@opengeni/api-router 0.12.2 → 0.12.7

package/dist/{chunk-3JR6L6NJ.js → chunk-SD5GJTZ4.js}

@@ -21,13 +21,13 @@ import {
 import { dbSql, getWorkspace as getWorkspace2 } from "@opengeni/db";
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
-import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport3 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { HTTPException as HTTPException26 } from "hono/http-exception";
 import {
-  hasPermission as hasPermission7,
+  hasPermission as hasPermission10,
   requireAccessGrant as requireAccessGrant18,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
@@ -291,6 +291,8 @@ import { requireLimit as requireLimit8 } from "@opengeni/core";
 // src/mcp/server.ts
 import {
   CreateScheduledTaskRequest,
+  DEFAULT_FIRST_PARTY_MCP_TOOLS,
+  FIRST_PARTY_MCP_TOOL_NAMES,
   defaultRepositoryMountPath,
   SESSION_EVENT_RAW_DELTA_TYPES,
   SessionEventLatestClass,
@@ -335,7 +337,6 @@ import {
   MEMORY_CORRECT_TOOL_DESCRIPTION,
   MEMORY_SAVE_TOOL_DESCRIPTION,
   MEMORY_SEARCH_TOOL_DESCRIPTION,
-  requireFile,
   requireScheduledTask,
   requireSession,
   saveWorkspaceMemory,
@@ -356,7 +357,9 @@ import {
   GitHubAppConfigurationError,
   githubAppMissingSettings
 } from "@opengeni/github";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  McpServer
+} from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as z4 from "zod/v4";
 import {
   hasPermission as hasPermission2,
@@ -2019,7 +2022,8 @@ import {
   completeSlackBotPostOperation,
   getSession,
   recordAuditEvent,
-  releaseSlackBotPostOperationClaim
+  releaseSlackBotPostOperationClaim,
+  setConnectionStatus
 } from "@opengeni/db";
 import { readResponseJsonBounded } from "@opengeni/network";
 import { HTTPException as HTTPException2 } from "hono/http-exception";
@@ -2031,6 +2035,46 @@ var MAX_HISTORY_PAGE = 100;
 var MAX_USER_PAGE = 200;
 var MAX_PROJECTED_TEXT = 4e3;
 var SLACK_POST_CLAIM_LEASE_MS = 3e4;
+async function exchangeOpenGeniSlackAuthorizationCode(input, fetchImpl = fetch) {
+  const body = new URLSearchParams({
+    code: input.code,
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    redirect_uri: input.redirectUri
+  });
+  let response;
+  try {
+    response = await fetchImpl(`${SLACK_API_BASE}oauth.v2.access`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body: body.toString(),
+      redirect: "error",
+      signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+    });
+  } catch {
+    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+  }
+  if (!response.ok) {
+    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+  }
+  const payload = await readResponseJsonBounded(
+    response,
+    SLACK_RESPONSE_MAX_BYTES,
+    "Slack OAuth response"
+  );
+  const record3 = slackRecord(payload);
+  if (!record3 || record3.ok !== true) {
+    throw new SlackBotProviderError(slackString(record3?.error) || "oauth_exchange_failed");
+  }
+  const accessToken = slackString(record3.access_token);
+  if (!accessToken?.startsWith("xoxb-")) {
+    throw new HTTPException2(502, { message: "Slack installation did not return a bot token" });
+  }
+  return accessToken;
+}
 var SlackBotProviderError = class extends Error {
   constructor(code) {
     super(`Slack bot request failed: ${safeSlackCode(code)}`);
@@ -2038,6 +2082,23 @@ var SlackBotProviderError = class extends Error {
     this.name = "SlackBotProviderError";
   }
 };
+var SLACK_CREDENTIAL_REJECTION_CODES = /* @__PURE__ */ new Set([
+  "account_inactive",
+  "invalid_auth",
+  "not_authed",
+  "token_expired",
+  "token_revoked"
+]);
+function slackCredentialRejected(error) {
+  return error instanceof SlackBotProviderError && SLACK_CREDENTIAL_REJECTION_CODES.has(error.code);
+}
+var SlackBotCredentialVerificationError = class extends HTTPException2 {
+  constructor(failureReason, message) {
+    super(422, { message });
+    this.failureReason = failureReason;
+    this.name = "SlackBotCredentialVerificationError";
+  }
+};
 async function verifyOpenGeniSlackBotCredential(token, fetchImpl = fetch, now = /* @__PURE__ */ new Date()) {
   const authResponse = await slackApiFetch(fetchImpl, "auth.test", token, {});
   const grantedScopes2 = parseGrantedScopes(authResponse.response.headers.get("x-oauth-scopes"));
@@ -2052,14 +2113,18 @@ async function verifyOpenGeniSlackBotCredential(token, fetchImpl = fetch, now =
   });
   const user = slackRecord(userResponse.payload.user);
   if (!user || user.is_bot !== true || user.deleted === true) {
-    throw new HTTPException2(422, { message: "Slack credential must identify an active bot user" });
+    throw new SlackBotCredentialVerificationError(
+      "identity_mismatch",
+      "Slack credential must identify an active bot user"
+    );
   }
   const profile = slackRecord(user.profile);
   const displayName = slackString(profile?.display_name) || slackString(profile?.real_name);
   if (displayName !== "OpenGeni") {
-    throw new HTTPException2(422, {
-      message: 'Slack bot display name must be exactly "OpenGeni"'
-    });
+    throw new SlackBotCredentialVerificationError(
+      "identity_mismatch",
+      'Slack bot display name must be exactly "OpenGeni"'
+    );
   }
   return {
     grantedScopes: grantedScopes2,
@@ -2270,7 +2335,18 @@ var OpenGeniSlackBotClient = class {
     return projected;
   }
   async call(headers, method, params) {
-    return (await slackApiFetchWithHeaders(this.fetchImpl, method, headers, params)).payload;
+    try {
+      return (await slackApiFetchWithHeaders(this.fetchImpl, method, headers, params)).payload;
+    } catch (error) {
+      if (slackCredentialRejected(error)) {
+        await setConnectionStatus(this.db, this.context.workspaceId, "needs_reauth", error.code, {
+          id: this.connection.id,
+          version: this.connection.version,
+          subjectId: null
+        }).catch(() => false);
+      }
+      throw error;
+    }
   }
   async withAudit(operation, run) {
     try {
@@ -2426,14 +2502,18 @@ function assertExactOpenGeniSlackBotScopes(grantedScopes2) {
       ...forbidden.length ? [`forbidden: ${forbidden.join(", ")}`] : [],
       ...unsupported.length ? [`unsupported: ${unsupported.join(", ")}`] : []
     ];
-    throw new HTTPException2(422, {
-      message: `Slack bot scopes must exactly match the OpenGeni manifest (${facts.join("; ")})`
-    });
+    throw new SlackBotCredentialVerificationError(
+      "scope_mismatch",
+      `Slack bot scopes must exactly match the OpenGeni manifest (${facts.join("; ")})`
+    );
   }
 }
 function parseGrantedScopes(header) {
   if (!header) {
-    throw new HTTPException2(422, { message: "Slack did not report granted bot scopes" });
+    throw new SlackBotCredentialVerificationError(
+      "scope_mismatch",
+      "Slack did not report granted bot scopes"
+    );
   }
   return [
     ...new Set(
@@ -2530,17 +2610,124 @@ function slackPostOutcomeMayBeAmbiguous(error) {
 }
 
 // src/mcp/server.ts
+var FIRST_PARTY_TOOL_AUTHORIZATION = {
+  set_session_title: { sessionRequired: true, allOf: ["sessions:control"] },
+  goal_set: { sessionRequired: true, allOf: ["goals:manage"] },
+  goal_update: { sessionRequired: true, allOf: ["goals:manage"] },
+  goal_complete: { sessionRequired: true, allOf: ["goals:manage"] },
+  goal_pause: { sessionRequired: true, allOf: ["goals:manage"] },
+  memory_search: { sessionRequired: true, allOf: ["documents:search"] },
+  memory_save: { sessionRequired: true, allOf: ["documents:search"] },
+  memory_correct: { sessionRequired: true, allOf: ["documents:search"] },
+  sandboxes_list: { sessionRequired: true, allOf: ["sessions:read"] },
+  sandbox_attach: { sessionRequired: true, allOf: ["sessions:control"] },
+  sandbox_swap: { sessionRequired: true, allOf: ["sessions:control"] },
+  run_on: { sessionRequired: true, allOf: ["sessions:control"] },
