@open-everywhere/provider-slack 0.1.3 → 0.1.5

package/agent/setup/slack-api-setup.ts

@@ -0,0 +1,176 @@
+// THE TWO SLACK CALLS A `/setup` RUN MAKES (OPE-2231) — create the app, then install it.
+//
+// Both go through `channels/slack-web-api.ts`, the ONE seam a Slack Web API call leaves this host
+// through (OPE-1211), so both carry the 429/`Retry-After` backoff and neither becomes a new
+// uncovered bypass in `slack-web-api-seam-test.ts`'s inventory.
+//
+// 1. `apps.manifest.create` — docs.slack.dev/reference/methods/apps.manifest.create. Authenticated by
+//    an APP CONFIGURATION TOKEN the operator pastes (api.slack.com/apps → "Your App Configuration
+//    Tokens", scope `app_configurations:write`, ~12 h life). It takes the manifest this bundle ships
+//    (`agent/app-manifest.ts`) with this deployment's host substituted, and returns the app's
+//    `app_id`, `client_id`, `client_secret`, `signing_secret` and `oauth_authorize_url`.
+//
+// 2. `oauth.v2.access` — docs.slack.dev/reference/methods/oauth.v2.access. Exchanges the `code` the
+//    install redirect brought back for the workspace bot `access_token`, and reports `team.id` and
+//    `authed_user.id`. Authenticated by the app's CLIENT CREDENTIALS IN THE BODY, so it is the one
+//    call in this tree that sends no `Authorization` header (`unauthenticated: true` — see the seam).
+//
+// 🔴 NOTHING HERE LOGS, AUDITS, RETURNS IN AN ERROR, OR OTHERWISE RENDERS A VALUE IT RECEIVED. Each
+// function returns a typed record the caller stores straight into the vault, and each failure is a
+// {@link SlackSetupApiError} carrying Slack's own `error` CODE and nothing else. Slack's error codes
+// are a closed vocabulary (`invalid_auth`, `token_expired`, `invalid_manifest`, …) and are the one
+// thing an operator needs to act; the response body that carried them is dropped unread, because on
+// the manifest call that body is the credential bundle.
+
+import { callSlackWebApi } from "../channels/slack-web-api.js";
+
+/**
+ * A Slack call that failed. `code` is Slack's own `error` string when it gave one, else a fixed
+ * local classification — never a message assembled from a response. The page renders this; see the
+ * header on why it carries no payload.
+ */
+export class SlackSetupApiError extends Error {
+  readonly code: string;
+  constructor(operation: string, code: string) {
+    super(`Slack refused ${operation}: ${code}`);
+    this.name = "SlackSetupApiError";
+    this.code = code;
+  }
+}
+
+/** What `apps.manifest.create` gives back. Three of the five fields are SECRET. */
+export interface CreatedSlackApp {
+  readonly appId: string;
+  readonly clientId: string;
+  /** SECRET. */
+  readonly clientSecret: string;
+  /** SECRET. */
+  readonly signingSecret: string;
+  /** Where to send the installer's browser to install the app. Slack composes it. */
+  readonly oauthAuthorizeUrl: string;
+}
+
+/** Injectable seam for the suite — the live default is the real Slack Web API seam. */
+export interface SlackSetupApiDeps {
+  readonly call?: typeof callSlackWebApi;
+}
+
+/** Read one non-empty string field, or throw a shaped error naming the FIELD, never the payload. */
+function requireString(operation: string, res: Record<string, unknown>, key: string): string {
+  const v = res[key];
+  if (typeof v !== "string" || v.length === 0) throw new SlackSetupApiError(operation, `missing_field:${key}`);
+  return v;
+}
+
+/** Slack's `error` code off an `ok:false` envelope, or a fixed stand-in when it named none. */
+function slackErrorCode(res: Record<string, unknown>): string {
+  const e = res.error;
+  return typeof e === "string" && e.length > 0 ? e : "unknown_error";
+}
+
+/**
+ * Create the Slack app from this bundle's shipped manifest.
+ *
+ * `configToken` is the pasted app configuration token and is used ONCE, here, as the bearer. It is
+ * never stored: it expires in about 12 hours and `/setup` has no later use for it, so holding it
+ * would be a credential kept past its purpose.
+ *
+ * `manifest` is the already-substituted manifest JSON string (the caller resolves the host, so this
+ * function has no opinion about where the deployment lives).
