	return Message().blocks(Blocks.Header().text(SlackStrings.help.title), Blocks.Section().text(SlackStrings.help.publicSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.privateSection), Blocks.Divider(), Blocks.Section().text(SlackStrings.help.otherCommands), Blocks.Divider(), Blocks.Context().elements(SlackStrings.help.docsLink)).buildToObject();
 }
 function createAlreadyLinkedMessage(email, linkedAt, dashboardUrl) {
 	return Message().blocks(Blocks.Section().text(Md.bold("Already linked") + "\n\nYour Slack account is connected to Inkeep.\n\n" + Md.bold("Account:") + ` ${email}\n` + Md.bold("Linked:") + ` ${new Date(linkedAt).toLocaleDateString()}\n\nTo switch accounts, first run \`/inkeep unlink\``), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
@@ -84,9 +75,237 @@ function createStatusMessage(email, linkedAt, dashboardUrl, agentConfigs) {
 	else agentLine = `${Md.bold("Agent:")} None configured\n${Md.italic("Ask your admin to set up an agent in the dashboard.")}`;
 	return Message().blocks(Blocks.Section().text(Md.bold("Connected to Inkeep") + `\n\n${Md.bold("Account:")} ${email}\n${Md.bold("Linked:")} ${new Date(linkedAt).toLocaleDateString()}\n` + agentLine), Blocks.Actions().elements(Elements.Button().text(SlackStrings.buttons.openDashboard).url(dashboardUrl).actionId("open_dashboard"))).buildToObject();
 }
+const ToolApprovalButtonValueSchema = z.object({
+	toolCallId: z.string(),
+	conversationId: z.string(),
+	projectId: z.string(),
+	agentId: z.string(),
+	slackUserId: z.string(),
+	channel: z.string(),
+	threadTs: z.string(),
+	toolName: z.string()
+});
+function buildToolApprovalBlocks(params) {
+	const { toolName, input, buttonValue } = params;
+	const blocks = [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: `*Approval required - \`${toolName}\`*`
+		}
+	}];
+	if (input && Object.keys(input).length > 0) {
+		const fields = Object.entries(input).slice(0, 10).map(([k, v]) => {
+			const val = typeof v === "object" ? JSON.stringify(v) : String(v ?? "");
+			return {
+				type: "mrkdwn",
+				text: `*${k}:*\n${val.length > 80 ? `${val.slice(0, 80)}…` : val}`
+			};
+		});
+		blocks.push({
+			type: "section",
+			fields
+		});
+	}
+	blocks.push({
+		type: "actions",
+		elements: [{
+			type: "button",
+			text: {
+				type: "plain_text",
+				text: "Approve",
+				emoji: true
+			},
+			style: "primary",
+			action_id: "tool_approval_approve",
+			value: buttonValue
+		}, {
+			type: "button",
+			text: {
+				type: "plain_text",
+				text: "Deny",
+				emoji: true
+			},
+			style: "danger",
+			action_id: "tool_approval_deny",
+			value: buttonValue
+		}]
+	});
+	return blocks;
+}
+function buildToolApprovalDoneBlocks(params) {
+	const { toolName, approved, actorUserId } = params;
+	return [{
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: approved ? `✅ Approved \`${toolName}\` · <@${actorUserId}>` : `❌ Denied \`${toolName}\` · <@${actorUserId}>`
+		}]
+	}];
+}
+function buildToolApprovalExpiredBlocks(params) {
+	return [{
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: `⏱️ Expired · \`${params.toolName}\``
+		}]
+	}];
+}
+function buildToolOutputErrorBlock(toolName, errorText) {
+	return {
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: `⚠️ *${toolName}* · failed: ${errorText.length > 100 ? `${errorText.slice(0, 100)}…` : errorText}`
+		}]
+	};
+}
+function buildSummaryBreadcrumbBlock(labels) {
+	return {
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: labels.join(" → ")
+		}]
+	};
+}
+function isFlatRecord(obj) {
+	return Object.values(obj).every((v) => v === null || [
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof v));
+}
+function findSourcesArray(data) {
+	for (const value of Object.values(data)) if (Array.isArray(value) && value.length > 0 && typeof value[0] === "object" && value[0] !== null && ("url" in value[0] || "href" in value[0])) return value;
+	return null;
+}
+function buildDataComponentBlocks(component) {
+	const { data } = component;