+  sandbox_provision: { sessionRequired: true, allOf: ["sessions:control"] },
+  rig_list: { allOf: ["rigs:use"] },
+  rig_get: { allOf: ["rigs:use"] },
+  rig_propose_change: { allOf: ["rigs:use"] },
+  rig_verify: { allOf: ["rigs:use"] },
+  rig_promote: { allOf: ["rigs:manage"] },
+  sessions_list: { allOf: ["sessions:read"] },
+  session_get: { allOf: ["sessions:read"] },
+  session_events: { allOf: ["sessions:read"] },
+  session_create: { allOf: ["sessions:create"] },
+  session_send_message: { allOf: ["sessions:control"] },
+  session_pause: { allOf: ["sessions:control"] },
+  session_resume: { allOf: ["sessions:control"] },
+  session_steer: { sessionRequired: true, allOf: ["sessions:control"] },
+  set_other_session_title: { allOf: ["sessions:control"] },
+  variable_set_list: { allOf: ["variable-sets:use"] },
+  environment_list: { allOf: ["variable-sets:use"] },
+  variable_set_set_variable: { allOf: ["variable-sets:manage"] },
+  environment_set_variable: { allOf: ["variable-sets:manage"] },
+  github_connect_link: { allOf: ["github:use"] },
+  github_token: { sessionRequired: true, allOf: ["github:use"] },
+  github_repositories_list: { allOf: ["github:use"] },
+  social_connections_list: { allOf: ["connections:read"] },
+  social_posts_recent: { allOf: ["connections:read"] },
+  social_daily_analysis_context: { allOf: ["connections:read"] },
+  scheduled_tasks_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
+  scheduled_tasks_get: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
+  scheduled_tasks_create: { allOf: ["scheduled_tasks:manage"] },
+  scheduled_tasks_update: { allOf: ["scheduled_tasks:manage"] },
+  scheduled_tasks_pause: { allOf: ["scheduled_tasks:manage"] },
+  scheduled_tasks_resume: { allOf: ["scheduled_tasks:manage"] },
+  scheduled_tasks_trigger: { allOf: ["scheduled_tasks:run"] },
+  scheduled_tasks_delete: { allOf: ["scheduled_tasks:manage"] },
+  scheduled_task_runs_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
+  slack_bot_list_channels: { allOf: ["connections:read"] },
+  slack_bot_channel_history: { allOf: ["connections:read"] },
+  slack_bot_list_users: { allOf: ["connections:read"] },
+  slack_bot_post_message: { allOf: ["connections:read"] }
+};
+var FIRST_PARTY_MCP_TOOL_NAME_SET = new Set(FIRST_PARTY_MCP_TOOL_NAMES);
+var PolicyMcpServer = class extends McpServer {
+  constructor(grant, sessionId, selectedTools, allowUncatalogued) {
+    super({ name: "opengeni", version: "1.0.0" });
+    this.grant = grant;
+    this.sessionId = sessionId;
+    this.selectedTools = selectedTools;
+    this.allowUncatalogued = allowUncatalogued;
+  }
+  registeredToolCount = 0;
+  registerTool(name, config, cb) {
+    const catalogued = FIRST_PARTY_MCP_TOOL_NAME_SET.has(name);
+    let admitted = this.allowUncatalogued && !catalogued;
+    if (catalogued) {
+      const toolName = name;
+      const policy = FIRST_PARTY_TOOL_AUTHORIZATION[toolName];
+      const authorized = (!policy.sessionRequired || this.sessionId !== null) && (policy.allOf?.every((permission) => hasPermission2(this.grant.permissions, permission)) ?? true) && (policy.anyOf?.some((permission) => hasPermission2(this.grant.permissions, permission)) ?? true);
+      const selected = this.selectedTools === null || this.selectedTools.has(toolName);
+      admitted = authorized && selected;
+    }
+    if (!admitted) {
+      return {
+        ...config.title ? { title: config.title } : {},
+        ...config.description ? { description: config.description } : {},
+        ...config.annotations ? { annotations: config.annotations } : {},
+        ...config._meta ? { _meta: config._meta } : {},
+        handler: cb,
+        enabled: false,
+        enable() {
+        },
+        disable() {
+        },
+        update() {
+        },
+        remove() {
+        }
+      };
+    }
+    this.registeredToolCount += 1;
+    return super.registerTool(name, config, cb);
+  }
+  ensureToolsListHandler() {
+    if (this.registeredToolCount > 0) return;
+    super.registerTool(
+      "__opengeni_empty_first_party_surface__",
+      {
+        description: "Internal disabled placeholder for an empty first-party surface.",
+        inputSchema: z4.object({})
+      },
+      async () => ({
+        content: [{ type: "text", text: '{"unavailable":true}' }]
+      })
+    ).disable();
+  }
+};
 function buildOpenGeniMcpServer(deps, grant, options = {}) {
-  const server = new McpServer({
-    name: "opengeni",
-    version: "1.0.0"
-  });
   const json = (value) => ({
     content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
   });
   const can = (permission) => hasPermission2(grant.permissions, permission);
   const toolspaceMode = options.toolspace != null;
   const sessionId = typeof grant.metadata?.["sessionId"] === "string" ? grant.metadata["sessionId"] : null;
+  const selectedTools = sessionId !== null && !toolspaceMode ? new Set(
+    grant.metadata?.["firstPartyMcpTools"] ?? DEFAULT_FIRST_PARTY_MCP_TOOLS
+  ) : null;
+  const server = new PolicyMcpServer(grant, sessionId, selectedTools, toolspaceMode);
   if (sessionId !== null && (!toolspaceMode || can("sessions:control"))) {
     server.registerTool(
       "set_session_title",
@@ -2580,44 +2767,6 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
       registerGitHubTokenTool(server, deps, grant, sessionId, json);
     }
   }
-  if (!toolspaceMode || can("files:read")) {
-    server.registerTool(
-      "files_get_download_url",
-      {
-        description: "Create a short-lived download URL for a ready file asset.",
-        inputSchema: { fileId: z4.string().uuid() }
-      },
-      async ({ fileId }) => {
-        if (!deps.objectStorage) {
-          throw new Error("object storage is not configured");
-        }
-        const file = await requireFile(deps.db, grant.workspaceId, fileId);
-        if (file.status !== "ready") {
-          throw new Error(`file is ${file.status}`);
-        }
-        const signed = await deps.objectStorage.createGetUrl({
-          key: file.objectKey
-        });
-        return json({
-          file: {
-            id: file.id,
-            filename: file.filename,
-            safeFilename: file.safeFilename,
-            contentType: file.contentType,
-            sizeBytes: file.sizeBytes,
-            sha256: file.sha256,
-            status: file.status,
-            createdAt: file.createdAt,
-            updatedAt: file.updatedAt
-          },
-          downloadUrl: {
-            url: signed.url,
-            expiresAt: signed.expiresAt.toISOString()
-          }
-        });
-      }
-    );
-  }
   if (!toolspaceMode || can("github:use")) {
     server.registerTool(
       "github_repositories_list",
@@ -2908,7 +3057,8 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
         await deps.workflowClient.triggerScheduledTask({
           task,
           agentRunUsageIdempotencyKey,
-          triggerWorkflowId
+          triggerWorkflowId,
+          initiator: { kind: "subject", subjectId: grant.subjectId }
         });
         await recordWorkspaceUsage(deps, {
           accountId: grant.accountId,
@@ -2954,6 +3104,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
     );
   }
   registerToolspaceProxyTools(server, options.toolspace ?? null);
+  server.ensureToolsListHandler();
   return server;
 }
 function registerSlackBotTools(server, deps, grant, sessionId, json) {
@@ -3819,6 +3970,9 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           firstPartyMcpPermissions: z4.array(z4.string()).optional().describe(
             "Optional first-party capability set for the child. Omit to inherit this session's effective permissions. An explicit set may only narrow capabilities held by this session. A goal-bearing child requires goals:manage in the resulting set; creation fails rather than adding it implicitly."
