@myvillage/cli 1.76.0 → 1.77.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myvillage/cli",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "description": "MyVillageOS CLI for community developers",
   "type": "module",
   "bin": {

package/src/commands/agent-credentials.js

@@ -18,13 +18,14 @@ import {
 // The villager connects the provider once in MyVillage Studio or at
 // myvillageproject.ai. These commands only manage the per-agent consent.
 
-const VALID_PROVIDERS = ['google', 'microsoft', 'zoom'];
+const VALID_PROVIDERS = ['google', 'microsoft', 'zoom', 'slack'];
 
 // Human-facing labels keyed by the lowercase slug the CLI accepts.
 const PROVIDER_LABELS = {
   google: 'Google (Gmail, Calendar, Drive)',
   microsoft: 'Microsoft 365 (Outlook mail, Calendar)',
   zoom: 'Zoom',
+  slack: 'Slack (channels, messages, search — acts as you)',
 };
 
 function fail(message) {

package/src/commands/agent-local.js

@@ -209,7 +209,8 @@ export async function agentCreateLocalCommand() {
 
     console.log(brand.green(`  \u2713 Agent created at ~/.myvillage/agents/${answers.name}/\n`));
     console.log(brand.teal('  Next steps:'));
-    console.log(`    ${brand.gold(`myvillage agent add-mcp ${answers.name}`)}    Add a tool (Gmail, Slack, your own MCP, etc.)`);
+    console.log(`    ${brand.gold(`myvillage agent add-mcp ${answers.name}`)}    Add a tool (GitHub, Twilio, your own MCP, etc.)`);
+    console.log(`    ${brand.gold(`myvillage agent grant ${answers.name} <provider>`)}  Authorize Google, Microsoft, or Slack`);
     console.log(`    ${brand.gold(`myvillage agent start ${answers.name}`)}     Launch the agent`);
     console.log(`    ${brand.gold(`myvillage agent edit ${answers.name}`)}      Customize the prompt`);
     console.log(`    ${brand.gold(`myvillage agent logs ${answers.name}`)}      View activity\n`);
@@ -737,7 +738,8 @@ export async function agentAddToolCommand(name, tool) {
   if (!validTools.includes(tool)) {
     console.log(chalk.red(`  \u2717 Unknown built-in tool "${tool}".`));
     console.log(brand.teal(`  Built-in tools: ${validTools.join(', ')}`));
-    console.log(brand.teal(`  For Gmail, Slack, Twilio, custom MCPs, etc. use: ${chalk.bold(`myvillage agent add-mcp ${name}`)}\n`));
+    console.log(brand.teal(`  For GitHub, Twilio, custom MCPs, etc. use: ${chalk.bold(`myvillage agent add-mcp ${name}`)}`));
+    console.log(brand.teal(`  For Google, Microsoft, or Slack use: ${chalk.bold(`myvillage agent grant ${name} <provider>`)}\n`));
     return;
   }
 

package/src/index.js

@@ -536,7 +536,7 @@ export function run() {
 
   agentCmd
     .command('add-tool <name> <tool>')
-    .description('Add a built-in tool (filesystem, browser) — for everything else (Gmail, GitHub, Slack, custom MCPs) use `add-mcp`')
+    .description('Add a built-in tool (filesystem, browser) — for custom MCPs use `add-mcp`, for Google/Microsoft/Slack use `grant`')
     .action(agentAddToolCommand);
 
   agentCmd

package/src/utils/agent-scaffolder.js

@@ -11,10 +11,11 @@ import { stringify as stringifyYaml } from 'yaml';
 // local-machine resources only; github uses an env var the developer sets
 // themselves).
 //
-// Everything else — Gmail, Slack, Twilio, custom remote MCPs, anything new
-// the community ships — lives as a "recipe" under src/recipes/ that the
-// developer installs via `myvillage agent add-mcp` after creation. See
-// src/utils/recipes.js.
+// Everything else — Twilio, custom remote MCPs, anything new the community
+// ships — lives as a "recipe" the developer installs via `myvillage agent
+// add-mcp` after creation (see src/utils/recipes.js). OAuth providers (Google,
+// Microsoft, Slack) instead connect once and are authorized per-agent with
+// `myvillage agent grant`.
 
