@meetopenbot/slack 0.0.1 → 0.0.2

package/README.md

@@ -24,11 +24,13 @@ plugins:
       signingSecret: your-signing-secret
       botToken: xoxb-your-bot-token
       teamId: T01234567
-      openaiApiKey: sk-...
-      model: gpt-4o-mini
+      authMode: credits
+      model: openai/gpt-4o-mini
       channelMappings: "C01234567:engineering,C89ABCDEF:support"
 ```
 
+On cloud, `authMode: credits` uses your workspace credit balance. For BYOK (bring your own key), set `authMode: byok` and add `OPENAI_API_KEY` under workspace settings — no API key field in plugin config.
+
 ### Channel routing (webhook ingress)
 
 When a Slack message arrives via the Events API webhook, the plugin delegates to the OpenBot **system** agent in a target channel. Set `channelMappings` as comma-separated `slackChannelId:openbotChannelId` pairs:

package/dist/cloud-mode.js

@@ -0,0 +1,10 @@
+/** True when this runtime is a platform-managed cloud deployment. */
+export const isCloudMode = () => process.env.OPENBOT_CLOUD_MODE === "1";
+/** Default auth mode: Credits on cloud, BYOK locally. */
+export const defaultAuthMode = () => isCloudMode() ? "credits" : "byok";
+export function resolveAuthMode(config) {
+    if (config.authMode === "byok" || config.authMode === "credits") {
+        return config.authMode;
+    }
+    return defaultAuthMode();
+}

package/dist/config.js

@@ -1,3 +1,5 @@
+import { resolveAuthMode } from "./cloud-mode.js";
+import { shouldUseCreditsAuth } from "./credits-auth.js";
 export const DEFAULT_OPENBOT_CHANNEL_ID = "uncategorized";
 /** Parse `C0123:engineering,C0456:support` into a lookup index. */
 export function buildSlackChannelMappingIndex(config) {
@@ -30,13 +32,58 @@ export function resolveOpenBotChannelId(slackChannelId, config) {
     const mapped = buildSlackChannelMappingIndex(config).get(normalized);
     return mapped ?? DEFAULT_OPENBOT_CHANNEL_ID;
 }
-function varValue(variables, key) {
-    const variable = variables[key];
-    return typeof variable === "string" ? variable : variable?.value;
+function variableValue(variables, key) {
+    const entry = variables[key];
+    if (typeof entry === "string")
+        return entry || undefined;
+    return entry?.value || undefined;
+}
+export function readSlackConfig(config) {
+    return {
+        signingSecret: typeof config.signingSecret === "string" && config.signingSecret.trim()
+            ? config.signingSecret.trim()
+            : undefined,
+        botToken: typeof config.botToken === "string" && config.botToken.trim()
+            ? config.botToken.trim()
+            : undefined,
+        teamId: typeof config.teamId === "string" && config.teamId.trim()
+            ? config.teamId.trim()
+            : undefined,
+        channelMappings: typeof config.channelMappings === "string" &&
+            config.channelMappings.trim()
+            ? config.channelMappings.trim()
+            : undefined,
+        authMode: resolveAuthMode(config),
+        model: typeof config.model === "string" && config.model.trim()
+            ? config.model.trim()
+            : undefined,
+    };
+}
+export function formatMissingCredentials(missing, authMode) {
+    const lines = [
+        "Slack agent setup is incomplete. Configure the following in plugin config, workspace settings, or environment variables:",
+    ];
+    if (missing.includes("botToken")) {
+        lines.push("- `botToken` / `SLACK_BOT_TOKEN` — Slack bot OAuth token (`xoxb-…`)");
+    }
+    if (missing.includes("teamId")) {
+        lines.push("- `teamId` / `SLACK_TEAM_ID` — workspace team id (`T…`)");
+    }
+    if (missing.includes("openaiApiKey")) {
+        if (authMode === "credits") {
+            lines.push("- OpenAI API key is required in BYOK mode — add `OPENAI_API_KEY` under workspace settings, or switch `authMode` to `credits` on cloud");
+        }
+        else {
+            lines.push("- `OPENAI_API_KEY` — OpenAI API key for the agent loop (BYOK mode), or switch `authMode` to `credits` on cloud");
+        }
+    }
+    return lines.join("\n");
