@inkeep/agents-work-apps 0.58.18 → 0.58.20

package/dist/env.js

@@ -44,11 +44,18 @@ const envSchema = z.object({
 	INKEEP_AGENTS_JWT_SIGNING_SECRET: z.string().optional().describe("JWT signing secret shared with agents-api. Required in production (min 32 chars). Used for Slack user tokens and link tokens."),
 	INKEEP_AGENTS_API_URL: z.string().optional().describe("Inkeep Agents API URL")
 });
+const logEnvIssues = (scope, error) => {
+	for (const issue of error.issues) {
+		const key = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+		console.error(`[${scope}] ${key}: ${issue.message}`);
+	}
+};
 const parseEnv = () => {
 	try {
 		return envSchema.parse(process.env);
 	} catch (error) {
 		if (error instanceof z.ZodError) {
+			logEnvIssues("agents-work-apps env", error);
 			const missingVars = error.issues.map((issue) => issue.path.join("."));
 			throw new Error(`❌ Invalid environment variables: ${missingVars.join(", ")}\n${error.message}`);
 		}

package/dist/github/installation.d.ts

@@ -45,7 +45,7 @@ interface GitHubRepository {
 type GenerateInstallationAccessTokenResult = GenerateTokenResult | GenerateTokenError;
 declare function createAppJwt(): Promise<string>;
 declare function lookupInstallationForRepo(repositoryOwner: string, repositoryName: string): Promise<LookupInstallationForRepoResult>;
-declare function generateInstallationAccessToken(installationId: number): Promise<GenerateInstallationAccessTokenResult>;
+declare function generateInstallationAccessToken(installationId: number, repositoryId: number): Promise<GenerateInstallationAccessTokenResult>;
 declare function fetchInstallationDetails(installationId: string, appJwt: string): Promise<{
   success: true;
   installation: GitHubInstallationResponse;

package/dist/github/installation.js

@@ -100,7 +100,7 @@ async function lookupInstallationForRepo(repositoryOwner, repositoryName) {
 		};
 	}
 }
-async function generateInstallationAccessToken(installationId) {
+async function generateInstallationAccessToken(installationId, repositoryId) {
 	let appJwt;
 	try {
 		appJwt = await createAppJwt();
@@ -120,9 +120,11 @@ async function generateInstallationAccessToken(installationId) {
 			headers: {
 				Authorization: `Bearer ${appJwt}`,
 				Accept: "application/vnd.github+json",
+				"Content-Type": "application/json",
 				"X-GitHub-Api-Version": "2022-11-28",
 				"User-Agent": "inkeep-agents-api"
-			}
+			},
+			body: JSON.stringify({ repository_ids: [repositoryId] })
 		});
 		if (!response.ok) {
 			const errorText = await response.text();
@@ -159,7 +161,8 @@ async function generateInstallationAccessToken(installationId) {
 		const message = error instanceof Error ? error.message : "Unknown error";
 		logger.error({
 			error: message,
-			installationId
+			installationId,
+			repositoryId
 		}, "Error calling GitHub API to generate installation access token");
 		return {
 			success: false,

package/dist/github/routes/setup.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import * as hono_types6 from "hono/types";
+import * as hono_types5 from "hono/types";
 
 //#region src/github/routes/setup.d.ts
-declare const app: Hono<hono_types6.BlankEnv, hono_types6.BlankSchema, "/">;
+declare const app: Hono<hono_types5.BlankEnv, hono_types5.BlankSchema, "/">;
 //#endregion
 export { app as default };

package/dist/github/routes/tokenExchange.js

@@ -195,7 +195,22 @@ app.post("/", async (c) => {
 			reason: accessCheck.reason
 		}, "Project has access to repository");
 	}
-	const tokenResult = await generateInstallationAccessToken(installation.installationId);
+	const repositoryId = Number.parseInt(claims.repository_id, 10);
+	if (!Number.isSafeInteger(repositoryId) || repositoryId <= 0) {
+		const errorMessage = "OIDC token contains an invalid repository_id claim";
+		logger.warn({
+			repository: claims.repository,
+			repositoryId: claims.repository_id
+		}, errorMessage);
+		c.header("Content-Type", "application/problem+json");
+		return c.json({
+			title: "Bad Request",
+			status: 400,
+			detail: errorMessage,
+			error: errorMessage
+		}, 400);
+	}
+	const tokenResult = await generateInstallationAccessToken(installation.installationId, repositoryId);
 	if (!tokenResult.success) {
 		const { errorType, message } = tokenResult;
 		logger.error({

package/dist/github/routes/webhooks.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import * as hono_types8 from "hono/types";
+import * as hono_types7 from "hono/types";
 
 //#region src/github/routes/webhooks.d.ts
 interface WebhookVerificationResult {
@@ -7,6 +7,6 @@ interface WebhookVerificationResult {
   error?: string;
 }
 declare function verifyWebhookSignature(payload: string, signature: string | undefined, secret: string): WebhookVerificationResult;
-declare const app: Hono<hono_types8.BlankEnv, hono_types8.BlankSchema, "/">;
+declare const app: Hono<hono_types7.BlankEnv, hono_types7.BlankSchema, "/">;
 //#endregion
 export { WebhookVerificationResult, app as default, verifyWebhookSignature };

package/dist/slack/mcp/index.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import * as hono_types5 from "hono/types";
+import * as hono_types9 from "hono/types";
 
 //#region src/slack/mcp/index.d.ts
 interface ChannelInfo {
@@ -18,6 +18,6 @@ declare const app: Hono<{
     tenantId: string;
     projectId: string;
   };
-}, hono_types5.BlankSchema, "/">;
+}, hono_types9.BlankSchema, "/">;
 //#endregion
 export { ChannelInfo, app as default, pruneStaleChannelIds };

package/dist/slack/services/events/utils.d.ts

@@ -9,12 +9,12 @@ import { AgentOption } from "../modals.js";
  * Called on every @mention and /inkeep command — caching avoids redundant DB queries.
  */
 declare function findCachedUserMapping(tenantId: string, slackUserId: string, teamId: string, clientId?: string): Promise<{
+  id: string;
   createdAt: string;
   updatedAt: string;
-  id: string;
+  slackUserId: string;
   tenantId: string;
   clientId: string;
-  slackUserId: string;
   slackTeamId: string;
   slackEnterpriseId: string | null;
   inkeepUserId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-work-apps",
-  "version": "0.58.18",
+  "version": "0.58.20",
   "description": "First party integrations for Inkeep Agents",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -33,7 +33,7 @@
     "jose": "^6.1.0",
     "minimatch": "^10.2.1",
     "slack-block-builder": "^2.8.0",
-    "@inkeep/agents-core": "0.58.18"
+    "@inkeep/agents-core": "0.58.20"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",