 const TOOL_CATALOG = {
 
@@ -100,8 +101,10 @@ export function scaffoldAgent(agentDir, options) {
   );
 
   // A starter .env file for the developer to populate. Tools/recipes that
-  // need credentials (Gmail token, Slack bot token, Twilio SID/auth, custom
-  // headers for remote MCPs) read env vars from this file at agent start.
+  // need credentials (Twilio SID/auth, custom headers for remote MCPs) read env
+  // vars from this file at agent start. OAuth providers (Google, Microsoft,
+  // Slack) are NOT env vars — they connect once and are authorized per-agent
+  // with `myvillage agent grant`.
   // Gitignore-able by convention — it's plaintext on the developer's machine
   // and isn't transmitted anywhere.
   writeFileSync(
@@ -122,13 +125,13 @@ function starterEnvFile() {
     '#',
     '# Examples (the curated recipes — install with `myvillage agent add-mcp`):',
     '#   GITHUB_PERSONAL_ACCESS_TOKEN=ghp_xxxxxxxxxxxx',
-    '#   SLACK_BOT_TOKEN=xoxb-xxxxxxxxxxxx',
-    '#   SLACK_TEAM_ID=T01234567',
     '#   TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxx',
     '#   TWILIO_API_KEY=SKxxxxxxxxxxxx',
     '#   TWILIO_API_SECRET=xxxxxxxxxxxx',
     '#',
-    '# Gmail uses file-based auth (~/.gmail-mcp/credentials.json), no env var needed.',
+    '# Google, Microsoft, and Slack need NO env vars — connect them in MyVillage',
+    "# Studio (or at myvillageproject.ai), then authorize this agent with:",
+    '#   myvillage agent grant <agent> google|microsoft|slack',
     '#',
     '# This file is plaintext — keep it out of version control.',
     '',

package/src/utils/recipes.js

@@ -45,6 +45,27 @@ import { parse as parseYaml } from 'yaml';
 import { getConfig } from './config.js';
 import { getAccessToken } from './auth.js';
 
+// ── Deprecated registry recipes ─────────────────────────
+//
+// Curated recipes retired in favor of one-click OAuth provider connect
+// (`myvillage agent grant <agent> <provider>`). We hide them from the registry
+// listing and block a direct fetch so there's a single, obvious path — even if
+// the backend registry still serves the old entry. Keyed by registry recipe
+// name → the provider slug that replaces it. Only affects bare-name registry
+// loads; a developer's own `--from ./slack.yaml` is untouched.
+const DEPRECATED_REGISTRY_RECIPES = {
+  slack: 'slack', // bot-token Slack MCP → "Sign in with Slack" (acts as you)
+};
+
+function deprecationMessage(name, providerSlug) {
+  const label = name.charAt(0).toUpperCase() + name.slice(1);
+  return (
+    `The "${name}" bot-token tool has been replaced by one-click ${label} sign-in. ` +
+    `Connect ${label} in MyVillage Studio (or at myvillageproject.ai), then run ` +
+    `\`myvillage agent grant <agent> ${providerSlug}\` — no token to copy.`
+  );
+}
+
 // ── Public API ──────────────────────────────────────────
 
 /**
@@ -81,12 +102,20 @@ export async function listRegistryRecipes() {
     throw await registryError(res, 'list recipes');
   }
   const body = await res.json();
-  return body.recipes || [];
+  // Hide retired recipes (e.g. the bot-token Slack MCP) so they never show up
+  // as an option — the OAuth provider path supersedes them.
+  return (body.recipes || []).filter(
+    (r) => !Object.hasOwn(DEPRECATED_REGISTRY_RECIPES, String(r?.name || '').toLowerCase()),
+  );
 }
 
 // ── Loaders ─────────────────────────────────────────────
 
 async function loadRecipeFromRegistry(name) {
+  const slug = String(name || '').toLowerCase();
+  if (Object.hasOwn(DEPRECATED_REGISTRY_RECIPES, slug)) {
+    throw new Error(deprecationMessage(slug, DEPRECATED_REGISTRY_RECIPES[slug]));
+  }
   const url = `${getConfig().apiBaseUrl}/recipes/${encodeURIComponent(name)}`;
   const res = await authedFetch(url);
   if (!res.ok) {