 }
 export async function resolveSlackCredentials(config, storage, options) {
-    const requireOpenAi = options?.requireOpenAi ?? true;
-    const variables = await storage.getVariables();
+    const authMode = config.authMode ?? resolveAuthMode({});
+    const useCredits = shouldUseCreditsAuth({ authMode });
+    const requireOpenAi = options?.requireOpenAi ?? !useCredits;
+    const variables = (await storage.getVariables().catch(() => ({})));
     const resolve = (configKey, envKey) => {
         const fromConfig = config[configKey];
         if (typeof fromConfig === "string" && fromConfig.trim()) {
@@ -44,16 +91,17 @@ export async function resolveSlackCredentials(config, storage, options) {
         }
         if (process.env[envKey]?.trim())
             return process.env[envKey].trim();
-        return varValue(variables, envKey)?.trim();
+        return variableValue(variables, envKey)?.trim();
     };
     const signingSecret = (typeof config.signingSecret === "string" && config.signingSecret.trim()) ||
         process.env.SLACK_SIGNING_SECRET?.trim() ||
-        varValue(variables, "SLACK_SIGNING_SECRET") ||
+        variableValue(variables, "SLACK_SIGNING_SECRET") ||
         "";
     const botToken = resolve("botToken", "SLACK_BOT_TOKEN");
     const teamId = resolve("teamId", "SLACK_TEAM_ID");
-    const openaiApiKey = resolve("openaiApiKey", "OPENAI_API_KEY");
-    const model = resolve("model", "OPENAI_MODEL") ?? "gpt-4o-mini";
+    const openaiApiKey = process.env.OPENAI_API_KEY?.trim() ||
+        variableValue(variables, "OPENAI_API_KEY");
+    const model = resolve("model", "OPENAI_MODEL") ?? "openai/gpt-4o-mini";
     const missing = [];
     if (!botToken)
         missing.push("botToken");
@@ -70,7 +118,8 @@ export async function resolveSlackCredentials(config, storage, options) {
             signingSecret,
             botToken: botToken,
             teamId: teamId,
-            openaiApiKey: openaiApiKey ?? "",
+            authMode,
+            openaiApiKey: openaiApiKey || undefined,
             model,
         },
     };

package/dist/credits-auth.js

@@ -0,0 +1,53 @@
+import { isCloudMode } from "./cloud-mode.js";
+export const INTEGRATIONS_TOKEN_HEADER = "x-openbot-integrations-token";
+export const CREDITS_API_KEY_PLACEHOLDER = "openbot-credits";
+/** Cloud host injects these when routing LLM calls through OpenBot Credits. */
+export function resolveCreditsAuthConfig() {
+    const baseUrl = process.env.OPENBOT_INTEGRATIONS_BASE_URL?.trim();
+    const token = process.env.OPENBOT_INTEGRATIONS_TOKEN?.trim();
+    if (!baseUrl || !token)
+        return undefined;
+    return { baseUrl: baseUrl.replace(/\/$/, ""), token };
+}
+export function creditsProviderBaseUrl(config) {
+    return `${config.baseUrl}/openai/v1`;
+}
+export function shouldUseCreditsAuth(options) {
+    if (options?.authMode === "byok")
+        return false;
+    if (options?.authMode === "credits")
+        return true;
+    return isCloudMode() && resolveCreditsAuthConfig() !== undefined;
+}
+export function isCreditsErrorMessage(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes("insufficient_credits") ||
+        lower.includes("insufficient credits") ||
+        lower.includes("402"));
+}
+export function isAuthErrorMessage(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes("api key") ||
+        lower.includes("401") ||
+        lower.includes("unauthorized") ||
+        lower.includes("authentication"));
+}
+export function isIntegrationsProviderError(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes("provider api key not configured") ||
+        (lower.includes("503") && lower.includes("provider")));
+}
+export const CREDITS_NOT_CONFIGURED_MESSAGE = "OpenBot Credits is not configured on this runtime. The cloud host must set OPENBOT_INTEGRATIONS_BASE_URL and OPENBOT_INTEGRATIONS_TOKEN (try redeploying the workspace).";
+export const CREDITS_PROVIDER_UNAVAILABLE_MESSAGE = "OpenBot Credits could not reach OpenAI — the platform provider API key is not configured yet. Try again later or switch this agent to BYOK mode.";