+ */
+export async function createSlackApp(
+  input: { readonly configToken: string; readonly manifest: string },
+  deps: SlackSetupApiDeps = {},
+): Promise<CreatedSlackApp> {
+  const call = deps.call ?? callSlackWebApi;
+  let res: Record<string, unknown>;
+  try {
+    res = (await call({
+      botToken: input.configToken,
+      operation: "apps.manifest.create",
+      body: { manifest: input.manifest },
+    })) as Record<string, unknown>;
+  } catch {
+    // A throw from the seam is a transport failure or a non-2xx — the caught value can carry Slack's
+    // response body, so it is dropped rather than inspected. See the header.
+    throw new SlackSetupApiError("apps.manifest.create", "request_failed");
+  }
+  if (res.ok !== true) throw new SlackSetupApiError("apps.manifest.create", slackErrorCode(res));
+
+  const credentials = res.credentials;
+  if (typeof credentials !== "object" || credentials === null) {
+    throw new SlackSetupApiError("apps.manifest.create", "missing_field:credentials");
+  }
+  const c = credentials as Record<string, unknown>;
+  return {
+    appId: requireString("apps.manifest.create", res, "app_id"),
+    clientId: requireString("apps.manifest.create", c, "client_id"),
+    clientSecret: requireString("apps.manifest.create", c, "client_secret"),
+    signingSecret: requireString("apps.manifest.create", c, "signing_secret"),
+    oauthAuthorizeUrl: requireString("apps.manifest.create", res, "oauth_authorize_url"),
+  };
+}
+
+/** What `oauth.v2.access` gives back. `botToken` is SECRET; the three ids are not. */
+export interface SlackOauthInstall {
+  /** SECRET — the workspace bot token (`xoxb-…`). */
+  readonly botToken: string;
+  readonly teamId: string;
+  readonly teamName?: string;
+  readonly installerUserId: string;
+}
+
+/**
+ * Exchange the install `code` for the workspace bot token.
+ *
+ * NO `Authorization` HEADER — Slack authenticates this one by `client_id` + `client_secret` in the
+ * body (see the module header and the seam's own note). The `redirect_uri` is sent back because Slack
+ * requires it to MATCH the one the authorize step used; omitting it when one was used is an
+ * `invalid_grant`-class refusal rather than a laxer check.
+ */
+export async function exchangeSlackOauthCode(
+  input: {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly code: string;
+    readonly redirectUri: string;
+  },
+  deps: SlackSetupApiDeps = {},
+): Promise<SlackOauthInstall> {
+  const call = deps.call ?? callSlackWebApi;
+  let res: Record<string, unknown>;
+  try {
+    res = (await call({
+      unauthenticated: true,
+      operation: "oauth.v2.access",
+      body: {
+        client_id: input.clientId,
+        client_secret: input.clientSecret,
+        code: input.code,
+        redirect_uri: input.redirectUri,
+      },
+    })) as Record<string, unknown>;
+  } catch {
+    throw new SlackSetupApiError("oauth.v2.access", "request_failed");
+  }
+  if (res.ok !== true) throw new SlackSetupApiError("oauth.v2.access", slackErrorCode(res));
+
+  const team = res.team;
+  const authedUser = res.authed_user;
+  if (typeof team !== "object" || team === null) throw new SlackSetupApiError("oauth.v2.access", "missing_field:team");
+  if (typeof authedUser !== "object" || authedUser === null) {
+    throw new SlackSetupApiError("oauth.v2.access", "missing_field:authed_user");
+  }
+  const t = team as Record<string, unknown>;
+  const u = authedUser as Record<string, unknown>;
+  const teamName = typeof t.name === "string" && t.name.length > 0 ? t.name : undefined;
+  return {
+    // `access_token` on an `oauth.v2.access` response IS the bot token for a bot-scoped install —
+    // Slack puts the USER token under `authed_user.access_token`, which this flow never asks for and
+    // never reads. Taking the wrong one here would store a token with the installer's own access.
+    botToken: requireString("oauth.v2.access", res, "access_token"),
+    teamId: requireString("oauth.v2.access", t, "id"),
+    installerUserId: requireString("oauth.v2.access", u, "id"),
+    ...(teamName ? { teamName } : {}),
+  };
+}

