@joe-broadhead/opencode-slack 0.0.0-stage → 0.0.1

package/dist/index.js

@@ -0,0 +1,646 @@
+// src/index.ts
+import { Plugin } from "@opencode/plugin";
+
+// src/defaults.ts
+var DEFAULT_REDIRECT_URI = "http://localhost:8765/callback";
+var HOSTED_REDIRECT_EXAMPLE = "https://host.example/oauth/return";
+var CALLBACK_PORT_EXAMPLE = 8766;
+var DEFAULT_SCOPES = ["channels:history", "channels:read", "search:read.public", "users:read"];
+var DEFAULT_SERVER = "slack";
+var APP_MANIFEST_URL = "https://github.com/joe-broadhead/opencode-slack/blob/HEAD/docs/slack-app-manifest.json";
+var SLACK_MCP_URL = "https://mcp.slack.com/mcp";
+var TESTED_HOST_RANGE = ">=2.2.3 <2.3.0";
+
+// src/connect.ts
+var NO_SPACES = /^\S+$/;
+var appIntegrationID = (server) => `${server}-app`;
+var appDisplayName = (server) => server === DEFAULT_SERVER ? "Slack app" : `Slack app (${server})`;
+var serverDisplayName = (server) => server === DEFAULT_SERVER ? "Slack" : `Slack (${server})`;
+function registerAppIntegration(integration, server) {
+  const id = appIntegrationID(server);
+  return integration.transform((editor) => {
+    editor.update(id, (draft) => {
+      draft.name = appDisplayName(server);
+    });
+    editor.method.update({
+      integrationID: id,
+      method: {
+        type: "key",
+        label: "Slack app client ID",
+        form: [{
+          key: "client_secret",
+          type: "string",
+          title: "Client secret",
+          description: "Only for a Slack app without PKCE. Skip it for an app made from the plugin's manifest.",
+          required: false
+        }]
+      }
+    });
+  });
+}
+async function resolveClient(integration, options) {
+  if (options.clientId !== void 0) {
+    return { client: { id: options.clientId, ...options.clientSecret === void 0 ? {} : { secret: options.clientSecret }, source: "options" }, invalid: false };
+  }
+  const integrationID = appIntegrationID(options.server);
+  const connection2 = await integration.connection.active(integrationID);
+  const stored = connection2 === void 0 ? void 0 : await integration.connection.resolve(connection2);
+  if (connection2 !== void 0 && stored?.type === "key") {
+    const id = stored.key.trim();
+    const valid = NO_SPACES.test(id);
+    await integration.connection.status({
+      integrationID,
+      connection: connection2,
+      status: valid ? void 0 : { status: "needs_auth", message: "This is not a Slack client ID: it is empty or has spaces." }
+    }).catch(() => void 0);
+    if (!valid) return { invalid: true };
+    const secret = typeof stored.metadata?.client_secret === "string" ? stored.metadata.client_secret.trim() : "";
+    return { client: { id, ...secret === "" ? {} : { secret }, source: "connect" }, invalid: false };
+  }
+  return { invalid: false };
+}
+var sameClient = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function serverNamer(ctx, server, owned) {
+  let registration;
+  return {
+    /** True once the integration carries the display name. */
+    async apply() {
+      if (!owned()) return false;
+      const id = (await ctx.mcp.list()).data.find((item) => item.name === server)?.integrationID;
+      if (id === void 0) return false;
+      const name = serverDisplayName(server);
+      if ((await ctx.integration.get({ integrationID: id })).data.name === name) return true;
+      const previous = registration;
+      registration = await ctx.integration.transform((editor) => {
+        if (editor.get(id) !== void 0) editor.update(id, (draft) => void (draft.name = name));
+      });
+      await previous?.dispose();
+      return false;
+    },
+    async dispose() {
+      await registration?.dispose();