+export const CREDITS_AUTH_FAILED_MESSAGE = "Slack could not authenticate via OpenBot Credits. Check your workspace credit balance in settings, or switch this agent to BYOK mode.";
+export function creditsErrorMessage(message) {
+    if (isIntegrationsProviderError(message)) {
+        return CREDITS_PROVIDER_UNAVAILABLE_MESSAGE;
+    }
+    if (isCreditsErrorMessage(message)) {
+        return "Insufficient workspace credits. Add credits in workspace settings or switch this agent to BYOK mode.";
+    }
+    if (isAuthErrorMessage(message))
+        return CREDITS_AUTH_FAILED_MESSAGE;
+    return undefined;
+}

package/dist/index.js

@@ -1,6 +1,9 @@
 import { randomUUID } from "node:crypto";
 import { agentOutput, definePlugin, decodeWebhookRawBody, getWebhookHeader, shouldHandleInvoke, webhookHttpResponse, } from "@meetopenbot/plugin-sdk";
-import { DEFAULT_OPENBOT_CHANNEL_ID, resolveOpenBotChannelId, resolveSlackCredentials, } from "./config.js";
+import { isCloudMode } from "./cloud-mode.js";
+import { CREDITS_NOT_CONFIGURED_MESSAGE, creditsErrorMessage, resolveCreditsAuthConfig, } from "./credits-auth.js";
+import { DEFAULT_OPENBOT_CHANNEL_ID, formatMissingCredentials, readSlackConfig, resolveOpenBotChannelId, resolveSlackCredentials, } from "./config.js";
+import { resolveModelConfigField } from "./model-registry.js";
 import { postSlackMessage } from "./slack-post.js";
 import { runSlackAgent } from "./slack-agent.js";
 import { verifySlackSignature } from "./slack-verify.js";
@@ -51,21 +54,6 @@ function getSlackThreadMeta(meta) {
         return undefined;
     return slack;
 }
-function formatMissingCredentials(missing) {
-    const lines = [
-        "Slack agent setup is incomplete. Configure the following in plugin config or environment variables:",
-    ];
-    if (missing.includes("botToken")) {
-        lines.push("- `botToken` / `SLACK_BOT_TOKEN` — Slack bot OAuth token (`xoxb-…`)");
-    }
-    if (missing.includes("teamId")) {
-        lines.push("- `teamId` / `SLACK_TEAM_ID` — workspace team id (`T…`)");
-    }
-    if (missing.includes("openaiApiKey")) {
-        lines.push("- `openaiApiKey` / `OPENAI_API_KEY` — OpenAI API key for the agent loop");
-    }
-    return lines.join("\n");
-}
 async function* bridgeSystemAgentRun(args) {
     const runId = `slack_${randomUUID()}`;
     const slackMeta = getSlackThreadMeta(args.meta);
@@ -146,36 +134,41 @@ async function* bridgeSystemAgentRun(args) {
     }
     await runPromise;
 }
+const modelField = await resolveModelConfigField();
 const slackPluginConfigSchema = {
     type: "object",
     properties: {
-        signingSecret: {
-            type: "string",
-            description: "Slack app signing secret (Basic Information → App Credentials)",
-            format: "password",
+        ...(isCloudMode()
+            ? {
+                authMode: {
+                    type: "string",
+                    description: "Outbound — Credits uses your workspace credit balance via OpenBot. BYOK uses `OPENAI_API_KEY` from workspace settings.",
+                    enum: ["credits", "byok"],
+                    default: "credits",
+                },
+            }
+            : {}),
+        model: {
+            ...modelField,
+            description: "Outbound — OpenAI model for direct Slack agent invocations",
         },
         botToken: {
             type: "string",
-            description: "Slack bot token (OAuth & Permissions → Bot User OAuth Token)",
+            description: "Outbound — Slack bot token (OAuth & Permissions → Bot User OAuth Token)",
             format: "password",
         },
         teamId: {
             type: "string",
-            description: "Slack workspace team id (starts with T)",
-        },
-        channelMappings: {
-            type: "string",
-            description: "Webhook ingress routing. Comma-separated slackChannelId:openbotChannelId pairs (e.g. C01234567:engineering,C89ABCDEF:support). Unmapped Slack channels use uncategorized.",