package/agent/status.ts

@@ -0,0 +1,94 @@
+// The Slack arm of the deployment-status surface (OPE-2230) — what `GET /eve/v1/oe/status` reports
+// under `surfaces.slack`.
+//
+// It lives in the BUNDLE, not in core, for the same reason the telemetry credential probe does:
+// `SLACK_BOT_TOKEN` and `SLACK_SIGNING_SECRET` are this vendor's fingerprints, and core carries
+// none of them (`scripts/boundary-test.ts` rule 6).
+//
+// It lives in `status.ts` beside `register.ts` rather than in `ops.ts` because it READS THE
+// OPERATIONAL STORE. `ops.ts` imports core through the light door so the standalone ops MCP server
+// can register it without booting an agent; reaching the store from there would undo that.
+//
+// 🔴 EVERY ANSWER IS A VERDICT, AND EVERY VERDICT IS ONE THIS BUNDLE CAN DEFEND. The route is
+// public, so nothing here returns a token, a team id, a channel key, a count, or a timestamp.
+
+import {
+  deploymentOrg,
+  getOperationalStore,
+  surfaceEventVerifiedAt,
+  unifiedDomainSessionKey,
+  type SurfaceStatus,
+} from "@open-everywhere/core/agent/adapter-api.js";
+
+const set = (v: string | undefined): boolean => v !== undefined && v.trim() !== "";
+
+/**
+ * The two `channel_session` key shapes the LEGACY evidence can be found under.
+ *
+ * A session row is keyed by the supervisor grain's `registryKey`
+ * (`packages/core/agent/channels/unified-supervisor.ts` `supervisorGrainFor`), and that key is NOT
+ * the surface key whenever window topology resolves a domain for the channel:
+ *
+ *   • topology off, or no domain  → the fully-qualified surface key, `slack/<team>/<channel>`;
+ *   • topology on, `solo` mode    → `oe-domain::slack/<team>/<channel>` (the windowId IS the
+ *                                   surface key, so the prefix still carries the platform);
+ *   • topology on, `unified` mode → `oe-domain::<domain name>`;
+ *   • a NAMED window group        → `oe-domain::<group name>`;
+ *   • a DM seat                   → the DM pseudo-domain's key.
+ *
+ * The last three carry no platform marker, so no prefix can find them. That is why the PRIMARY
+ * evidence is now the signature gate's own stamp (OPE-2242, below), which no key shape can hide.
+ * These prefixes stay only for a deployment whose Slack traffic all predates the stamp.
+ */
+// Built with core's OWN key builder, never a copied prefix literal: a change to the key shape then
+// reaches this reporter instead of silently making it match nothing again.
+const SLACK_SESSION_PREFIXES = ["slack/", unifiedDomainSessionKey("slack/")] as const;
+
+/**
+ * Has this deployment ever VERIFIED a signed Slack event?
+ *
+ * Two kinds of evidence, checked in order:
+ *
+ *   1. THE STAMP (OPE-2242). `slack-front.ts` calls core's `stampSurfaceEventVerified("slack")`
+ *      right after its `v0=` HMAC verify passes, on every delivery and before any classification.
+ *      It is a deployment-level `instance_meta` row, so it reads the same for every domain topology:
+ *      `unified` mode, a named window group and a DM-only deployment included.
+ *   2. A LEGACY SESSION ROW. A `channel_session` row is written by a turn, and a turn is reached only
+ *      after the same gate accepts the delivery, so a row is proof too. It covers a deployment whose
+ *      traffic predates the stamp, in the two key shapes above that carry the platform.
+ *
+ * Neither is proof about the CURRENT signing secret: a rotation, or a restored database, leaves
+ * both behind.
+ *
+ * 🔴 ONE-DIRECTIONAL ON PURPOSE. No evidence means NO EVIDENCE, not "no": a workspace that has not
+ * yet sent the app an event, a store that cannot be read, or a deployment whose store was just
+ * migrated writes nothing. "unknown" is the honest answer there, and reporting "no" would train the
+ * reader to ignore the field on exactly the deployments it is meant to help.
+ */
+async function eventsVerified(): Promise<SurfaceStatus["eventsVerified"]> {
+  if ((await surfaceEventVerifiedAt("slack")) !== null) return "yes";
+  try {
+    const store = getOperationalStore();
+    const org = deploymentOrg();
+    for (const prefix of SLACK_SESSION_PREFIXES) {
+      const rows = await store.listChannelSessions(org, prefix);
+      if (rows.length > 0) return "yes";
+    }
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+/** The bundle's answer for `surfaces.slack`. */
+export async function slackSurfaceStatus(env: NodeJS.ProcessEnv = process.env): Promise<Partial<SurfaceStatus>> {
+  const token = set(env.SLACK_BOT_TOKEN);
+  return {
+    credentials: token && set(env.SLACK_SIGNING_SECRET) ? "yes" : "no",
+    // Slack issues a bot token only when the app is installed to a workspace, so holding one is
+    // evidence of an install. It is NOT evidence that the install is still live — a revoked app
+    // leaves the stale token in place — and the detail in the contract page says so.
+    installed: token ? "yes" : "no",
+    eventsVerified: await eventsVerified(),
+  };
+}

package/dist/agent/access/slack-attachment-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-attachment-fetch.d.ts","sourceRoot":"","sources":["../../../agent/access/slack-attachment-fetch.ts"],"names":[],"mappings":"AAmCA,OAAO,EAIL,KAAK,eAAe,EAGrB,MAAM,4CAA4C,CAAC;AAsBpD;kFACkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0F/G"}
+{"version":3,"file":"slack-attachment-fetch.d.ts","sourceRoot":"","sources":["../../../agent/access/slack-attachment-fetch.ts"],"names":[],"mappings":"AAmCA,OAAO,EAIL,KAAK,eAAe,EAGrB,MAAM,4CAA4C,CAAC;AAuBpD;kFACkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2F/G"}

package/dist/agent/access/slack-attachment-fetch.js

@@ -33,6 +33,7 @@
 // before any dispatch. The token does traverse the operator's own proxy: Tier A tunnels it
 // undecrypted (CONNECT), Tier B decrypts with the operator's CA, which is what Tier B is for.
 import { assertSafeFetchUrl, auditToolAction, hostCallAuditFields, } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackBotToken } from "../setup/credentials.js";
 // THE CREDENTIAL'S IDENTITY, FOR THE AUDIT ROW (OPE-1547) — the ref NAME, never the value. This is
 // the one host-side seam that attaches a credential, so before this ticket it was the one place
 // where a plane both saw the call and knew whose credential rode it, and said neither on the row.
@@ -107,7 +108,8 @@ export async function fetchSlackAttachment(ctx, ref) {
         });
         throw new Error(`describe_image: refusing to send the Slack bot token to non-Slack host "${safe.url.hostname}".`);
     }
-    const token = process.env.SLACK_BOT_TOKEN;
+    // Resolved, not read off the env (OPE-2231) — the token may live in the credential store.
+    const token = await slackBotToken();
     if (!token) {
         throw new Error("describe_image: SLACK_BOT_TOKEN is not set — the bot token is required to download a Slack attachment.");
     }