+      registration = void 0;
+    }
+  };
+}
+
+// src/host-version.ts
+var RELEASE = /^(\d+)\.(\d+)\.(\d+)$/;
+var RANGE = /^>=(\d+)\.(\d+)\.(\d+) <(\d+)\.(\d+)\.(\d+)$/;
+var compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+function isTestedHost(version) {
+  const found = RELEASE.exec(version);
+  if (!found) return false;
+  const bounds = RANGE.exec(TESTED_HOST_RANGE).slice(1).map(Number);
+  const host = found.slice(1).map(Number);
+  return compare(host, bounds.slice(0, 3)) >= 0 && compare(host, bounds.slice(3)) < 0;
+}
+
+// src/options.ts
+var TOP_KEYS = ["oauth", "server", "allowUntestedHost"];
+var OAUTH_KEYS = ["client_id", "redirect_uri", "callback_port", "scopes", "client_secret"];
+var SERVER_NAME = /^[A-Za-z0-9_-]+$/;
+var NO_SPACES2 = /^\S+$/;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var fail = (field, message, next) => ({ ok: false, error: { code: "OPTIONS_INVALID", field, message, next } });
+function redirectProblem(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return "Must be a valid URL.";
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return "Must use http: or https:.";
+  if (url.protocol === "http:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+    return "An http: URL must use the host localhost or 127.0.0.1.";
+  }
+  if (url.protocol === "http:" && url.port === "") return "An http: URL must include an explicit port.";
+  if (url.username !== "" || url.password !== "") return "Must not include credentials.";
+  if (value.includes("?") || value.includes("#")) return "Must not include a query or fragment.";
+  if (url.pathname === "/") return "Must include a path, such as /callback.";
+  return void 0;
+}
+var isPort = (value) => typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
+function parseOptions(input) {
+  const raw = input ?? {};
+  if (!isRecord(raw)) return fail("options", "Plugin options must be an object.", "Set options to an object, or remove them.");
+  const unknownKey = Object.keys(raw).find((key) => !TOP_KEYS.includes(key));
+  if (unknownKey !== void 0) {
+    return fail(unknownKey, "This option is not supported.", `Remove it. Supported options: ${TOP_KEYS.join(", ")}.`);
+  }
+  const oauth = raw.oauth ?? {};
+  if (!isRecord(oauth)) return fail("oauth", "Must be an object.", 'Set oauth to an object such as { "client_id": "..." }.');
+  const unknownOAuthKey = Object.keys(oauth).find((key) => !OAUTH_KEYS.includes(key));
+  if (unknownOAuthKey !== void 0) {
+    return fail(`oauth.${unknownOAuthKey}`, "This option is not supported.", unknownOAuthKey === "redirect_port" ? `Use oauth.redirect_uri instead, for example ${DEFAULT_REDIRECT_URI}.` : `Remove it. Supported oauth options: ${OAUTH_KEYS.join(", ")}.`);
+  }
+  const clientId = oauth.client_id;
+  if (clientId !== void 0 && (typeof clientId !== "string" || !NO_SPACES2.test(clientId))) {
+    return fail("oauth.client_id", "Must be a non-empty string without spaces.", "Copy the client ID from the Basic Information page of your Slack app.");
+  }
+  const redirectUri = oauth.redirect_uri ?? DEFAULT_REDIRECT_URI;
+  const redirectError = typeof redirectUri === "string" ? redirectProblem(redirectUri) : "Must be a string.";
+  if (typeof redirectUri !== "string" || redirectError !== void 0) {
+    return fail("oauth.redirect_uri", redirectError ?? "Must be a string.", `Use a URL listed in the app's Redirect URLs, for example ${DEFAULT_REDIRECT_URI} or ${HOSTED_REDIRECT_EXAMPLE}.`);
+  }
+  const hosted = new URL(redirectUri).protocol === "https:";
+  const callbackPort = oauth.callback_port;
+  if (callbackPort !== void 0 && !isPort(callbackPort)) {