+            description: "Outbound — Slack workspace team id (starts with T)",
         },
-        openaiApiKey: {
+        signingSecret: {
             type: "string",
-            description: "OpenAI API key for direct Slack agent invocations",
+            description: "Inbound — Slack app signing secret (Basic Information → App Credentials)",
             format: "password",
         },
-        model: {
+        channelMappings: {
             type: "string",
-            description: "OpenAI model id for direct Slack agent invocations (default: gpt-4o-mini)",
-            default: "gpt-4o-mini",
+            description: "Inbound — webhook routing. Comma-separated slackChannelId:openbotChannelId pairs (e.g. C01234567:engineering,C89ABCDEF:support). Unmapped Slack channels use uncategorized.",
         },
     },
     required: ["signingSecret"],
@@ -186,7 +179,7 @@ export default definePlugin({
     configSchema: slackPluginConfigSchema,
     factory: (pluginContext) => (builder) => {
         const { agentId, config, storage } = pluginContext;
-        const slackConfig = config;
+        const slackConfig = readSlackConfig(config);
         const host = pluginContext.host;
         const publicBaseUrl = pluginContext.publicBaseUrl ?? "";
         builder.on("action:webhook", async function* (event, ctx) {
@@ -301,7 +294,9 @@ export default definePlugin({
                 if (!auth.ok) {
                     yield {
                         type: "agent:output",
-                        data: { content: formatMissingCredentials(auth.missing) },
+                        data: {
+                            content: formatMissingCredentials(auth.missing, slackConfig.authMode),
+                        },
                         meta: {
                             agentId: ROUTING_AGENT_ID,
                             threadId,
@@ -361,7 +356,17 @@ export default definePlugin({
             if (!auth.ok) {
                 yield agentOutput({
                     agentId,
-                    content: formatMissingCredentials(auth.missing),
+                    content: formatMissingCredentials(auth.missing, slackConfig.authMode),
+                    threadId,
+                    meta: event.meta,
+                });
+                return;
+            }
+            if (auth.credentials.authMode === "credits" &&
+                !resolveCreditsAuthConfig()) {
+                yield agentOutput({
+                    agentId,
+                    content: CREDITS_NOT_CONFIGURED_MESSAGE,
                     threadId,
                     meta: event.meta,
                 });
@@ -370,6 +375,7 @@ export default definePlugin({
             try {
                 const reply = await runSlackAgent({
                     prompt: userMessage,
+                    authMode: auth.credentials.authMode,
                     openaiApiKey: auth.credentials.openaiApiKey,
                     botToken: auth.credentials.botToken,
                     teamId: auth.credentials.teamId,
@@ -384,9 +390,12 @@ export default definePlugin({
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
+                const creditsMessage = auth.credentials.authMode === "credits"
+                    ? creditsErrorMessage(message)
+                    : undefined;
                 yield agentOutput({
                     agentId,
-                    content: `Slack agent error: ${message}`,
+                    content: creditsMessage ?? `Slack agent error: ${message}`,
                     threadId,
                     meta: event.meta,
                 });

package/dist/model-registry.js

@@ -0,0 +1,40 @@
+const REGISTRY_URL = "https://raw.githubusercontent.com/meetopenbot/openbot-registry/main/registry.json";
+const OPENAI_PROVIDER = "openai";
+const freeInputModelField = () => ({
+    type: "string",
+    override: true,
+    description: "OpenAI model in provider/model-id format (e.g. openai/gpt-4o-mini).",
+    default: "openai/gpt-4o-mini",
+});