package/dist/agent/access/slack-attachment-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-attachment-fetch.js","sourceRoot":"","sources":["../../../agent/access/slack-attachment-fetch.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,yDAAyD;AACzD,EAAE;AACF,8FAA8F;AAC9F,iFAAiF;AACjF,4FAA4F;AAC5F,kGAAkG;AAClG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,8EAA8E;AAC9E,gGAAgG;AAChG,gGAAgG;AAChG,oCAAoC;AACpC,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,iGAAiG;AACjG,qGAAqG;AACrG,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,8FAA8F;AAE9F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GAIpB,MAAM,4CAA4C,CAAC;AAEpD,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,+FAA+F;AAC/F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE3E,mGAAmG;AACnG,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,GAA2B;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+EAA+E,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACpH,CAAC;IACD,6FAA6F;IAC7F,2EAA2E;IAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,2FAA2F;YAC3F,0EAA0E;YAC1E,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YACxF,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,sFAAsF;IACtF,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,GAAI,GAA8C,EAAE,aAAa,KAAK,gBAAgB,CAAC;QAC1G,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,0FAA0F;YAC1F,6FAA6F;YAC7F,sEAAsE;YACtE,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnH,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM;YACjD,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,iGAAiG;IACjG,+EAA+E;IAC/E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC7F,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,2EAA2E;IAC3E,EAAE;IACF,4FAA4F;IAC5F,kGAAkG;IAClG,8FAA8F;IAC9F,kDAAkD;IAClD,MAAM,GAAG,GAAG,CAAC,OAA6B,EAAE,KAAK,GAA4B,EAAE,EAA2B,EAAE,CAAC,CAAC;QAC5G,GAAG,mBAAmB,CAAC;YACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YACvB,IAAI,EAAE,eAAe;YACrB,OAAO;YACP,UAAU,EAAE,mBAAmB;SAChC,CAAC;QACF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,KAAK;KACT,CAAC,CAAC;IACH,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,8FAA8F;QAC9F,2DAA2D;QAC3D,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACpB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"slack-attachment-fetch.js","sourceRoot":"","sources":["../../../agent/access/slack-attachment-fetch.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,yDAAyD;AACzD,EAAE;AACF,8FAA8F;AAC9F,iFAAiF;AACjF,4FAA4F;AAC5F,kGAAkG;AAClG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,8EAA8E;AAC9E,gGAAgG;AAChG,gGAAgG;AAChG,oCAAoC;AACpC,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,iGAAiG;AACjG,qGAAqG;AACrG,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,8FAA8F;AAE9F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GAIpB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,+FAA+F;AAC/F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE3E,mGAAmG;AACnG,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,GAA2B;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+EAA+E,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACpH,CAAC;IACD,6FAA6F;IAC7F,2EAA2E;IAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,2FAA2F;YAC3F,0EAA0E;YAC1E,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YACxF,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,sFAAsF;IACtF,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,GAAI,GAA8C,EAAE,aAAa,KAAK,gBAAgB,CAAC;QAC1G,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,0FAA0F;YAC1F,6FAA6F;YAC7F,sEAAsE;YACtE,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnH,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM;YACjD,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,iGAAiG;IACjG,+EAA+E;IAC/E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC7F,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpH,CAAC;IACD,0FAA0F;IAC1F,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,2EAA2E;IAC3E,EAAE;IACF,4FAA4F;IAC5F,kGAAkG;IAClG,8FAA8F;IAC9F,kDAAkD;IAClD,MAAM,GAAG,GAAG,CAAC,OAA6B,EAAE,KAAK,GAA4B,EAAE,EAA2B,EAAE,CAAC,CAAC;QAC5G,GAAG,mBAAmB,CAAC;YACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YACvB,IAAI,EAAE,eAAe;YACrB,OAAO;YACP,UAAU,EAAE,mBAAmB;SAChC,CAAC;QACF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,KAAK;KACT,CAAC,CAAC;IACH,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,8FAA8F;QAC9F,2DAA2D;QAC3D,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACpB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/agent/app-manifest.d.ts

@@ -1,12 +1,12 @@
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
- *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the wizard leaves it for the
+ *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
  *  operator, who has usually not deployed yet when they run it. */
 export declare const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
 /** The app name the manifest carries when the operator names none. */
 export declare const SLACK_DEFAULT_APP_NAME = "Open Everywhere";
 /** Slack's limit on an app name (`display_information.name`). A longer name fails at paste time. */
 export declare const SLACK_APP_NAME_MAX = 35;
-/** Why `raw` cannot name the Slack app, or `undefined` when it can. The install wizard's
+/** Why `raw` cannot name the Slack app, or `undefined` when it can. The setup CLI's
  *  `--app-name` reads this; the ops tool applies core's generic check with {@link SLACK_APP_NAME_MAX}. */
 export declare function slackAppNameProblem(raw: string): string | undefined;
 /** Options for {@link slackAppManifestTemplate}. */
@@ -15,8 +15,8 @@ export interface SlackAppManifestOptions {
      *  second install in one workspace needs its own name, or the two apps look the same. */
     readonly appName?: string;
 }
-/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the minimal
- *  scope/event set docs/deploy/surfaces/slack.md walks through by hand. */
+/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the scope/event
+ *  set docs/deploy/surfaces/slack.md walks through by hand. */
 export declare function slackAppManifestTemplate(opts?: SlackAppManifestOptions): string;
 /** Where the operator pastes the manifest. */
 export declare const SLACK_APP_CONSOLE_URL = "https://api.slack.com/apps";

package/dist/agent/app-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-manifest.d.ts","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAaA;;mEAEmE;AACnE,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;0GAC0G;AAC1G,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnE;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC;6FACyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;2EAC2E;AAC3E,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAmHnF;AAED,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAOrD,CAAC;AAEF;;8BAE8B;AAC9B,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAKvD,CAAC"}
+{"version":3,"file":"app-manifest.d.ts","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAaA;;mEAEmE;AACnE,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;0GAC0G;AAC1G,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnE;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC;6FACyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;+DAC+D;AAC/D,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAyJnF;AAED,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAOrD,CAAC;AAEF;;8BAE8B;AAC9B,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAKvD,CAAC"}