+	const componentType = typeof data.type === "string" ? data.type : void 0;
+	const blocks = [{
+		type: "header",
+		text: {
+			type: "plain_text",
+			text: `📊 ${componentType || "Data Component"}`,
+			emoji: true
+		}
+	}];
+	const payload = Object.fromEntries(Object.entries(data).filter(([k]) => k !== "type"));
+	let overflowJson;
+	if (Object.keys(payload).length > 0) if (isFlatRecord(payload)) {
+		const fields = Object.entries(payload).slice(0, 10).map(([k, v]) => {
+			const val = String(v ?? "");
+			return {
+				type: "mrkdwn",
+				text: `*${k}*\n${val.length > 80 ? `${val.slice(0, 80)}…` : val}`
+			};
+		});
+		blocks.push({
+			type: "section",
+			fields
+		});
+	} else {
+		const jsonStr = JSON.stringify(payload, null, 2);
+		if (jsonStr.length > 2900) overflowJson = jsonStr;
+		else blocks.push({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: `\`\`\`json\n${jsonStr}\n\`\`\``
+			}
+		});
+	}
+	if (componentType) blocks.push({
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: `data component · type: ${componentType}`
+		}]
+	});
+	return {
+		blocks,
+		overflowJson,
+		componentType
+	};
+}
+function buildDataArtifactBlocks(artifact) {
+	const { data } = artifact;
+	const sourcesArray = findSourcesArray(data);
+	if (sourcesArray && sourcesArray.length > 0) {
+		const MAX_SOURCES = 10;
+		const lines = sourcesArray.slice(0, MAX_SOURCES).map((s) => {
+			const url = s.url || s.href;
+			const title = s.title || s.name || url;
+			return url ? `• <${url}|${title}>` : null;
+		}).filter((l) => l !== null);
+		if (lines.length > 0) {
+			const suffix = sourcesArray.length > MAX_SOURCES ? `\n_and ${sourcesArray.length - MAX_SOURCES} more_` : "";
+			return { blocks: [{
+				type: "section",
+				text: {
+					type: "mrkdwn",
+					text: `📚 *Sources*\n${lines.join("\n")}${suffix}`
+				}
+			}] };
+		}
+	}
+	const artifactType = typeof data.type === "string" ? data.type : void 0;
+	const name = typeof data.name === "string" && data.name ? data.name : artifactType || "Artifact";
+	const blocks = [{
+		type: "header",
+		text: {
+			type: "plain_text",
+			text: `📄 ${name}`,
+			emoji: true
+		}
+	}];
+	if (artifactType) blocks.push({
+		type: "context",
+		elements: [{
+			type: "mrkdwn",
+			text: `type: ${artifactType}`
+		}]
+	});
+	let overflowContent;
+	if (typeof data.description === "string" && data.description) if (data.description.length > 2900) overflowContent = data.description;
+	else blocks.push({
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: data.description
+		}
+	});
+	return {
+		blocks,
+		overflowContent,
+		artifactName: name
+	};
+}
+function buildCitationsBlock(citations) {
+	const MAX_CITATIONS = 10;
+	const lines = citations.slice(0, MAX_CITATIONS).map((c) => {
+		const url = c.url;
+		const title = c.title || url;
+		return url ? `• <${url}|${title}>` : null;
+	}).filter((l) => l !== null);
+	if (lines.length === 0) return [];
+	const suffix = citations.length > MAX_CITATIONS ? `\n_and ${citations.length - MAX_CITATIONS} more_` : "";
+	return [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: `📚 *Sources*\n${lines.join("\n")}${suffix}`
+		}
+	}];
+}
 function createJwtLinkMessage(linkUrl, expiresInMinutes) {
 	return Message().blocks(Blocks.Section().text(`${Md.bold("Link your Inkeep account")}\n\nConnect your Slack and Inkeep accounts to use Inkeep agents.`), Blocks.Actions().elements(Elements.Button().text("Link Account").url(linkUrl).actionId("link_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes.`)).buildToObject();
 }
+function createCreateInkeepAccountMessage(acceptUrl, expiresInMinutes) {
+	return Message().blocks(Blocks.Section().text(`${Md.bold("Create your Inkeep account")}\n\nYou've been invited to join Inkeep. Create an account to start using Inkeep agents in Slack.`), Blocks.Actions().elements(Elements.Button().text("Create Account").url(acceptUrl).actionId("create_account").primary()), Blocks.Context().elements(`This link expires in ${expiresInMinutes} minutes.`)).buildToObject();
+}
 