+    return fail("oauth.callback_port", "Must be a whole number from 1 to 65535.", `Set it to the local port that receives the forwarded callback, for example ${CALLBACK_PORT_EXAMPLE}.`);
+  }
+  if (callbackPort !== void 0 && !hosted) {
+    return fail("oauth.callback_port", "Applies only to an https: oauth.redirect_uri.", "Remove it: with a loopback oauth.redirect_uri, OpenCode listens on that URL's port.");
+  }
+  if (callbackPort === void 0 && hosted) {
+    return fail("oauth.callback_port", "Must be set with an https: oauth.redirect_uri.", `Set it to the local port your proxy forwards the redirect to, for example ${CALLBACK_PORT_EXAMPLE}.`);
+  }
+  const scopes = oauth.scopes ?? DEFAULT_SCOPES;
+  const isScope = (scope) => typeof scope === "string" && NO_SPACES2.test(scope);
+  if (!Array.isArray(scopes) || scopes.length === 0 || !scopes.every(isScope)) {
+    return fail("oauth.scopes", "Must be a non-empty list of scope names without spaces.", `List Slack user scopes, for example ${JSON.stringify(DEFAULT_SCOPES)}.`);
+  }
+  if (new Set(scopes).size !== scopes.length) return fail("oauth.scopes", "Lists a scope more than once.", "Remove the duplicate scope.");
+  const clientSecret = oauth.client_secret;
+  if (clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret === "")) {
+    return fail("oauth.client_secret", "Must be a non-empty string.", "Set it to {env:SLACK_CLIENT_SECRET} and export that variable, or remove it to use PKCE.");
+  }
+  if (clientSecret !== void 0 && clientId === void 0) {
+    return fail("oauth.client_secret", "Needs oauth.client_id.", "Set oauth.client_id to your Slack app's client ID, or remove oauth.client_secret.");
+  }
+  const server = raw.server ?? DEFAULT_SERVER;
+  if (typeof server !== "string" || !SERVER_NAME.test(server)) {
+    return fail("server", "Must contain only letters, digits, _ and -.", `Use a name such as "${DEFAULT_SERVER}".`);
+  }
+  const allowUntestedHost = raw.allowUntestedHost ?? false;
+  if (typeof allowUntestedHost !== "boolean") {
+    return fail("allowUntestedHost", "Must be true or false.", "Set it to true only to run on an OpenCode version this plugin is not tested with.");
+  }
+  return {
+    ok: true,
+    options: {
+      ...clientId === void 0 ? {} : { clientId },
+      redirectUri,
+      ...callbackPort === void 0 ? {} : { callbackPort },
+      scopes: [...scopes],
+      ...clientSecret === void 0 ? {} : { clientSecret },
+      server,
+      allowUntestedHost
+    }
+  };
+}
+
+// src/tools.ts
+var KNOWN = {
+  slack_search_public: "read",
+  slack_search_channels: "read",
+  slack_search_users: "read",
+  slack_read_channel: "read",
+  slack_read_thread: "read",
+  slack_read_user_profile: "read",
+  slack_read_canvas: "read",
+  slack_list_channel_members: "read",
+  slack_get_reactions: "read",
+  slack_list_user_channels: "read",
+  slack_read_list: "read",
+  slack_search_emojis: "read",
+  slack_search_public_and_private: "private",
+  slack_read_file: "file",
+  slack_send_message: "write",
+  slack_send_message_draft: "write",
+  slack_schedule_message: "write",
+  slack_create_canvas: "write",
+  slack_update_canvas: "write",
+  slack_add_reaction: "write",
+  slack_get_file_upload_url: "write",
+  slack_complete_file_upload: "write",
+  slack_create_conversation: "write",
+  slack_create_list: "write",
+  slack_update_list: "write",
+  slack_add_list_record: "write",
+  slack_update_list_record: "write"
+};
+var READ_TOOLS = Object.keys(KNOWN).filter((tool) => KNOWN[tool] === "read");
+function classify(tool) {
+  return Object.hasOwn(KNOWN, tool) ? KNOWN[tool] : "unknown";
+}
+
+// src/permissions.ts
+function defaultRules(server) {