package/dist/agent/app-manifest.js

@@ -1,24 +1,24 @@
 // THE Slack app manifest — one definition, three readers (OPE-1603).
 //
-// This file is the only place the manifest exists. The install wizard's Slack step
+// This file is the only place the manifest exists. The setup check's Slack step
 // (packages/create/src/steps/slack.ts) prints it, the ops MCP tool `surface_manifest` serves it
 // with this deployment's host substituted, and `scripts/slack-scope-audit-test.ts` parses the bot
-// scope array below against the runbook's documented scopes. It used to live in the wizard, where
+// scope array below against the runbook's documented scopes. It used to live in the setup CLI, where
 // the ops server could not reach it at all.
 //
-// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The install wizard depends on the bundle for this
+// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The setup CLI depends on the bundle for this
 // document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
 // eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
 // only the vendor's own knowledge.
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
- *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the wizard leaves it for the
+ *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
  *  operator, who has usually not deployed yet when they run it. */
 export const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
 /** The app name the manifest carries when the operator names none. */
 export const SLACK_DEFAULT_APP_NAME = "Open Everywhere";
 /** Slack's limit on an app name (`display_information.name`). A longer name fails at paste time. */
 export const SLACK_APP_NAME_MAX = 35;
-/** Why `raw` cannot name the Slack app, or `undefined` when it can. The install wizard's
+/** Why `raw` cannot name the Slack app, or `undefined` when it can. The setup CLI's
  *  `--app-name` reads this; the ops tool applies core's generic check with {@link SLACK_APP_NAME_MAX}. */
 export function slackAppNameProblem(raw) {
     const name = raw.trim();
@@ -28,8 +28,8 @@ export function slackAppNameProblem(raw) {
         return `the app name is ${name.length} characters; Slack accepts at most ${SLACK_APP_NAME_MAX}`;
     return undefined;
 }
-/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the minimal
- *  scope/event set docs/deploy/surfaces/slack.md walks through by hand. */
+/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the scope/event
+ *  set docs/deploy/surfaces/slack.md walks through by hand. */
 export function slackAppManifestTemplate(opts = {}) {
     const appName = opts.appName?.trim() || SLACK_DEFAULT_APP_NAME;
     return JSON.stringify({
@@ -51,8 +51,10 @@ export function slackAppManifestTemplate(opts = {}) {
                 {
                     command: "/oe",
                     url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack/commands`,
-                    description: "Open Everywhere control commands — status, budget, stop.",
-                    usage_hint: "stop | status | budget",
+                    description: "Open Everywhere control-plane commands (stop, status, budget) — no model turn.",
+                    // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
+                    // scripts/slack-app-manifest-test.ts fails if one is missing here.
+                    usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | help",
                     should_escape: false,
                 },
             ],
@@ -81,6 +83,13 @@ export function slackAppManifestTemplate(opts = {}) {
             ],
         },
         oauth_config: {
+            // THE OAUTH REDIRECT BACK TO THIS DEPLOYMENT (OPE-2231). `/setup` installs the app by sending
+            // the installer to Slack's authorize URL and taking the `code` on the way back, and Slack
+            // refuses a redirect to a URL the app does not DECLARE — so the agent-led install needs this
+            // line in the manifest, not just in the code that handles the callback. It is harmless on the
+            // hand-paste path: an app created from this manifest and installed from the Slack console
+            // never visits the URL.
+            redirect_urls: [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`],
             scopes: {
                 bot: [
                     "app_mentions:read",
@@ -108,10 +117,20 @@ export function slackAppManifestTemplate(opts = {}) {
                     // asked in an ordinary room is delivered to the requester's DM, never rendered there.
                     "im:write",
                     "groups:history",
+                    // Group-DM messages — the scope `message.mpim` below needs (Slack's event reference).
+                    "mpim:history",
                     // The group-DM (`mpim`) half of `im:read` — same two calls, same call sites. Code-derived
                     // rather than live-proven: the roster/disclosure paths are keyed on the room, and a
                     // member-tier click or a card can land in a group DM exactly as it can in a 1:1.
                     "mpim:read",
+                    // files.getUploadURLExternal + files.completeUploadExternal — the `post_file` tool's
+                    // upload flow (packages/core/agent/tools/post_file.ts). Without it every file post fails
+                    // with `missing_scope`.
+                    "files:write",
+                    // The authenticated download of a Slack file's `url_private`
+                    // (access/slack-attachment-fetch.ts fetchSlackAttachment), which `describe_image` uses to
+                    // read an image a person posted. Slack serves that URL only to an app with this scope.
+                    "files:read",
                     "reactions:write",
                     "reactions:read",
                     "pins:read",
@@ -125,7 +144,26 @@ export function slackAppManifestTemplate(opts = {}) {
         settings: {
             event_subscriptions: {
                 request_url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack`,
-                bot_events: ["app_mention", "message.im", "reaction_added", "reaction_removed"],
+                // EVERY event the front route acts on (slack-front.ts classifyEnvelope), and each one's
+                // scope is in the bot list above, per Slack's event reference:
+                //   app_mention → app_mentions:read · message.im → im:history
+                //   message.channels → channels:history (an engaged thread's follow-up with no re-mention)
+                //   message.groups → groups:history (the same, in private channels)
+                //   message.mpim → mpim:history (group DMs; without it only an @mention there is heard)
+                //   member_joined_channel → channels:read, groups:read, mpim:read (the channel-join intro)
+                //   reaction_added, reaction_removed → reactions:read (reaction feedback)
+                // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
+                // this list drops one (OPE-2223).
+                bot_events: [
+                    "app_mention",
+                    "message.im",
+                    "message.channels",
+                    "message.groups",
+                    "message.mpim",
+                    "member_joined_channel",
+                    "reaction_added",
+                    "reaction_removed",
+                ],
             },
             // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every
             // button click and every shortcut lands here, and the front route classifies which handler