           ),
+          firstPartyMcpTools: z4.array(z4.enum(FIRST_PARTY_MCP_TOOL_NAMES)).optional().describe(
+            "Exact model-visible first-party tool selection for the child. Omit to inherit this session's effective selection. This does not grant permissions."
+          ),
           // Shared-sandbox placement (addendum 05 §D). OMIT (default) to SHARE the
           // creator's box — one filesystem/repo/desktop, N independent conversations;
           // this is the SAFE DEFAULT. Pass "new" for a fresh isolated box (a different
@@ -3872,7 +4026,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
     server.registerTool(
       "session_send_message",
       {
-        description: "Send information to another session. From an OpenGeni worker this becomes a coalescible internal update, never a visible prompt-queue row; pending updates are delivered together on the target's next inference. A sessionless operator call appends one visible prompt.",
+        description: "Send information to another session. From an OpenGeni worker this becomes a canonical coalescible machine input: it appears in the target's compact incoming queue group, is durably added to model history when claimed, and remains visible in the timeline. A sessionless operator call appends one human/API prompt.",
         inputSchema: {
           sessionId: z4.string().uuid(),
           text: z4.string().min(1),
@@ -4052,7 +4206,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
       server.registerTool(
         "session_steer",
         {
-          description: "Atomically replace another session's current direction and resume it. The instruction is an internal update, never a human queue row.",
+          description: "Atomically replace another session's current direction and resume it. The Agent Steer is a typed machine input shown in the target queue/timeline and durably retained in model history; it never impersonates a human prompt.",
           inputSchema: {
             sessionId: z4.string().uuid(),
             instruction: z4.string().min(1),
@@ -5290,7 +5444,15 @@ function connectionBrokerFetch(baseFetch, input) {
   if (!connectionRef) {
     return baseFetch;
   }
-  const resolveCredential = input.deps.connectionCredentials?.mcpCredentials ? buildHostConnectionTokenResolver(input.deps.connectionCredentials.mcpCredentials, {
+  const credentialSubjectId = input.turn.initiator.kind === "subject" ? input.turn.initiator.subjectId : void 0;
+  if (connectionRef.subjectScope === "subject" && !credentialSubjectId) {
+    throw new Error(
+      `subject-owned connection for MCP server ${input.config.id} requires a human turn initiator`
+    );
+  }
+  const hostCredentialPort = input.deps.connectionCredentials?.mcpCredentials;
+  const resolverSubjectId = hostCredentialPort ? input.grant.subjectId : credentialSubjectId;
+  const resolveCredential = hostCredentialPort ? buildHostConnectionTokenResolver(hostCredentialPort, {
     accountId: input.grant.accountId,
     workspaceId: input.grant.workspaceId,
     sessionId: input.sessionId,
@@ -5312,7 +5474,7 @@ function connectionBrokerFetch(baseFetch, input) {
       destinationUrl,
       forceRefresh: false,
       ...request.toolName ? { toolName: request.toolName } : {},
-      subjectId: input.grant.subjectId
+      ...resolverSubjectId ? { subjectId: resolverSubjectId } : {}
     });
     if (first.status === "auth_needed") {
       return await authNeededFetchResponse(input, request, first);
@@ -5330,7 +5492,7 @@ function connectionBrokerFetch(baseFetch, input) {
         destinationUrl,
         forceRefresh: true,
         ...request.toolName ? { toolName: request.toolName } : {},
-        subjectId: input.grant.subjectId
+        ...resolverSubjectId ? { subjectId: resolverSubjectId } : {}
       });
       if (refreshed.status === "auth_needed") {
         return await authNeededFetchResponse(input, request, refreshed);
@@ -5614,7 +5776,7 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/github/setup" || path === "/v1/github/install/callback" || path === "/v1/github/oauth/callback" || path === "/v1/github/app-manifest/callback") {
     return true;
   }
-  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json") {
+  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json" || path === "/v1/integrations/slack/callback") {
     return true;
   }
   if (path.startsWith("/v1/catalog-assets/")) {
@@ -5796,8 +5958,8 @@ function registerCatalogAssetRoutes(app, deps) {
     if (!contentType) {
       throw new HTTPException5(404, { message: "asset not found" });
     }
-    const object4 = await objectStorage.getObjectBytes(key);
-    if (!object4) {
+    const object5 = await objectStorage.getObjectBytes(key);
+    if (!object5) {
       throw new HTTPException5(404, { message: "asset not found" });
     }
     const etag = etagForKey(key);
@@ -5810,7 +5972,7 @@ function registerCatalogAssetRoutes(app, deps) {
     if (ifNoneMatchSatisfied(c.req.header("if-none-match"), etag)) {
       return c.body(null, 304, headers);
     }
-    return c.body(new Uint8Array(object4.bytes), 200, { ...headers, "Content-Type": contentType });
+    return c.body(new Uint8Array(object5.bytes), 200, { ...headers, "Content-Type": contentType });
   });
 }
 function catalogAssetKeyFromPath(pathname) {
@@ -7032,17 +7194,20 @@ function registerCodexRoutes(app, deps) {
 }
 
 // src/routes/connections.ts
+import { createHash as createHash4 } from "crypto";
 import {
-  ConnectOpenGeniSlackBotRequest,
   ConnectionResponse,
   CreateConnectionRequest,
   IntegrationClientMetadata,
   ListConnectionsResponse,
+  OpenGeniSlackBotInstallRequest,
+  OpenGeniSlackBotInstallStart,
   OAuthStartRequest,
   OAuthStartResponse as OAuthStartResponse2,
   UpdateConnectionRequest
 } from "@opengeni/contracts";
 import {
+  hasPermission as hasPermission6,
   hasReservedOpenGeniSlackBotMetadata,
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
@@ -7050,13 +7215,19 @@ import {
   requireEnvironmentEncryption as requireEnvironmentEncryption2
 } from "@opengeni/core";
 import {
+  consumeIntegrationOAuthStateNonce as consumeIntegrationOAuthStateNonce2,
   createConnection as createConnection2,
+  createConnectionWithSlackBotSuccessAudit,
   encryptEnvironmentValue as encryptEnvironmentValue3,
   getConnectionMetadata as getConnectionMetadata2,
+  getWorkspaceGrant as getWorkspaceGrant2,
   listConnectionsMetadata as listConnectionsMetadata2,
-  recordAuditEvent as recordAuditEvent2,
+  recordSlackBotInstallCallbackFailure,
   revokeConnection,
-  updateConnection as updateConnection2
+  revokeConnectionWithSlackBotSuccessAudit,
+  SlackBotLifecycleSuccessAuditError,
+  updateConnection as updateConnection2,
+  updateConnectionWithSlackBotSuccessAudit
 } from "@opengeni/db";
 import { HTTPException as HTTPException9 } from "hono/http-exception";
 
@@ -7065,13 +7236,14 @@ import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { parseIntegrationsOauthClientsJson } from "@opengeni/config";
 import { OAuthStartResponse } from "@opengeni/contracts";
-import { requireEnvironmentEncryption } from "@opengeni/core";
+import { hasPermission as hasPermission5, requireEnvironmentEncryption } from "@opengeni/core";
 import {
   consumeIntegrationOAuthStateNonce,
   createConnection,
   decryptEnvironmentValue,
   encryptEnvironmentValue as encryptEnvironmentValue2,
   getConnectionMetadata,
+  getWorkspaceGrant,
   listConnectionsMetadata,
   loadIntegrationOAuthClient,
   normalizeBearerScheme,
@@ -7104,6 +7276,8 @@ function canonicalProviderDomain(value) {