 //#endregion
-export { buildConversationResponseBlocks, buildFollowUpButton, createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };
+export { ToolApprovalButtonValueSchema, buildCitationsBlock, buildConversationResponseBlocks, buildDataArtifactBlocks, buildDataComponentBlocks, buildFollowUpButton, buildSummaryBreadcrumbBlock, buildToolApprovalBlocks, buildToolApprovalDoneBlocks, buildToolApprovalExpiredBlocks, buildToolOutputErrorBlock, createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage };

package/dist/slack/services/commands/index.d.ts

@@ -2,7 +2,7 @@ import { SlackWorkspaceConnection } from "../nango.js";
 import { SlackCommandPayload, SlackCommandResponse } from "../types.js";
 
 //#region src/slack/services/commands/index.d.ts
-declare function handleLinkCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string): Promise<SlackCommandResponse>;
+declare function handleLinkCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string, botToken?: string): Promise<SlackCommandResponse>;
 declare function handleUnlinkCommand(payload: SlackCommandPayload, tenantId: string): Promise<SlackCommandResponse>;
 declare function handleStatusCommand(payload: SlackCommandPayload, dashboardUrl: string, tenantId: string): Promise<SlackCommandResponse>;
 declare function handleHelpCommand(): Promise<SlackCommandResponse>;

package/dist/slack/services/commands/index.js

@@ -4,22 +4,116 @@ import runDbClient_default from "../../../db/runDbClient.js";
 import { findWorkspaceConnectionByTeamId } from "../nango.js";
 import { resolveEffectiveAgent } from "../agent-resolution.js";
 import { SlackStrings } from "../../i18n/strings.js";
-import { createAlreadyLinkedMessage, createContextBlock, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "../blocks/index.js";
+import { createAlreadyLinkedMessage, createContextBlock, createCreateInkeepAccountMessage, createErrorMessage, createJwtLinkMessage, createNotLinkedMessage, createStatusMessage, createUnlinkSuccessMessage, createUpdatedHelpMessage } from "../blocks/index.js";
 import { getSlackClient } from "../client.js";
 import { extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "../events/utils.js";
 import { buildAgentSelectorModal } from "../modals.js";
-import { deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, flushTraces, getInProcessFetch, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
+import { createInvitationInDb, deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingBySlackUser, findWorkAppSlackWorkspaceByTeamId, flushTraces, getInProcessFetch, getOrganizationMemberByEmail, getPendingInvitationsByEmail, getWaitUntil, signSlackLinkToken, signSlackUserToken } from "@inkeep/agents-core";
 