package/dist/agent/app-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-manifest.js","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,mFAAmF;AACnF,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,4CAA4C;AAC5C,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mCAAmC;AAEnC;;mEAEmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAExD,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;0GAC0G;AAC1G,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,uBAAuB,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,mBAAmB,IAAI,CAAC,MAAM,sCAAsC,kBAAkB,EAAE,CAAC;IACtI,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;2EAC2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAA4B,EAAE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAC;IAC/D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACtC,QAAQ,EAAE;YACR,wFAAwF;YACxF,4FAA4F;YAC5F,yFAAyF;YACzF,kFAAkF;YAClF,QAAQ,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE;YACxG,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;YACxD,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,yFAAyF;YACzF,2DAA2D;YAC3D,cAAc,EAAE;gBACd;oBACE,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,WAAW,6BAA6B,wBAAwB;oBACrE,WAAW,EAAE,0DAA0D;oBACvE,UAAU,EAAE,wBAAwB;oBACpC,aAAa,EAAE,KAAK;iBACrB;aACF;YACD,mFAAmF;YACnF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,qDAAqD;YACrD,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,qBAAqB;oBAClC,WAAW,EAAE,iCAAiC;iBAC/C;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oBAAoB;oBACjC,WAAW,EAAE,yBAAyB;iBACvC;aACF;SACF;QACD,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG,EAAE;oBACH,mBAAmB;oBACnB,YAAY;oBACZ,kBAAkB;oBAClB,sFAAsF;oBACtF,wFAAwF;oBACxF,iFAAiF;oBACjF,UAAU;oBACV,iFAAiF;oBACjF,+EAA+E;oBAC/E,iFAAiF;oBACjF,eAAe;oBACf,aAAa;oBACb,YAAY;oBACZ,wFAAwF;oBACxF,4EAA4E;oBAC5E,wFAAwF;oBACxF,wFAAwF;oBACxF,wFAAwF;oBACxF,oFAAoF;oBACpF,2EAA2E;oBAC3E,SAAS;oBACT,uFAAuF;oBACvF,sFAAsF;oBACtF,UAAU;oBACV,gBAAgB;oBAChB,0FAA0F;oBAC1F,oFAAoF;oBACpF,iFAAiF;oBACjF,WAAW;oBACX,iBAAiB;oBACjB,gBAAgB;oBAChB,WAAW;oBACX,YAAY;oBACZ,mFAAmF;oBACnF,wDAAwD;oBACxD,YAAY;iBACb;aACF;SACF;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE;gBACnB,WAAW,EAAE,WAAW,6BAA6B,eAAe;gBACpE,UAAU,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;aAChF;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,oFAAoF;YACpF,yFAAyF;YACzF,+DAA+D;YAC/D,aAAa,EAAE;gBACb,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,WAAW,6BAA6B,eAAe;aACrE;YACD,kBAAkB,EAAE,KAAK;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;SAC9B;KACF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,wFAAwF;IACxF,wCAAwC;IACxC,gEAAgE;IAChE,gBAAgB;IAChB,2DAA2D;IAC3D,oSAAoS;CACrS,CAAC;AAEF;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,uEAAuE;IACvE,6EAA6E;IAC7E,sJAAsJ;IACtJ,4HAA4H;CAC7H,CAAC"}
+{"version":3,"file":"app-manifest.js","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,gFAAgF;AAChF,gGAAgG;AAChG,kGAAkG;AAClG,qGAAqG;AACrG,4CAA4C;AAC5C,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,iGAAiG;AACjG,mCAAmC;AAEnC;;mEAEmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAE/D,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAExD,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;0GAC0G;AAC1G,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,uBAAuB,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,mBAAmB,IAAI,CAAC,MAAM,sCAAsC,kBAAkB,EAAE,CAAC;IACtI,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;+DAC+D;AAC/D,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAA4B,EAAE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAC;IAC/D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACtC,QAAQ,EAAE;YACR,wFAAwF;YACxF,4FAA4F;YAC5F,yFAAyF;YACzF,kFAAkF;YAClF,QAAQ,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE;YACxG,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;YACxD,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,yFAAyF;YACzF,2DAA2D;YAC3D,cAAc,EAAE;gBACd;oBACE,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,WAAW,6BAA6B,wBAAwB;oBACrE,WAAW,EAAE,gFAAgF;oBAC7F,0FAA0F;oBAC1F,mEAAmE;oBACnE,UAAU,EAAE,gEAAgE;oBAC5E,aAAa,EAAE,KAAK;iBACrB;aACF;YACD,mFAAmF;YACnF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,qDAAqD;YACrD,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,qBAAqB;oBAClC,WAAW,EAAE,iCAAiC;iBAC/C;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oBAAoB;oBACjC,WAAW,EAAE,yBAAyB;iBACvC;aACF;SACF;QACD,YAAY,EAAE;YACZ,8FAA8F;YAC9F,0FAA0F;YAC1F,6FAA6F;YAC7F,8FAA8F;YAC9F,0FAA0F;YAC1F,wBAAwB;YACxB,aAAa,EAAE,CAAC,WAAW,6BAA6B,iBAAiB,CAAC;YAC1E,MAAM,EAAE;gBACN,GAAG,EAAE;oBACH,mBAAmB;oBACnB,YAAY;oBACZ,kBAAkB;oBAClB,sFAAsF;oBACtF,wFAAwF;oBACxF,iFAAiF;oBACjF,UAAU;oBACV,iFAAiF;oBACjF,+EAA+E;oBAC/E,iFAAiF;oBACjF,eAAe;oBACf,aAAa;oBACb,YAAY;oBACZ,wFAAwF;oBACxF,4EAA4E;oBAC5E,wFAAwF;oBACxF,wFAAwF;oBACxF,wFAAwF;oBACxF,oFAAoF;oBACpF,2EAA2E;oBAC3E,SAAS;oBACT,uFAAuF;oBACvF,sFAAsF;oBACtF,UAAU;oBACV,gBAAgB;oBAChB,sFAAsF;oBACtF,cAAc;oBACd,0FAA0F;oBAC1F,oFAAoF;oBACpF,iFAAiF;oBACjF,WAAW;oBACX,qFAAqF;oBACrF,yFAAyF;oBACzF,wBAAwB;oBACxB,aAAa;oBACb,6DAA6D;oBAC7D,0FAA0F;oBAC1F,uFAAuF;oBACvF,YAAY;oBACZ,iBAAiB;oBACjB,gBAAgB;oBAChB,WAAW;oBACX,YAAY;oBACZ,mFAAmF;oBACnF,wDAAwD;oBACxD,YAAY;iBACb;aACF;SACF;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE;gBACnB,WAAW,EAAE,WAAW,6BAA6B,eAAe;gBACpE,wFAAwF;gBACxF,+DAA+D;gBAC/D,8DAA8D;gBAC9D,2FAA2F;gBAC3F,oEAAoE;gBACpE,wFAAwF;gBACxF,2FAA2F;gBAC3F,0EAA0E;gBAC1E,wFAAwF;gBACxF,kCAAkC;gBAClC,UAAU,EAAE;oBACV,aAAa;oBACb,YAAY;oBACZ,kBAAkB;oBAClB,gBAAgB;oBAChB,cAAc;oBACd,uBAAuB;oBACvB,gBAAgB;oBAChB,kBAAkB;iBACnB;aACF;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,oFAAoF;YACpF,yFAAyF;YACzF,+DAA+D;YAC/D,aAAa,EAAE;gBACb,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,WAAW,6BAA6B,eAAe;aACrE;YACD,kBAAkB,EAAE,KAAK;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;SAC9B;KACF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,wFAAwF;IACxF,wCAAwC;IACxC,gEAAgE;IAChE,gBAAgB;IAChB,2DAA2D;IAC3D,oSAAoS;CACrS,CAAC;AAEF;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,uEAAuE;IACvE,6EAA6E;IAC7E,sJAAsJ;IACtJ,4HAA4H;CAC7H,CAAC"}