 // src/integrations/oauth-client.ts
 import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES2 } from "@opengeni/network";
 var oauthStateTtlMs = 10 * 60 * 1e3;
+var OFFICIAL_SLACK_MCP_URL = "https://mcp.slack.com/mcp";
+var SLACK_OAUTH_ORIGIN = "https://slack.com";
 var OAuthCallbackStageError = class extends Error {
   constructor(stage, reason, cause) {
     super(errorMessage(cause));
@@ -7116,9 +7290,10 @@ var OAuthCallbackStageError = class extends Error {
 async function startMcpOAuth(deps, context) {
   const { db, settings } = deps;
   const mcpUrl = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
-  const providerDomain = canonicalProviderDomain(
-    context.payload.providerDomain ?? new URL(mcpUrl).hostname
-  );
+  const officialSlackResource = mcpUrl === OFFICIAL_SLACK_MCP_URL;
+  const providerDomain = officialSlackResource ? "slack.com" : canonicalProviderDomain(context.payload.providerDomain ?? new URL(mcpUrl).hostname);
+  const personalSlack = officialSlackResource || providerDomain === "slack.com";
+  assertPersonalSlackOAuthStart(settings, context.payload, mcpUrl, personalSlack);
   const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
   const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
   const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
@@ -7133,6 +7308,9 @@ async function startMcpOAuth(deps, context) {
     throw new HTTPException8(404, { message: "connection not found" });
   }
   const discovery = await discoverMcpOAuth(mcpUrl, settings);
+  if (personalSlack && !isLocalTestEnvironment(settings.environment)) {
+    assertSlackAuthorizationServer(discovery.as);
+  }
   const resource = discovery.prm.resource ? canonicalOAuthResource(discovery.prm.resource) : mcpUrl;
   const verifier = randomPkceVerifier();
   const authorizeScopes = chooseAuthorizeScopes(
@@ -7200,6 +7378,7 @@ async function completeMcpOAuthCallback(deps, input) {
   }
   try {
     state = readOAuthState(input.state, settings);
+    await requireOAuthCallbackGrant(db, state);
     if (!input.code) {
       return {
         redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" })
@@ -7258,6 +7437,7 @@ async function completeMcpOAuthCallback(deps, input) {
       ...verification.tools ? { mcpTools: verification.tools } : {}
     };
     const credentialEncrypted = encryptEnvironmentValue2(key, JSON.stringify(credential));
+    await requireOAuthCallbackGrant(db, state);
     const connection = await runCallbackStage(
       "persist",
       "persist_failed",
@@ -7266,6 +7446,7 @@ async function completeMcpOAuthCallback(deps, input) {
         connectionId: state.connectionId,
         visibleToSubjectId: state.subjectId,
         expectedVersion: state.connectionVersion,
+        subjectId: state.subjectId,
         providerDomain: state.providerDomain,
         kind: "oauth2",
         status: "active",
@@ -7277,7 +7458,7 @@ async function completeMcpOAuthCallback(deps, input) {
       }) : createConnection(db, {
         accountId: state.accountId,
         workspaceId: state.workspaceId,
-        subjectId: null,
+        subjectId: state.subjectId,
         providerDomain: state.providerDomain,
         kind: "oauth2",
         credentialEncrypted,
@@ -7317,6 +7498,43 @@ function requireIntegrationsStateSecret(settings) {
   }
   return secret;
 }
+async function requireOAuthCallbackGrant(db, state) {
+  const grant = await getWorkspaceGrant(db, state.subjectId, state.workspaceId);
+  if (!grant || grant.accountId !== state.accountId || !hasPermission5(grant.permissions, "connections:write")) {
+    throw new HTTPException8(403, {
+      message: "OAuth subject no longer has permission to write this workspace connection"
+    });
+  }
+}
+function assertPersonalSlackOAuthStart(settings, payload, mcpUrl, personalSlack) {
+  if (!personalSlack) return;
+  if (payload.oauthClient) {
+    throw new HTTPException8(422, {
+      message: "Slack OAuth client credentials are deployment-managed"
+    });
+  }
+  if (payload.providerDomain && canonicalProviderDomain(payload.providerDomain) !== "slack.com") {
+    throw new HTTPException8(422, { message: "Slack provider identity does not match slack.com" });
+  }
+  if (!isLocalTestEnvironment(settings.environment) && mcpUrl !== OFFICIAL_SLACK_MCP_URL) {
+    throw new HTTPException8(422, {
+      message: `personal Slack OAuth must use ${OFFICIAL_SLACK_MCP_URL}`
+    });
+  }
+  if (!settings.slackClientId?.trim() || !settings.slackClientSecret?.trim()) {
+    throw new HTTPException8(503, {
+      message: "personal Slack OAuth requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET"
+    });
+  }
+}
+function assertSlackAuthorizationServer(as) {
+  const urls = [as.issuer, as.authorizationServer, as.authorizationEndpoint, as.tokenEndpoint];
+  if (urls.some((value) => new URL(value).origin !== SLACK_OAUTH_ORIGIN)) {
+    throw new HTTPException8(422, {
+      message: "Slack MCP authorization metadata did not remain bound to slack.com"
+    });
+  }
+}
 async function discoverMcpOAuth(resource, settings) {
   const challenge = await probeMcpChallenge(resource, settings);
   const prm = await discoverProtectedResourceMetadata(
@@ -7553,6 +7771,14 @@ function operatorClientForAs(settings, as) {
   };
 }
 function operatorClientEntryFor(settings, candidates) {
+  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
+  if (normalizedCandidates.has(SLACK_OAUTH_ORIGIN) && settings.slackClientId?.trim() && settings.slackClientSecret?.trim()) {
+    return {
+      clientId: settings.slackClientId.trim(),
+      clientSecret: settings.slackClientSecret.trim(),
+      tokenEndpointAuthMethod: "client_secret_post"
+    };
+  }
   const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
   const exactKeys = uniqueStrings(
     candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)])
@@ -7563,7 +7789,6 @@ function operatorClientEntryFor(settings, candidates) {
       return entry;
     }
   }
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   for (const [key, entry] of Object.entries(configured)) {
     if (normalizedCandidates.has(normalizedIssuerKey(key))) {
       return entry;
@@ -7624,11 +7849,17 @@ async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
 }
 async function existingOAuthConnectionForStart(db, input) {
   if (input.connectionId) {
-    return await getConnectionMetadata(db, input.workspaceId, input.connectionId, input.subjectId);
+    const connection = await getConnectionMetadata(
+      db,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId
+    );
+    return connection?.subjectId === input.subjectId && connection.kind === "oauth2" && connection.providerDomain === input.providerDomain ? connection : null;
   }
   const visible = await listConnectionsMetadata(db, input.workspaceId, input.subjectId);
   return visible.find(
-    (connection) => connection.subjectId === null && connection.kind === "oauth2" && connection.status === "active" && connection.providerDomain === input.providerDomain
+    (connection) => connection.subjectId === input.subjectId && connection.kind === "oauth2" && connection.status === "active" && connection.providerDomain === input.providerDomain
   ) ?? null;
 }
 function buildAuthorizationUrl(input) {
@@ -7695,6 +7926,9 @@ function readOAuthState(state, settings) {
   };
   const connectionId = stringValue(payload.connectionId);
   const connectionVersion = numberValue(payload.connectionVersion);
+  if (Boolean(connectionId) !== Boolean(connectionVersion)) {
+    throw new HTTPException8(400, { message: "invalid OAuth reconnect state" });