 //#region src/slack/services/commands/index.ts
 const DEFAULT_CLIENT_ID = "work-apps-slack";
 const LINK_CODE_TTL_MINUTES = 10;
 const logger = getLogger("slack-commands");
-async function handleLinkCommand(payload, dashboardUrl, tenantId) {
+/**
+* Create an invitation for a Slack user who doesn't have an Inkeep account yet.
+* Returns the invitation ID and email so the caller can direct the user
+* to the accept-invitation page.
+*
+* Returns null if:
+* - Workspace doesn't have shouldAllowJoinFromWorkspace enabled
+* - User already has an Inkeep account (JWT link flow is sufficient)
+* - Service account is not configured
+*/
+async function tryAutoInvite(payload, tenantId, botToken) {
+	try {
+		if (!(await findWorkAppSlackWorkspaceByTeamId(runDbClient_default)(tenantId, payload.teamId))?.shouldAllowJoinFromWorkspace) return null;
+		const slackClient = getSlackClient(botToken);
+		let userEmail;
+		try {
+			userEmail = (await slackClient.users.info({ user: payload.userId })).user?.profile?.email;
+		} catch (error) {
+			logger.warn({
+				error,
+				userId: payload.userId
+			}, "Failed to get user info from Slack");
+			return null;
+		}
+		if (!userEmail) {
+			logger.warn({ userId: payload.userId }, "No email found in Slack user profile");
+			return null;
+		}
+		if (await getOrganizationMemberByEmail(runDbClient_default)(tenantId, userEmail)) {
+			logger.debug({
+				userId: payload.userId,
+				email: userEmail
+			}, "User already has Inkeep account, skipping auto-invite");
+			return null;
+		}
+		const existingInvitation = (await getPendingInvitationsByEmail(runDbClient_default)(userEmail)).find((inv) => inv.organizationId === tenantId);
+		if (existingInvitation) {
+			logger.info({
+				userId: payload.userId,
+				tenantId,
+				invitationId: existingInvitation.id,
+				email: userEmail
+			}, "Reusing existing pending invitation for Slack user");
+			return {
+				invitationId: existingInvitation.id,
+				email: userEmail
+			};
+		}
+		const invitation = await createInvitationInDb(runDbClient_default)({
+			organizationId: tenantId,
+			email: userEmail
+		});
+		logger.info({
+			userId: payload.userId,
+			tenantId,
+			invitationId: invitation.id,
+			email: userEmail
+		}, "Invitation created for Slack user without Inkeep account");
+		return {
+			invitationId: invitation.id,
+			email: userEmail
+		};
+	} catch (error) {
+		logger.warn({
+			error,
+			userId: payload.userId,
+			tenantId
+		}, "Auto-invite attempt failed");
+		return null;
+	}
+}
+async function handleLinkCommand(payload, dashboardUrl, tenantId, botToken) {
 	const existingLink = await findWorkAppSlackUserMapping(runDbClient_default)(tenantId, payload.userId, payload.teamId, DEFAULT_CLIENT_ID);
 	if (existingLink) return {
 		response_type: "ephemeral",
 		...createAlreadyLinkedMessage(existingLink.slackEmail || existingLink.slackUsername || "Unknown", existingLink.linkedAt, dashboardUrl)
 	};
+	if (botToken) {
+		const autoInvite = await tryAutoInvite(payload, tenantId, botToken);
+		if (autoInvite) {
+			const manageUiUrl = env.INKEEP_AGENTS_MANAGE_UI_URL || "http://localhost:3000";
+			const linkToken = await signSlackLinkToken({
+				tenantId,
+				slackTeamId: payload.teamId,
+				slackUserId: payload.userId,
+				slackEnterpriseId: payload.enterpriseId,
+				slackUsername: payload.userName
+			});
+			const linkReturnUrl = `/link?token=${encodeURIComponent(linkToken)}`;
+			const acceptUrl = `${manageUiUrl}/accept-invitation/${autoInvite.invitationId}?email=${encodeURIComponent(autoInvite.email)}&returnUrl=${encodeURIComponent(linkReturnUrl)}`;
+			logger.info({
+				invitationId: autoInvite.invitationId,
+				email: autoInvite.email
+			}, "Directing new user to accept-invitation page with link returnUrl");
+			return {
+				response_type: "ephemeral",
+				...createCreateInkeepAccountMessage(acceptUrl, LINK_CODE_TTL_MINUTES)
+			};
+		}
+	}
 	try {
 		const linkToken = await signSlackLinkToken({
 			tenantId,
@@ -363,7 +457,7 @@ async function handleCommand(payload) {
 	}, "Slack command received");
 	switch (subcommand) {
 		case "link":
-		case "connect": return handleLinkCommand(payload, dashboardUrl, tenantId);
+		case "connect": return handleLinkCommand(payload, dashboardUrl, tenantId, workspaceConnection.botToken);
 		case "status": return handleStatusCommand(payload, dashboardUrl, tenantId);
 		case "unlink":
 		case "logout":

package/dist/slack/services/events/app-mention.js

@@ -196,7 +196,7 @@ async function handleAppMention(params) {
 				thinkingMessageTs = (await slackClient.chat.postMessage({
 					channel,
 					thread_ts: threadTs,
-					text: `_${agentDisplayName} is reading this thread..._`
+					text: SlackStrings.status.readingThread(agentDisplayName)
 				})).ts || void 0;
 				const conversationId$1 = generateSlackConversationId({
 					teamId,
@@ -274,7 +274,7 @@ Respond naturally as if you're joining the conversation to help.`;
 			thinkingMessageTs = (await slackClient.chat.postMessage({
 				channel,
 				thread_ts: replyThreadTs,
-				text: `_${agentDisplayName} is preparing a response..._`
+				text: SlackStrings.status.thinking(agentDisplayName)
 			})).ts || void 0;
 			const conversationId = generateSlackConversationId({
 				teamId,