+  return [
+    { action: `${server}_*`, resource: "*", effect: "ask" },
+    ...READ_TOOLS.map((tool) => ({ action: `${server}_${tool}`, resource: "*", effect: "allow" }))
+  ];
+}
+var same = (a, b) => a.action === b.action && a.resource === b.resource && a.effect === b.effect;
+var BASE_ALLOW = { action: "*", resource: "*", effect: "allow" };
+function insertDefaultRules(editor, server) {
+  const block = defaultRules(server);
+  for (const agent of editor.list()) {
+    const at = agent.permissions.findIndex((rule) => same(rule, BASE_ALLOW));
+    if (at === -1) continue;
+    const present = agent.permissions.some((_rule, start) => start > at && block.every((rule, offset) => {
+      const existing = agent.permissions[start + offset];
+      return existing !== void 0 && same(existing, rule);
+    }));
+    if (present) continue;
+    editor.update(agent.id, (draft) => {
+      draft.permissions.splice(at + 1, 0, ...block);
+    });
+  }
+}
+
+// src/rpc.ts
+import { Rpc } from "@opencode/plugin/rpc";
+var text = { type: "string" };
+var texts = { type: "array", items: text };
+var object = (properties, required) => ({ type: "object", properties, required, additionalProperties: false });
+var status = object({
+  state: { enum: ["connected", "not_signed_in", "connecting", "disabled", "failed", "not_registered", "no_client_id", "config_invalid", "host_untested"] },
+  code: {
+    enum: ["OPTIONS_INVALID", "SERVER_NAME_IN_USE", "HOST_UNTESTED", "CLIENT_ID_MISSING", "CLIENT_ID_INVALID", "AUTH_REQUIRED", "CONNECTION_FAILED", "SERVER_DISABLED"]
+  },
+  message: text,
+  detail: text,
+  next: text,
+  server: object({ name: text, url: text }, ["name", "url"]),
+  client: object({ id: text, mode: { enum: ["public_pkce", "confidential"] }, source: { enum: ["options", "connect"] } }, ["id", "mode", "source"]),
+  callback: text,
+  callbackPort: { type: "integer" },
+  scopes: texts,
+  asksBefore: texts,
+  tools: object({
+    read: { type: "integer" },
+    private: { type: "integer" },
+    file: { type: "integer" },
+    write: { type: "integer" },
+    unknown: texts
+  }, ["read", "private", "file", "write", "unknown"]),
+  unguardedAgents: texts,
+  host: object({ version: text, range: text, tested: { type: "boolean" } }, ["version", "range", "tested"])
+}, ["state", "message", "next", "server", "asksBefore", "tools", "unguardedAgents", "host"]);
+var SlackRpc = Rpc.define({
+  id: "slack.workspace",
+  methods: {
+    status: {
+      input: object({}, []),
+      output: status,
+      errors: { unavailable: {} }
+    }
+  },
+  events: {}
+});
+
+// src/server.ts
+function serverConfig(options, client) {
+  return {
+    type: "remote",
+    url: SLACK_MCP_URL,
+    oauth: {
+      client_id: client.id,
+      redirect_uri: options.redirectUri,
+      ...options.callbackPort === void 0 ? {} : { callback_port: options.callbackPort },
+      scope: options.scopes.join(" "),
+      ...client.secret === void 0 ? {} : { client_secret: client.secret }
+    }
+  };
+}
+function registerServer(editor, options, client) {
+  if (editor.get(options.server) !== void 0) return false;
+  if (client !== void 0) editor.set(options.server, serverConfig(options, client));
+  return true;
+}
+
+// src/skills.ts
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { Skill } from "@opencode/plugin";
+var SKILLS = ["slack-search"];
+var FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/;
+function parseSkill(id, path, text2) {
+  const match = FRONTMATTER.exec(text2);
+  if (match === null) return void 0;
+  const fields = /* @__PURE__ */ new Map();
+  for (const line of match[1].split(/\r?\n/)) {