+  }
   return {
     ...parsed,
     ...connectionId ? { connectionId } : {},
@@ -8181,8 +8415,10 @@ function requiredString(value, field) {
 // src/routes/connections.ts
 import {
   OPENGENI_SLACK_BOT_CREDENTIAL_LABEL as OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE as OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE as OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+  OPENGENI_SLACK_BOT_REQUIRED_SCOPES as OPENGENI_SLACK_BOT_REQUIRED_SCOPES2
 } from "@opengeni/contracts";
+import { createSignedState as createSignedState4, readSignedState as readSignedState3 } from "@opengeni/github";
 function registerConnectionRoutes(app, deps) {
   const { db, settings, observability } = deps;
   function assertIntegrationsEnabled() {
@@ -8206,11 +8442,13 @@ function registerConnectionRoutes(app, deps) {
     assertNotReservedSlackBotMetadata(payload.metadata);
     const key = requireEnvironmentEncryption2(settings);
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
+    const providerDomain = canonicalProviderDomain(payload.providerDomain);
+    assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
     const connection = await createConnection2(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId,
-      providerDomain: canonicalProviderDomain(payload.providerDomain),
+      providerDomain,
       kind: payload.kind,
       credentialEncrypted: encryptCredentialBundle(key, payload.credential),
       grantedScopes: payload.grantedScopes,
@@ -8220,19 +8458,11 @@ function registerConnectionRoutes(app, deps) {
     });
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
-  app.post("/v1/workspaces/:workspaceId/connections/slack-bot", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/connections/slack-bot/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
-    const payload = ConnectOpenGeniSlackBotRequest.parse(await c.req.json());
-    const verified = await verifyOpenGeniSlackBotCredential(
-      payload.token,
-      deps.slackFetch ?? fetch
-    );
-    const key = requireEnvironmentEncryption2(settings);
-    const credentialEncrypted = encryptCredentialBundle(
-      key,
-      slackBotCredentialBundle(payload.token)
-    );
+    const payload = OpenGeniSlackBotInstallRequest.parse(await c.req.json());
+    const slack = requireOpenGeniSlackOAuthSettings(settings);
     const existing = payload.connectionId ? await getConnectionMetadata2(db, workspaceId, payload.connectionId, grant.subjectId) : null;
     if (payload.connectionId && !existing) {
       throw new HTTPException9(404, { message: "connection not found" });
@@ -8242,69 +8472,119 @@ function registerConnectionRoutes(app, deps) {
         message: "connectionId is not an OpenGeni Slack bot connection"
       });
     }
-    const existingMetadata = existing ? openGeniSlackBotMetadata2(existing.metadata) : null;
-    if (existingMetadata && existingMetadata.slackTeamId !== verified.metadata.slackTeamId) {
-      throw new HTTPException9(409, {
-        message: "a Slack bot connection can only be reinstalled for its original Slack workspace"
-      });
-    }
-    if (existingMetadata && (existingMetadata.botId !== verified.metadata.botId || existingMetadata.botUserId !== verified.metadata.botUserId)) {
-      throw new HTTPException9(409, {
-        message: "a different Slack bot requires a new connection and explicit scheduled-task rebinding"
-      });
-    }
-    const verifiedInstallAt = new Date(verified.metadata.verifiedAt);
-    const connection = existing ? await updateConnection2(db, {
-      workspaceId,
-      connectionId: existing.id,
-      visibleToSubjectId: grant.subjectId,
-      expectedVersion: existing.version,
-      subjectId: null,
-      providerDomain: "slack.com",
-      kind: "app_install",
-      status: "active",
-      credentialEncrypted,
-      grantedScopes: verified.grantedScopes,
-      expiresAt: null,
-      verifiedInstallAt,
-      verifiedInstallVersion: existing.version + 1,
-      metadata: verified.metadata,
-      updatedBySubjectId: grant.subjectId
-    }) : await createConnection2(db, {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
+    const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
+    const returnPath = `/workspaces/${workspaceId}/capabilities`;
+    const state = createSignedState4(requireIntegrationsStateSecret(settings), {
       accountId: grant.accountId,
       workspaceId,
-      subjectId: null,
-      providerDomain: "slack.com",
-      kind: "app_install",
-      credentialEncrypted,
-      grantedScopes: verified.grantedScopes,
-      expiresAt: null,
-      verifiedInstallAt,
-      verifiedInstallVersion: 1,
-      metadata: verified.metadata,
-      createdBySubjectId: grant.subjectId
+      subjectId: grant.subjectId,
+      returnPath,
+      ...existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}
     });
-    if (!connection) {
-      throw new HTTPException9(409, {
-        message: "Slack bot connection changed during reinstall; retry with the current connection"
+    const authorizationUrl = new URL("https://slack.com/oauth/v2/authorize");
+    authorizationUrl.searchParams.set("client_id", slack.clientId);
+    authorizationUrl.searchParams.set("scope", OPENGENI_SLACK_BOT_REQUIRED_SCOPES2.join(","));
+    authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizationUrl.searchParams.set("state", state);
+    return c.json(
+      OpenGeniSlackBotInstallStart.parse({
+        authorizationUrl: authorizationUrl.toString(),
+        expiresAt: new Date(Date.now() + oauthStateTtlMs).toISOString()
+      })
+    );
+  });
+  app.get("/v1/integrations/slack/callback", async (c) => {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
+    let state = null;
+    let stage = "permission_check";
+    try {
+      state = readOpenGeniSlackInstallState(c.req.query("state"), settings);
+      await requireSlackInstallCallbackGrant(db, state);
+      stage = "nonce_consume";
+      const consumed = await consumeIntegrationOAuthStateNonce2(db, {
+        accountId: state.accountId,
+        workspaceId: state.workspaceId,
+        subjectId: state.subjectId,
+        nonce: state.nonce,
+        expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
+        now: /* @__PURE__ */ new Date()
       });
-    }
-    await recordAuditEvent2(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      action: existing ? "slack_bot.reinstalled" : "slack_bot.connected",
-      targetType: "connection",
-      targetId: connection.id,
-      metadata: {
-        credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
-        credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-        connectionId: connection.id,
-        slackTeamId: verified.metadata.slackTeamId,
-        outcome: "succeeded"
+      if (!consumed) {
+        throw new SlackInstallCallbackError(
+          400,
+          "state_replayed",
+          "Slack installation state has already been used"
+        );
       }
-    });
-    return c.json(ConnectionResponse.parse({ connection }), existing ? 200 : 201);
+      if (c.req.query("error")) {
+        stage = "provider_denial";
+        throw new SlackInstallCallbackError(
+          400,
+          "provider_denied",
+          "Slack installation authorization was denied"
+        );
+      }
+      stage = "code_exchange";
+      const code = c.req.query("code");
+      if (!code) {
+        throw new SlackInstallCallbackError(
+          400,
+          "missing_code",
+          "Slack installation callback is missing code"
+        );
+      }