package/dist/agent/channels/slack-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-commands.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAoCA,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,4CAA4C,CAAC;AAOpD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAS7D;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkBhF"}
+{"version":3,"file":"slack-commands.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAqCA,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,4CAA4C,CAAC;AAOpD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAS7D;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkBhF"}

package/dist/agent/channels/slack-commands.js

@@ -33,6 +33,7 @@
 // route below for what such a command reached before.
 import { defineChannel, POST } from "eve/channels";
 import { verifySlackSignature } from "./slack-front.js";
+import { slackSigningSecret } from "../setup/credentials.js";
 import { bindFrom, runOeCommand, parseSlackCommandText, resolvePartition, getOperationalStore, admittedTenantsFromConfig, unadmittedTenantLog, UNADMITTED_TENANT_DROP_REASON, } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackTenantAdmission } from "./slack-tenant-fence.js";
 function log(msg) {
@@ -135,7 +136,10 @@ export default defineChannel({
         // keeps stop free and working while the scope is over its spend cap.
         POST(SLACK_COMMANDS_ROUTE, async (req, { attachSession, waitUntil }) => {
             const rawBody = await req.text();
-            if (!verifySlackSignature(rawBody, req.headers, process.env.SLACK_SIGNING_SECRET)) {
+            // Resolved, not read off the env (OPE-2231): a `/setup` run can have put the signing secret in
+            // the credential store, and `/oe stop` is the affordance a person reaches for when the agent is
+            // doing the wrong thing. An install where stop 401s is an install where stop is missing.
+            if (!verifySlackSignature(rawBody, req.headers, await slackSigningSecret())) {
                 return new Response("unauthorized", { status: 401 });
             }
             const params = new URLSearchParams(rawBody);