+    const field = /^([a-z]+):\s*(.*?)\s*$/.exec(line);
+    if (field) fields.set(field[1], field[2].replace(/^(["'])(.*)\1$/, "$2"));
+  }
+  const description = fields.get("description");
+  if (fields.get("name") !== id || !description) return void 0;
+  return {
+    id: Skill.ID.make(id),
+    name: Skill.Name.make(id),
+    description,
+    path: Skill.Info.fields.path.make(path),
+    content: match[2].trim()
+  };
+}
+async function loadSkills(root = new URL("../skills/", import.meta.url)) {
+  const skills = [];
+  for (const id of SKILLS) {
+    const path = fileURLToPath(new URL(`${id}/SKILL.md`, root));
+    const text2 = await readFile(path, "utf8").catch(() => {
+      throw new Error(`SKILLS_INVALID: Bundled skill ${id} is missing. Next step: Reinstall the plugin.`);
+    });
+    const skill = parseSkill(id, path, text2);
+    if (skill === void 0) throw new Error(`SKILLS_INVALID: Bundled skill ${id} has invalid frontmatter. Next step: Reinstall the plugin.`);
+    skills.push(skill);
+  }
+  return skills;
+}
+
+// src/status.ts
+var UNAVAILABLE = "STATUS_UNAVAILABLE: Slack status is unavailable. Next step: Run /slack-status again in a moment.";
+var ASKS_BEFORE = [
+  "searching private channels",
+  "reading files",
+  "writes: messages, drafts, schedules, reactions, canvases, lists, new conversations and file uploads",
+  "Slack tools this plugin does not know yet"
+];
+function matches(value, pattern) {
+  const source = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${source}$`, "s").test(value);
+}
+function effect(rules, action) {
+  return rules.findLast((rule) => matches(action, rule.action) && matches("*", rule.resource))?.effect ?? "ask";
+}
+var unknownAction = (server) => `${server}_.`;
+var NOTHING_TO_DO = "Nothing to do.";
+var quote = (rule) => `{ "action": "${rule.action}", "resource": "${rule.resource}", "effect": "${rule.effect}" }`;
+var remedy = (server) => `[${defaultRules(server).map(quote).join(", ")}]`;
+function connection(server, status2, unguarded, toolCount) {
+  if (status2 === void 0) {
+    return { state: "not_registered", message: `The ${server} server is not registered.`, next: "Run opencode reload, then check again." };
+  }
+  switch (status2.status) {
+    case "pending":
+      return { state: "connecting", message: "Connecting to Slack.", next: "Wait a few seconds, then refresh." };
+    case "disabled":
+      return { state: "disabled", code: "SERVER_DISABLED", message: `The ${server} server is disabled.`, next: `Enable ${server} in /mcps.` };
+    case "needs_auth":
+      return {
+        state: "not_signed_in",
+        code: "AUTH_REQUIRED",
+        message: "Sign in to Slack to use it in OpenCode.",
+        detail: status2.error,
+        next: `Run /connect and choose ${serverDisplayName(server)}, then press o or Enter to open the sign-in page (in a terminal, opencode mcp auth ${server} opens the browser automatically).`
+      };
+    case "failed":
+      return {
+        state: "failed",
+        code: "CONNECTION_FAILED",
+        message: "Could not connect to Slack.",
+        detail: status2.error,
+        next: `Fix the error shown, then reconnect ${server} in /mcps.`
+      };
+    case "connected":
+      return {
+        state: "connected",
+        message: `Connected. Slack tools available: ${toolCount}.`,
+        next: unguarded.length > 0 ? `Put the default Slack rules shown under "Agents without default rules" first in each of these agents' own permissions (agents.<name>.permissions), so they ask before Slack writes: ${unguarded.join(", ")}.` : NOTHING_TO_DO
+      };
+  }
+}
+function buildStatus(input) {