+      const slack = requireOpenGeniSlackOAuthSettings(settings);
+      const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
+      const token = await exchangeOpenGeniSlackAuthorizationCode(
+        {
+          code,
+          clientId: slack.clientId,
+          clientSecret: slack.clientSecret,
+          redirectUri
+        },
+        deps.slackFetch ?? fetch
+      );
+      stage = "credential_verification";
+      const verified = await verifyOpenGeniSlackBotCredential(token, deps.slackFetch ?? fetch);
+      stage = "permission_recheck";
+      await requireSlackInstallCallbackGrant(db, state);
+      stage = "persistence";
+      const connection = await persistOpenGeniSlackBotConnection({
+        deps,
+        state,
+        token,
+        verified
+      });
+      return c.redirect(
+        slackInstallReturnUrl(baseUrl, state.returnPath, "connected", connection.id),
+        302
+      );
+    } catch (error) {
+      if (state) {
+        const failure = slackInstallCallbackFailure(stage, error);
+        try {
+          await recordSlackBotInstallCallbackFailure(db, {
+            accountId: state.accountId,
+            workspaceId: state.workspaceId,
+            subjectId: state.subjectId,
+            callbackDigest: createHash4("sha256").update(state.nonce).digest("hex"),
+            installMode: state.connectionId ? "reinstall" : "connect",
+            ...failure
+          });
+        } catch {
+          return c.redirect(
+            slackInstallReturnUrl(baseUrl, state.returnPath, "error", "installation_failed"),
+            302
+          );
+        }
+      }
+      const reason = slackInstallErrorReason(error);
+      return c.redirect(
+        slackInstallReturnUrl(baseUrl, state?.returnPath ?? "/integrations", "error", reason),
+        302
+      );
+    }
   });
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -8336,6 +8616,12 @@ function registerConnectionRoutes(app, deps) {
         message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection"
       });
     }
+    if (existing) {
+      assertNotDirectPersonalSlackOAuth(
+        canonicalProviderDomain(payload.providerDomain ?? existing.providerDomain),
+        payload.kind ?? existing.kind
+      );
+    }
     if (payload.status !== void 0) {
       if (payload.status !== "active") {
         throw new HTTPException9(400, {
@@ -8371,33 +8657,24 @@ function registerConnectionRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    const connectionId = c.req.param("connectionId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
-    const connection = await revokeConnection(
-      db,
-      workspaceId,
-      c.req.param("connectionId"),
-      grant.subjectId
-    );
-    if (!connection) {
+    const existing = await getConnectionMetadata2(db, workspaceId, connectionId, grant.subjectId);
+    if (!existing) {
       throw new HTTPException9(404, { message: "connection not found" });
     }
-    if (isOpenGeniSlackBotConnection(connection)) {
-      const metadata = openGeniSlackBotMetadata2(connection.metadata);
-      await recordAuditEvent2(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        action: "slack_bot.disconnected",
-        targetType: "connection",
-        targetId: connection.id,
-        metadata: {
-          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
-          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-          connectionId: connection.id,
-          slackTeamId: metadata.slackTeamId,
-          outcome: "succeeded"
-        }
-      });
+    const connection = isOpenGeniSlackBotConnection(existing) ? await revokeConnectionWithSlackBotSuccessAudit(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      connectionId,
+      expectedVersion: existing.version,
+      credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+      credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+      slackTeamId: openGeniSlackBotMetadata2(existing.metadata).slackTeamId
+    }) : await revokeConnection(db, workspaceId, connectionId, grant.subjectId);
+    if (!connection) {
+      throw new HTTPException9(409, { message: "connection changed during disconnect; try again" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -8451,6 +8728,222 @@ function registerConnectionRoutes(app, deps) {
     );
   });
 }
+async function persistOpenGeniSlackBotConnection(input) {
+  const { db, settings } = input.deps;
+  const key = requireEnvironmentEncryption2(settings);
+  const credentialEncrypted = encryptCredentialBundle(key, slackBotCredentialBundle(input.token));
+  const existing = input.state.connectionId ? await getConnectionMetadata2(
+    db,
+    input.state.workspaceId,
+    input.state.connectionId,
+    input.state.subjectId
+  ) : null;
+  if (input.state.connectionId && !existing) {
+    throw new SlackInstallCallbackError(
+      404,
+      "connection_conflict",
+      "connection not found",
+      "principal_validation"
+    );
+  }
+  if (existing && !isOpenGeniSlackBotConnection(existing)) {
+    throw new SlackInstallCallbackError(
+      422,
+      "connection_conflict",
+      "connectionId is not an OpenGeni Slack bot connection",
+      "principal_validation"
+    );
+  }
+  if (existing?.version !== input.state.connectionVersion) {
+    throw new SlackInstallCallbackError(
+      409,
+      "connection_conflict",
+      "Slack bot connection changed during reinstall; start again",
+      "principal_validation"
+    );
+  }
+  const existingMetadata = existing ? openGeniSlackBotMetadata2(existing.metadata) : null;
+  if (existingMetadata && existingMetadata.slackTeamId !== input.verified.metadata.slackTeamId) {
+    throw new SlackInstallCallbackError(
+      409,
+      "principal_mismatch",
+      "a Slack bot connection can only be reinstalled for its original Slack workspace",
+      "principal_validation"
+    );
+  }
+  if (existingMetadata && (existingMetadata.botId !== input.verified.metadata.botId || existingMetadata.botUserId !== input.verified.metadata.botUserId)) {
+    throw new SlackInstallCallbackError(
+      409,
+      "principal_mismatch",
+      "a different Slack bot requires a new connection and explicit scheduled-task rebinding",
+      "principal_validation"
+    );
+  }
+  const verifiedInstallAt = new Date(input.verified.metadata.verifiedAt);
+  const lifecycleAudit = {
+    accountId: input.state.accountId,
+    workspaceId: input.state.workspaceId,
+    subjectId: input.state.subjectId,
+    credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+    credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+    slackTeamId: input.verified.metadata.slackTeamId
+  };
+  const connection = existing ? await updateConnectionWithSlackBotSuccessAudit(db, {
+    ...lifecycleAudit,
+    connection: {
+      workspaceId: input.state.workspaceId,
+      connectionId: existing.id,
+      visibleToSubjectId: input.state.subjectId,
+      expectedVersion: existing.version,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      status: "active",
+      credentialEncrypted,
+      grantedScopes: input.verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: existing.version + 1,
+      metadata: input.verified.metadata,
+      updatedBySubjectId: input.state.subjectId
+    }
+  }) : await createConnectionWithSlackBotSuccessAudit(db, {
+    ...lifecycleAudit,
+    connection: {
+      accountId: input.state.accountId,
+      workspaceId: input.state.workspaceId,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      credentialEncrypted,
+      grantedScopes: input.verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: 1,