package/dist/slack/services/events/block-actions.d.ts

@@ -3,6 +3,17 @@
  * Handlers for Slack block action events (button clicks, selections, etc.)
  * and message shortcuts
  */
+/**
+ * Handle tool approval/denial button clicks.
+ * Called when a user clicks "Approve" or "Deny" on a tool approval message.
+ */
+declare function handleToolApproval(params: {
+  actionValue: string;
+  approved: boolean;
+  teamId: string;
+  slackUserId: string;
+  responseUrl?: string;
+}): Promise<void>;
 /**
  * Handle opening the agent selector modal when user clicks "Select Agent" button
  */
@@ -37,4 +48,4 @@ declare function handleMessageShortcut(params: {
   responseUrl?: string;
 }): Promise<void>;
 //#endregion
-export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal };
+export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval };

package/dist/slack/services/events/block-actions.js

@@ -1,10 +1,13 @@
+import { env } from "../../../env.js";
 import { getLogger } from "../../../logger.js";
 import { findWorkspaceConnectionByTeamId } from "../nango.js";
 import { SlackStrings } from "../../i18n/strings.js";
+import { ToolApprovalButtonValueSchema, buildToolApprovalDoneBlocks } from "../blocks/index.js";
 import { getSlackClient } from "../client.js";
-import { fetchAgentsForProject, fetchProjectsForTenant, getChannelAgentConfig, sendResponseUrlMessage } from "./utils.js";
+import { fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, getChannelAgentConfig, sendResponseUrlMessage } from "./utils.js";
 import { buildAgentSelectorModal, buildFollowUpModal, buildMessageShortcutModal } from "../modals.js";
 import { SLACK_SPAN_KEYS, SLACK_SPAN_NAMES, setSpanWithError, tracer } from "../../tracer.js";
+import { getInProcessFetch, signSlackUserToken } from "@inkeep/agents-core";
 
 //#region src/slack/services/events/block-actions.ts
 /**
@@ -13,6 +16,127 @@ import { SLACK_SPAN_KEYS, SLACK_SPAN_NAMES, setSpanWithError, tracer } from "../
 */
 const logger = getLogger("slack-block-actions");
 /**
+* Handle tool approval/denial button clicks.
+* Called when a user clicks "Approve" or "Deny" on a tool approval message.
+*/
+async function handleToolApproval(params) {
+	return tracer.startActiveSpan(SLACK_SPAN_NAMES.TOOL_APPROVAL, async (span) => {
+		const { actionValue, approved, teamId, slackUserId, responseUrl } = params;
+		span.setAttribute(SLACK_SPAN_KEYS.TEAM_ID, teamId);
+		span.setAttribute(SLACK_SPAN_KEYS.USER_ID, slackUserId);
+		try {
+			const buttonValue = ToolApprovalButtonValueSchema.parse(JSON.parse(actionValue));
+			const { toolCallId, conversationId, projectId, agentId, toolName } = buttonValue;
+			span.setAttribute(SLACK_SPAN_KEYS.CONVERSATION_ID, conversationId);
+			const workspaceConnection = await findWorkspaceConnectionByTeamId(teamId);
+			if (!workspaceConnection?.botToken) {
+				logger.error({ teamId }, "No bot token for tool approval");
+				span.end();
+				return;
+			}
+			const tenantId = workspaceConnection.tenantId;
+			const slackClient = getSlackClient(workspaceConnection.botToken);
+			if (slackUserId !== buttonValue.slackUserId) {
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: "Only the user who started this conversation can approve or deny this action."
+				}).catch((e) => logger.warn({ error: e }, "Failed to send ownership error notification"));
+				span.end();
+				return;
+			}
+			const existingLink = await findCachedUserMapping(tenantId, slackUserId, teamId);
+			if (!existingLink) {
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: "You need to link your Inkeep account first. Use `/inkeep link`."
+				}).catch((e) => logger.warn({ error: e }, "Failed to send not-linked notification"));
+				span.end();
+				return;
+			}
+			const slackUserToken = await signSlackUserToken({
+				inkeepUserId: existingLink.inkeepUserId,
+				tenantId,
+				slackTeamId: teamId,
+				slackUserId
+			});
+			const apiUrl = env.INKEEP_AGENTS_API_URL || "http://localhost:3002";
+			const approvalResponse = await getInProcessFetch()(`${apiUrl}/run/api/chat`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${slackUserToken}`,
+					"x-inkeep-project-id": projectId,
+					"x-inkeep-agent-id": agentId
+				},
+				body: JSON.stringify({
+					conversationId,
+					messages: [{
+						role: "tool",
+						parts: [{
+							type: "tool-call",
+							toolCallId,
+							state: "approval-responded",
+							approval: {
+								id: toolCallId,
+								approved
+							}
+						}]
+					}]
+				})
+			});
+			if (!approvalResponse.ok) {
+				const errorBody = await approvalResponse.text().catch(() => "");
+				logger.error({
+					status: approvalResponse.status,
+					errorBody,
+					toolCallId,
+					conversationId
+				}, "Tool approval API call failed");
+				await slackClient.chat.postEphemeral({
+					channel: buttonValue.channel,
+					user: slackUserId,
+					thread_ts: buttonValue.threadTs,
+					text: `Failed to ${approved ? "approve" : "deny"} \`${toolName}\`. Please try again.`
+				}).catch((e) => logger.warn({ error: e }, "Failed to send approval error notification"));
+				span.end();
+				return;
+			}
+			if (responseUrl) await sendResponseUrlMessage(responseUrl, {
+				text: approved ? `✅ Approved \`${toolName}\`` : `❌ Denied \`${toolName}\``,
+				replace_original: true,
+				blocks: buildToolApprovalDoneBlocks({
+					toolName,
+					approved,
+					actorUserId: slackUserId
+				})
+			}).catch((e) => logger.warn({ error: e }, "Failed to update approval message"));
+			logger.info({
+				toolCallId,
+				conversationId,
+				approved,
+				slackUserId
+			}, "Tool approval processed");
+			span.end();
+		} catch (error) {
+			if (error instanceof Error) setSpanWithError(span, error);
+			logger.error({
+				error,
+				teamId,
+				slackUserId
+			}, "Failed to handle tool approval");
+			if (responseUrl) await sendResponseUrlMessage(responseUrl, {
+				text: "Something went wrong processing your request. Please try again.",
+				response_type: "ephemeral"
+			}).catch((e) => logger.warn({ error: e }, "Failed to send error notification"));
+			span.end();
+		}
+	});
+}
+/**
 * Handle opening the agent selector modal when user clicks "Select Agent" button
 */
 async function handleOpenAgentSelectorModal(params) {
@@ -262,4 +386,4 @@ async function handleMessageShortcut(params) {
 }
 