+  const options = input.parsed.ok ? input.parsed.options : void 0;
+  const server = options?.server ?? DEFAULT_SERVER;
+  const host = { version: input.hostVersion, range: TESTED_HOST_RANGE, tested: input.hostTested };
+  const names = input.tools.filter((tool) => tool.options?.namespace === server).map((tool) => tool.name);
+  const tools = {
+    read: names.filter((name) => classify(name) === "read").length,
+    private: names.filter((name) => classify(name) === "private").length,
+    file: names.filter((name) => classify(name) === "file").length,
+    write: names.filter((name) => classify(name) === "write").length,
+    unknown: names.filter((name) => classify(name) === "unknown").sort()
+  };
+  const unguardedAgents = input.active ? input.agents.filter((agent) => effect(agent.permissions, unknownAction(server)) === "allow").map((agent) => agent.id) : [];
+  const client = input.client.client;
+  const base = {
+    server: { name: server, url: SLACK_MCP_URL },
+    ...options === void 0 || !input.active ? {} : {
+      ...client === void 0 ? {} : {
+        client: { id: client.id, mode: client.secret === void 0 ? "public_pkce" : "confidential", source: client.source }
+      },
+      callback: options.redirectUri,
+      ...options.callbackPort === void 0 ? {} : { callbackPort: options.callbackPort },
+      scopes: options.scopes
+    },
+    asksBefore: ASKS_BEFORE,
+    tools,
+    unguardedAgents,
+    host
+  };
+  if (!input.parsed.ok) {
+    const { error } = input.parsed;
+    return { ...base, state: "config_invalid", code: error.code, message: `Option ${error.field}: ${error.message}`, next: error.next };
+  }
+  if (!input.active && !input.hostTested) {
+    return {
+      ...base,
+      state: "host_untested",
+      code: "HOST_UNTESTED",
+      message: `OpenCode ${input.hostVersion} is outside the tested range ${TESTED_HOST_RANGE}, so Slack is not set up.`,
+      next: `Use OpenCode ${TESTED_HOST_RANGE}, or set "allowUntestedHost": true in this plugin's options to run anyway.`
+    };
+  }
+  if (input.nameInUse) {
+    return {
+      ...base,
+      state: "not_registered",
+      code: "SERVER_NAME_IN_USE",
+      message: `Another MCP server is already named "${server}", so Slack was not added.`,
+      next: `Remove mcp.servers.${server} from your OpenCode config, or set this plugin's "server" option to another name.`
+    };
+  }
+  if (client === void 0) {
+    const app = appDisplayName(server);
+    return {
+      ...base,
+      state: "no_client_id",
+      ...input.client.invalid ? { code: "CLIENT_ID_INVALID", message: `The client ID saved in the /connect ${app} entry is empty or has spaces, so Slack is not added.` } : { code: "CLIENT_ID_MISSING", message: `No Slack app client ID is set, so Slack is not added. To create the app, use the manifest at ${APP_MANIFEST_URL}.` },
+      next: `Run /connect and choose ${app}, then paste your Slack app's client ID.`
+    };
+  }
+  const status2 = input.servers.find((item) => item.name === server)?.status;
+  return { ...base, ...connection(server, status2, unguardedAgents, names.length) };
+}
+function callbackRow(callback, port) {
+  const register = "register exactly this URL in the app's Redirect URLs";
+  if (port === void 0) return `${callback} (${register})`;
+  return `${callback} (${register}, and forward it to http://127.0.0.1:${port}${new URL(callback).pathname}, where OpenCode listens)`;
+}
+var CLIENT_SOURCE = { options: "set in plugin options", connect: "saved in /connect" };
+function stateLabel(status2) {
+  switch (status2.state) {
+    case "not_signed_in":
+      return "sign-in required";
+    case "not_registered":