+      metadata: input.verified.metadata,
+      createdBySubjectId: input.state.subjectId
+    }
+  });
+  if (!connection) {
+    throw new SlackInstallCallbackError(
+      409,
+      "connection_conflict",
+      "Slack bot connection changed during reinstall; start again",
+      "principal_validation"
+    );
+  }
+  return connection;
+}
+function requireOpenGeniSlackOAuthSettings(settings) {
+  const clientId = settings.slackClientId?.trim();
+  const clientSecret = settings.slackClientSecret?.trim();
+  if (!clientId || !clientSecret) {
+    throw new HTTPException9(503, {
+      message: "OpenGeni Slack installation requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET"
+    });
+  }
+  return { clientId, clientSecret };
+}
+function readOpenGeniSlackInstallState(rawState, settings) {
+  if (!rawState) {
+    throw new HTTPException9(400, { message: "missing Slack installation state" });
+  }
+  const payload = readSignedState3(rawState, requireIntegrationsStateSecret(settings));
+  if (!payload) {
+    throw new HTTPException9(400, { message: "invalid or expired Slack installation state" });
+  }
+  const requiredString2 = (value, label) => {
+    if (typeof value !== "string" || value.length === 0) {
+      throw new HTTPException9(400, { message: `invalid Slack installation ${label}` });
+    }
+    return value;
+  };
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  if (typeof payload.iat !== "number" || nowSeconds < payload.iat || nowSeconds - payload.iat > oauthStateTtlMs / 1e3) {
+    throw new HTTPException9(400, { message: "invalid or expired Slack installation state" });
+  }
+  const accountId = requiredString2(payload.accountId, "account");
+  const workspaceId = requiredString2(payload.workspaceId, "workspace");
+  const subjectId = requiredString2(payload.subjectId, "subject");
+  const returnPath = requiredString2(payload.returnPath, "return path");
+  if (returnPath !== `/workspaces/${workspaceId}/capabilities`) {
+    throw new HTTPException9(400, { message: "invalid Slack installation return path" });
+  }
+  const connectionId = typeof payload.connectionId === "string" ? payload.connectionId : void 0;
+  const connectionVersion = typeof payload.connectionVersion === "number" && Number.isInteger(payload.connectionVersion) ? payload.connectionVersion : void 0;
+  if (Boolean(connectionId) !== Boolean(connectionVersion)) {
+    throw new HTTPException9(400, { message: "invalid Slack reinstall state" });
+  }
+  return {
+    accountId,
+    workspaceId,
+    subjectId,
+    returnPath,
+    ...connectionId ? { connectionId, connectionVersion } : {},
+    nonce: requiredString2(payload.nonce, "nonce"),
+    iat: typeof payload.iat === "number" ? payload.iat : (() => {
+      throw new HTTPException9(400, { message: "invalid Slack installation timestamp" });
+    })()
+  };
+}
+function slackInstallReturnUrl(baseUrl, returnPath, status, detail) {
+  const url = new URL(returnPath, `${baseUrl}/`);
+  url.searchParams.set("slack", status);
+  url.searchParams.set(status === "connected" ? "connectionId" : "reason", detail.slice(0, 128));
+  return url.toString();
+}
+var SlackInstallCallbackError = class extends HTTPException9 {
+  constructor(status, failureReason, message, failureStage) {
+    super(status, { message });
+    this.failureReason = failureReason;
+    this.failureStage = failureStage;
+    this.name = "SlackInstallCallbackError";
+  }
+};
+function slackInstallCallbackFailure(stage, error) {
+  if (error instanceof SlackInstallCallbackError) {
+    return { stage: error.failureStage ?? stage, reason: error.failureReason };
+  }
+  if (error instanceof SlackBotCredentialVerificationError) {
+    return { stage: "credential_verification", reason: error.failureReason };
+  }
+  if (error instanceof SlackBotLifecycleSuccessAuditError) {
+    return { stage: "persistence", reason: "success_audit_failed" };
+  }
+  if (stage === "code_exchange") {
+    return { stage, reason: "exchange_failed" };
+  }
+  if (stage === "credential_verification") {
+    return { stage, reason: "credential_verification_failed" };
+  }
+  return { stage, reason: "persistence_failed" };
+}
+function slackInstallErrorReason(error) {
+  if (error instanceof SlackInstallCallbackError && error.failureReason === "provider_denied") {
+    return "provider_denied";
+  }
+  if (error instanceof HTTPException9) {
+    return `http_${error.status}`;
+  }
+  return "installation_failed";
+}
+async function requireSlackInstallCallbackGrant(db, state) {
+  const grant = await getWorkspaceGrant2(db, state.subjectId, state.workspaceId);
+  if (!grant || grant.accountId !== state.accountId || !hasPermission6(grant.permissions, "connections:write")) {
+    throw new SlackInstallCallbackError(
+      403,
+      "permission_lost",
+      "Slack installation subject no longer has permission for this workspace"
+    );
+  }
+}
+function assertNotDirectPersonalSlackOAuth(providerDomain, kind) {
+  if (providerDomain === "slack.com" && kind === "oauth2") {
+    throw new HTTPException9(422, {
+      message: "personal Slack credentials must use the hosted MCP OAuth flow"
+    });
+  }
+}
 function assertNotReservedSlackBotMetadata(metadata) {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException9(422, {
@@ -8515,7 +9008,7 @@ import {
   queueDocumentForReindex,
   searchDocuments as searchDocuments2
 } from "@opengeni/documents";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { HTTPException as HTTPException11 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
@@ -8746,8 +9239,90 @@ import {
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// src/mcp/files.ts
+import { requireFile } from "@opengeni/db";
+import { hasPermission as hasPermission7 } from "@opengeni/core";
+import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as z3 from "zod/v4";
+function buildFilesMcpServer(deps, grant) {
+  const server = new McpServer3({
+    name: "opengeni-files",
+    version: "1.0.0"
+  });
+  if (!hasPermission7(grant.permissions, "files:read")) {
+    server.registerTool(
+      "__opengeni_empty_files_surface__",
+      {
+        description: "Internal disabled placeholder for an unauthorized files surface.",
+        inputSchema: z3.object({})
+      },
+      async () => ({
+        content: [{ type: "text", text: '{"unavailable":true}' }]
+      })
+    ).disable();
+    return server;
+  }
+  server.registerTool(
+    "files_get_download_url",
+    {
+      description: "Create a short-lived download URL for a ready file asset.",
+      inputSchema: { fileId: z3.string().uuid() }
+    },
+    async ({ fileId }) => {
+      if (!deps.objectStorage) {
+        throw new Error("object storage is not configured");
+      }
+      const file = await requireFile(deps.db, grant.workspaceId, fileId);
+      if (file.status !== "ready") {
+        throw new Error(`file is ${file.status}`);
+      }
+      const signed = await deps.objectStorage.createGetUrl({ key: file.objectKey });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                file: {
+                  id: file.id,
+                  filename: file.filename,
+                  safeFilename: file.safeFilename,
+                  contentType: file.contentType,
+                  sizeBytes: file.sizeBytes,
+                  sha256: file.sha256,
+                  status: file.status,
+                  createdAt: file.createdAt,
+                  updatedAt: file.updatedAt
+                },
+                downloadUrl: {
+                  url: signed.url,