+/** Registry-backed model field for plugin configSchema (`enum` + labeled `options`). */
+export async function resolveModelConfigField() {
+    try {
+        const res = await fetch(REGISTRY_URL, {
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok)
+            return freeInputModelField();
+        const registry = (await res.json());
+        const provider = registry.providers?.[OPENAI_PROVIDER];
+        const models = provider?.models ?? [];
+        if (models.length === 0)
+            return freeInputModelField();
+        const defaultModel = models.find((model) => model.id === "gpt-4o-mini")?.id ?? models[0].id;
+        return {
+            type: "string",
+            override: true,
+            description: "OpenAI model from the OpenBot registry.",
+            default: `${OPENAI_PROVIDER}/${defaultModel}`,
+            enum: models.map((model) => `${OPENAI_PROVIDER}/${model.id}`),
+            options: models.map((model) => ({
+                label: `${provider?.label ?? "OpenAI"} — ${model.label}`,
+                value: `${OPENAI_PROVIDER}/${model.id}`,
+                description: model.description,
+            })),
+        };
+    }
+    catch {
+        return freeInputModelField();
+    }
+}

package/dist/model.js

@@ -0,0 +1,24 @@
+import { createOpenAI } from "@ai-sdk/openai";
+import { CREDITS_API_KEY_PLACEHOLDER, INTEGRATIONS_TOKEN_HEADER, creditsProviderBaseUrl, resolveCreditsAuthConfig, shouldUseCreditsAuth, } from "./credits-auth.js";
+function normalizeOpenAiModelId(model) {
+    return model.includes("/") ? model.split("/").slice(1).join("/") : model;
+}
+export function resolveOpenAiModel(model, options) {
+    const modelId = normalizeOpenAiModelId(model);
+    const useCredits = shouldUseCreditsAuth(options);
+    if (useCredits) {
+        const config = resolveCreditsAuthConfig();
+        if (!config) {
+            throw new Error("OpenBot Credits is not configured. The cloud host must set OPENBOT_INTEGRATIONS_BASE_URL and OPENBOT_INTEGRATIONS_TOKEN.");
+        }
+        const baseURL = creditsProviderBaseUrl(config);
+        const headers = { [INTEGRATIONS_TOKEN_HEADER]: config.token };
+        const apiKey = config.token || CREDITS_API_KEY_PLACEHOLDER;
+        return createOpenAI({ baseURL, apiKey, headers })(modelId);
+    }
+    const apiKey = options?.openaiApiKey?.trim();
+    if (!apiKey) {
+        throw new Error("OpenAI API key is required in BYOK mode. Add `OPENAI_API_KEY` under workspace settings or switch `authMode` to `credits` on cloud.");
+    }
+    return createOpenAI({ apiKey })(modelId);
+}

package/dist/slack-agent.js

@@ -1,11 +1,14 @@
-import { createOpenAI } from "@ai-sdk/openai";
 import { generateText, stepCountIs } from "ai";
+import { resolveOpenAiModel } from "./model.js";
 import { createSlackMcpClient } from "./slack-mcp.js";
 const SYSTEM_PROMPT = `You are the OpenBot Slack specialist agent.
 Use Slack MCP tools to post messages, list channels, read history, and perform other workspace actions when needed.
 Summarize results clearly in plain text for the user. Be concise and friendly.`;
 export async function runSlackAgent(args) {
-    const openai = createOpenAI({ apiKey: args.openaiApiKey });
+    const model = resolveOpenAiModel(args.model ?? "openai/gpt-4o-mini", {
+        authMode: args.authMode,
+        openaiApiKey: args.openaiApiKey,
+    });
     const mcpClient = await createSlackMcpClient({
         botToken: args.botToken,
         teamId: args.teamId,
@@ -13,7 +16,7 @@ export async function runSlackAgent(args) {
     try {
         const tools = await mcpClient.tools();
         const result = await generateText({
-            model: openai(args.model ?? "gpt-4o-mini"),
+            model,
             system: SYSTEM_PROMPT,
             prompt: args.prompt,
             tools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/slack",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Slack Events API ingress, simple agent replies, and thread delivery for OpenBot",
   "type": "module",
   "main": "dist/index.js",