+      return status2.code === "SERVER_NAME_IN_USE" ? "conflict" : "failed";
+    case "no_client_id":
+    case "config_invalid":
+      return "not configured";
+    case "host_untested":
+      return "host untested";
+    default:
+      return status2.state;
+  }
+}
+function statusRows(status2) {
+  const { tools } = status2;
+  const rows = [
+    {
+      label: "Connection",
+      value: `${stateLabel(status2)}. ${status2.code === void 0 ? "" : `${status2.code}: `}${status2.message}${status2.detail === void 0 ? "" : ` ${status2.detail}`}`
+    },
+    { label: "Account", value: "Slack shows the account on its sign-in page; OpenCode does not store it." },
+    {
+      label: "Access",
+      value: `Reads run without asking. Asks before ${status2.asksBefore.join("; ")}. To allow one, choose "Always allow" when asked, or add a permissions rule such as ${quote({ action: `${status2.server.name}_slack_read_file`, resource: "*", effect: "allow" })}.`
+    },
+    { label: "Server", value: `${status2.server.name} at ${status2.server.url}` }
+  ];
+  if (status2.client !== void 0) {
+    const mode = status2.client.mode === "public_pkce" ? "public, PKCE" : "confidential, secret set";
+    rows.push({ label: "Client", value: `${status2.client.id} (${mode}; ${CLIENT_SOURCE[status2.client.source]})` });
+  }
+  if (status2.callback !== void 0) rows.push({ label: "Callback", value: callbackRow(status2.callback, status2.callbackPort) });
+  if (status2.scopes !== void 0) rows.push({ label: "Scopes", value: status2.scopes.join(" ") });
+  rows.push({
+    label: "Tools",
+    value: `${tools.read} read, ${tools.private} private search, ${tools.file} file, ${tools.write} write` + (tools.unknown.length > 0 ? `; unknown (ask first): ${tools.unknown.join(", ")}` : "")
+  });
+  if (status2.unguardedAgents.length > 0) {
+    rows.push({
+      label: "Agents without default rules",
+      value: `These agents run Slack writes and unknown tools without asking: ${status2.unguardedAgents.join(", ")}. In your OpenCode config, put these rules first in each agent's own "permissions" list (agents.<name>.permissions): ${remedy(status2.server.name)}. Follow them with your top-level rules for ${status2.server.name}_ actions, so yours keep winning. Do not add them to the top-level "permissions": there they would loosen stricter agents such as explore.`
+    });
+  }
+  rows.push(
+    { label: "OpenCode", value: `${status2.host.version} (${status2.host.tested ? "tested" : "untested"}; tested range ${status2.host.range})` },
+    { label: "Next step", value: status2.next }
+  );
+  return rows;
+}
+function formatStatus(status2) {
+  return ["Slack", ...statusRows(status2).map((row) => `${row.label}: ${row.value}`)].join("\n");
+}
+
+// src/index.ts
+var STARTUP_POLL_MS = 250;
+var STARTUP_WINDOW_MS = 1e4;
+var RESUBSCRIBE_MS = 1e3;
+var delay = (ms, signal) => new Promise((resolve) => {
+  if (signal.aborted) return resolve();
+  const timer = setTimeout(resolve, ms);
+  signal.addEventListener("abort", () => {
+    clearTimeout(timer);
+    resolve();
+  }, { once: true });
+});
+async function forEach(events, signal, handle) {
+  const iterator = events[Symbol.asyncIterator]();
+  const aborted = new Promise((resolve) => signal.addEventListener("abort", () => resolve(void 0), { once: true }));
+  try {
+    while (!signal.aborted) {
+      const result = await Promise.race([iterator.next(), aborted]);
+      if (result === void 0 || result.done === true) return;
+      handle(result.value);
+    }
+  } finally {
+    void iterator.return?.()?.catch(() => void 0);
+  }
+}
+var src_default = Plugin.define({
+  id: "slack.workspace",