 //#endregion
-export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal };
+export { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval };

package/dist/slack/services/events/index.d.ts

@@ -1,6 +1,6 @@
 import { InlineSelectorMetadata, handleAppMention } from "./app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./modal-submission.js";
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./utils.js";
 import { StreamResult, streamAgentResponse } from "./streaming.js";
-export { type InlineSelectorMetadata, SlackErrorType, type StreamResult, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };
+export { type InlineSelectorMetadata, SlackErrorType, type StreamResult, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };

package/dist/slack/services/events/index.js

@@ -1,7 +1,7 @@
 import { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, markdownToMrkdwn, sendResponseUrlMessage } from "./utils.js";
 import { streamAgentResponse } from "./streaming.js";
 import { handleAppMention } from "./app-mention.js";
-import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal } from "./block-actions.js";
+import { handleMessageShortcut, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval } from "./block-actions.js";
 import { handleFollowUpSubmission, handleModalSubmission } from "./modal-submission.js";
 
-export { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };
+export { SlackErrorType, checkIfBotThread, classifyError, extractApiErrorMessage, fetchAgentsForProject, fetchProjectsForTenant, findCachedUserMapping, generateSlackConversationId, getChannelAgentConfig, getThreadContext, getUserFriendlyErrorMessage, getWorkspaceDefaultAgent, handleAppMention, handleFollowUpSubmission, handleMessageShortcut, handleModalSubmission, handleOpenAgentSelectorModal, handleOpenFollowUpModal, handleToolApproval, markdownToMrkdwn, sendResponseUrlMessage, streamAgentResponse };

package/dist/slack/services/events/streaming.d.ts

@@ -20,7 +20,7 @@ declare function streamAgentResponse(params: {
   agentId: string;
   question: string;
   agentName: string;
-  conversationId?: string;
+  conversationId: string;
 }): Promise<StreamResult>;
 //#endregion
 export { StreamResult, streamAgentResponse };