package/dist/agent/channels/slack-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-commands.js","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,8FAA8F;AAC9F,uFAAuF;AACvF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,4FAA4F;AAC5F,+FAA+F;AAC/F,6FAA6F;AAC7F,8FAA8F;AAC9F,oFAAoF;AACpF,4FAA4F;AAC5F,sFAAsF;AACtF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,qFAAqF;AACrF,8FAA8F;AAC9F,mCAAmC;AACnC,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qFAAqF;AACrF,6FAA6F;AAC7F,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,sDAAsD;AAEtD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE7D;oFACoF;AACpF,SAAS,SAAS,CAAC,MAAuB,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP,UAAU,EAAE;wBACV,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE;wBAC3C,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE;wBACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD;oBACD,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE;oBAC/C,aAAa,EAAE,YAAY;iBAC5B;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAA0B,EAAE,SAA6B,EAAE,MAAc,EAAE,YAAqB;IACjI,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC;YACzB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;SAClI,CAAC,CAAC;QACtB,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC;YACtC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,IAAI,EAAE;SAC9H,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE;QACxE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,4FAA4F;QAC5F,0FAA0F;QAC1F,qEAAqE;QACrE,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAClF,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE5C,6FAA6F;YAC7F,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,0FAA0F;YAC1F,4CAA4C;YAC5C,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,+FAA+F;YAC/F,0FAA0F;YAC1F,EAAE;YACF,8FAA8F;YAC9F,iFAAiF;YACjF,uFAAuF;YACvF,2FAA2F;YAC3F,2FAA2F;YAC3F,2FAA2F;YAC3F,2BAA2B;YAC3B,EAAE;YACF,0FAA0F;YAC1F,uFAAuF;YACvF,mCAAmC;YACnC,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,2DAA2D;YAC3D,EAAE;YACF,4FAA4F;YAC5F,4FAA4F;YAC5F,8CAA8C;YAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACxD,IAAI,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;gBACpG,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,6BAA6B,EAAE,YAAY,CAAC,CAAC,CAAC;gBACrH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,qFAAqF;gBACrF,oFAAoF;gBACpF,qFAAqF;gBACrF,0DAA0D;gBAC1D,GAAG,CAAC,6BAA6B,OAAO,IAAI,GAAG,kEAAkE,CAAC,CAAC;gBACnH,OAAO,iBAAiB,CAAC,yFAAyF,CAAC,CAAC;YACtH,CAAC;YAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;gBAClE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,uFAAuF;gBACvF,6EAA6E;gBAC7E,6CAA6C;gBAC7C,GAAG,CAAC,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO,iBAAiB,CAAC,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC;KACH;CACF,CAAC,CAAC"}
+{"version":3,"file":"slack-commands.js","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,8FAA8F;AAC9F,uFAAuF;AACvF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,4FAA4F;AAC5F,+FAA+F;AAC/F,6FAA6F;AAC7F,8FAA8F;AAC9F,oFAAoF;AACpF,4FAA4F;AAC5F,sFAAsF;AACtF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,qFAAqF;AACrF,8FAA8F;AAC9F,mCAAmC;AACnC,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qFAAqF;AACrF,6FAA6F;AAC7F,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,sDAAsD;AAEtD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE7D;oFACoF;AACpF,SAAS,SAAS,CAAC,MAAuB,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxD,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP,UAAU,EAAE;wBACV,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE;wBAC3C,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE;wBACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD;oBACD,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE;oBAC/C,aAAa,EAAE,YAAY;iBAC5B;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAA0B,EAAE,SAA6B,EAAE,MAAc,EAAE,YAAqB;IACjI,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC;YACzB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;SAClI,CAAC,CAAC;QACtB,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC;YACtC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,UAAU,EAAE,YAAY,IAAI,IAAI,EAAE;SAC9H,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE;QACxE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,4FAA4F;QAC5F,0FAA0F;QAC1F,qEAAqE;QACrE,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,+FAA+F;YAC/F,gGAAgG;YAChG,yFAAyF;YACzF,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,kBAAkB,EAAE,CAAC,EAAE,CAAC;gBAC5E,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE5C,6FAA6F;YAC7F,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,0FAA0F;YAC1F,4CAA4C;YAC5C,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,+FAA+F;YAC/F,0FAA0F;YAC1F,EAAE;YACF,8FAA8F;YAC9F,iFAAiF;YACjF,uFAAuF;YACvF,2FAA2F;YAC3F,2FAA2F;YAC3F,2FAA2F;YAC3F,2BAA2B;YAC3B,EAAE;YACF,0FAA0F;YAC1F,uFAAuF;YACvF,mCAAmC;YACnC,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,2DAA2D;YAC3D,EAAE;YACF,4FAA4F;YAC5F,4FAA4F;YAC5F,8CAA8C;YAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YACxD,IAAI,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;gBACpG,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,6BAA6B,EAAE,YAAY,CAAC,CAAC,CAAC;gBACrH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,qFAAqF;gBACrF,oFAAoF;gBACpF,qFAAqF;gBACrF,0DAA0D;gBAC1D,GAAG,CAAC,6BAA6B,OAAO,IAAI,GAAG,kEAAkE,CAAC,CAAC;gBACnH,OAAO,iBAAiB,CAAC,yFAAyF,CAAC,CAAC;YACtH,CAAC;YAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;gBAClE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,uFAAuF;gBACvF,6EAA6E;gBAC7E,6CAA6C;gBAC7C,GAAG,CAAC,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO,iBAAiB,CAAC,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC;KACH;CACF,CAAC,CAAC"}

package/dist/agent/channels/slack-events.d.ts

@@ -1147,7 +1147,7 @@ export declare function slackChannelFactsFor(channelId: string): Promise<{
  * config-load error ⇒ false (fail-safe to the native per-channel split).
  */
 export declare function slackDomainUsesUnifiedWindow(surfaceKey: string): boolean;
-export declare function slackForm(method: string, body: string, token?: string | undefined): Promise<Record<string, unknown> | undefined>;
+export declare function slackForm(method: string, body: string, token?: string): Promise<Record<string, unknown> | undefined>;
 /**
  * Render a `conversations.history` response (newest-first, raw Slack JSON — probe,
  * never assume) as a compact oldest-first transcript, or undefined when there's