+  async setup(ctx) {
+    const hostVersion = ctx.app.version;
+    const hostTested = isTestedHost(hostVersion);
+    const parsed = parseOptions(ctx.options);
+    const options = parsed.ok && (hostTested || parsed.options.allowUntestedHost) ? parsed.options : void 0;
+    const stopped = new AbortController();
+    let nameInUse = false;
+    let client = { invalid: false };
+    let cleanup = async () => {
+    };
+    if (options !== void 0) {
+      const fromConnect = options.clientId === void 0;
+      if (fromConnect) await registerAppIntegration(ctx.integration, options.server);
+      client = await resolveClient(ctx.integration, options).catch(() => client);
+      await ctx.mcp.transform((editor) => {
+        nameInUse = !registerServer(editor, options, client.client);
+      });
+      await ctx.agent.transform((editor) => insertDefaultRules(editor, options.server));
+      const skills = await loadSkills();
+      await ctx.skill.transform((editor) => {
+        for (const skill of skills) editor.add(skill);
+      });
+      const namer = serverNamer(ctx, options.server, () => !nameInUse && client.client !== void 0);
+      const updateClient = async () => {
+        const next = await resolveClient(ctx.integration, options);
+        if (sameClient(next, client)) return;
+        client = next;
+        await ctx.mcp.reload();
+      };
+      let queue = Promise.resolve();
+      const handle = (work) => {
+        queue = queue.then(() => stopped.signal.aborted ? void 0 : work()).then(() => void 0, () => void 0);
+      };
+      const listen = (async () => {
+        while (!stopped.signal.aborted) {
+          const events = ctx.event.subscribe({ types: ["integration.updated", "credential.updated", "credential.switched"], signal: stopped.signal });
+          await forEach(events, stopped.signal, (event) => {
+            if (event.type === "integration.updated") handle(() => namer.apply());
+            else if (fromConnect) handle(updateClient);
+          }).catch(() => void 0);
+          await delay(RESUBSCRIBE_MS, stopped.signal);
+        }
+      })();
+      const startup = (async () => {
+        for (const until = Date.now() + STARTUP_WINDOW_MS; !stopped.signal.aborted && Date.now() < until; ) {
+          if (await namer.apply().catch(() => false)) break;
+          await delay(STARTUP_POLL_MS, stopped.signal);
+        }
+      })();
+      cleanup = async () => {
+        await Promise.all([listen, startup, queue]);
+        await namer.dispose();
+      };
+    }
+    const status2 = async () => buildStatus({
+      hostVersion,
+      hostTested,
+      parsed,
+      active: options !== void 0,
+      nameInUse,
+      client,
+      servers: (await ctx.mcp.list()).data,
+      tools: await ctx.tool.list(),
+      agents: (await ctx.agent.list()).data
+    });
+    await ctx.rpc.register(SlackRpc, {
+      status: async (_input, call) => {
+        try {
+          return await status2();
+        } catch {
+          return call.error("unavailable", UNAVAILABLE, void 0);
+        }
+      }
+    });
+    await ctx.command.transform((editor) => {
+      editor.add({
+        name: "slack-status",
+        description: "Show Slack sign-in, connection and permission status",
+        execute: async ({ sessionID, delivery }) => {
+          const text2 = await status2().then(formatStatus, () => UNAVAILABLE);
+          await ctx.session.synthetic({ sessionID, delivery, text: text2, description: "Slack status", resume: false });
+        }
+      });
+    });
+    return async () => {
+      stopped.abort();
+      await cleanup();
+    };
+  }
+});
+export {
+  src_default as default
+};