+                  expiresAt: signed.expiresAt.toISOString()
+                }
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+  return server;
+}
+
+// src/routes/files.ts
 function registerFileRoutes(app, deps) {
   const { db, objectStorage } = deps;
+  app.all("/v1/workspaces/:workspaceId/mcp/files", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "files:read");
+    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    const server = buildFilesMcpServer(deps, grant);
+    await server.connect(transport);
+    return await transport.handleRequest(c.req.raw);
+  });
   app.post("/v1/workspaces/:workspaceId/files/uploads", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "files:upload");
@@ -9556,7 +10131,7 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "documents:search");
     const sessionId = typeof grant.metadata?.sessionId === "string" ? grant.metadata.sessionId : void 0;
-    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    const transport = new WebStandardStreamableHTTPServerTransport2({ enableJsonResponse: true });
     const server = buildDocumentsMcpServer(
       db,
       grant.accountId,
@@ -11236,7 +11811,7 @@ import {
   authorizeGitHubInstallationBinding,
   buildGitHubAppManifest,
   convertGitHubAppManifest,
-  createSignedState as createSignedState4,
+  createSignedState as createSignedState5,
   envLinesFromGitHubManifestConversion,
   GitHubAppApiError,
   GitHubAppConfigurationError as GitHubAppConfigurationError2,
@@ -11245,13 +11820,13 @@ import {
   githubOAuthAuthorizeUrl,
   organizationAppManifestUrl,
   personalAppManifestUrl,
-  readSignedState as readSignedState3,
+  readSignedState as readSignedState4,
   stateMaxAgeSeconds,
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, setCookie } from "hono/cookie";
 import { HTTPException as HTTPException17 } from "hono/http-exception";
-import { hasPermission as hasPermission5, requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
+import { hasPermission as hasPermission8, requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 var githubBindingStateMaxAgeSeconds = 10 * 60;
 var legacyInstallationChooserDisabledMessage = "The legacy repository-admin GitHub installation chooser is disabled; use the GitHub owner-consent connect flow";
@@ -11264,8 +11839,8 @@ function registerGitHubRoutes(app, deps) {
     const slug = settings.githubAppSlug?.trim() || null;
     const installations = missing.length === 0 ? await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId) : [];
     const status = githubBindingStatus(missing.length === 0, installations);
-    const canManage = hasPermission5(grant.permissions, "github:manage");
-    const connectState = missing.length === 0 && slug && canManage ? createSignedState4(githubStateSecret, {
+    const canManage = hasPermission8(grant.permissions, "github:manage");
+    const connectState = missing.length === 0 && slug && canManage ? createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       intent: "installation_authority",
@@ -11290,7 +11865,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || statePayload.workspaceId !== workspaceId || typeof statePayload.accountId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
@@ -11365,7 +11940,7 @@ function registerGitHubRoutes(app, deps) {
       /\/+$/,
       ""
     );
-    const state = createSignedState4(githubStateSecret, {
+    const state = createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId
     });
@@ -11409,7 +11984,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
@@ -11440,7 +12015,7 @@ function registerGitHubRoutes(app, deps) {
         })
       });
     }
-    const oauthState = createSignedState4(githubStateSecret, {
+    const oauthState = createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       installationId,
@@ -11467,7 +12042,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority_oauth" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
@@ -11546,7 +12121,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || statePayload.accountId.length === 0 || statePayload.workspaceId !== workspaceId) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
@@ -12202,7 +12777,8 @@ function registerScheduledTaskRoutes(app, deps) {
     await workflowClient.triggerScheduledTask({
       task,
       agentRunUsageIdempotencyKey,
-      triggerWorkflowId
+      triggerWorkflowId,
+      initiator: { kind: "subject", subjectId: grant.subjectId }
     });
     await recordWorkspaceUsage4(deps, {
       accountId: grant.accountId,
@@ -12342,7 +12918,7 @@ import {
   coalesceSessionEventDeltas,
   publishDurableSessionEvents as publishDurableSessionEvents2
 } from "@opengeni/events";
-import { z as z3, ZodError } from "zod";
+import { z as z5, ZodError } from "zod";
 
 // src/sandbox/channel-a.ts
 import {
@@ -13546,7 +14122,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
-    if (!z3.string().uuid().safeParse(sessionId).success) {
+    if (!z5.string().uuid().safeParse(sessionId).success) {
       throw new HTTPException22(404, { message: "session not found" });
     }
     const session = await getSessionForSubject(
@@ -13565,7 +14141,7 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
-    if (!z3.string().uuid().safeParse(sessionId).success) {
+    if (!z5.string().uuid().safeParse(sessionId).success) {
       throw new HTTPException22(404, { message: "session not found" });
     }
     const parsed = UpdateSessionPinRequest.safeParse(await c.req.json().catch(() => null));
@@ -15265,7 +15841,7 @@ function eventEnumList(raw, schema, name) {
 }
 function sessionListQuery(query, allowCursor = true) {
   const parentSessionId = query.parentSessionId;
-  if (parentSessionId !== void 0 && parentSessionId !== "null" && !z3.string().uuid().safeParse(parentSessionId).success) {
+  if (parentSessionId !== void 0 && parentSessionId !== "null" && !z5.string().uuid().safeParse(parentSessionId).success) {
     throw new HTTPException22(400, {
       message: 'parentSessionId must be a session id or the literal "null"'
     });
@@ -15421,7 +15997,7 @@ import {
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 import { requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
   const { db } = deps;
@@ -15511,7 +16087,7 @@ function parseConnectionIds(raw) {
     return void 0;
   }
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
-  const parsed = z5.array(z5.string().uuid()).safeParse(values);
+  const parsed = z6.array(z6.string().uuid()).safeParse(values);
   if (!parsed.success) {
     throw new HTTPException23(422, {
       message: "connectionIds must be a comma-separated list of UUIDs"
@@ -15572,7 +16148,7 @@ import {
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import { HTTPException as HTTPException24 } from "hono/http-exception";
-import { hasPermission as hasPermission6, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
+import { hasPermission as hasPermission9, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import {
   assertWorkspaceDeletable,
@@ -15819,7 +16395,7 @@ function registerWorkspaceRoutes(app, deps) {
     const context = await requireAccessContext2(c, deps);
     const readableWorkspaceIds = [
       ...new Set(
-        context.workspaceGrants.filter((grant) => hasPermission6(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
+        context.workspaceGrants.filter((grant) => hasPermission9(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
       )
     ];
     if (readableWorkspaceIds.length > 0) {
@@ -16108,8 +16684,8 @@ import {
   WorkspaceInstructionPolicyNotFoundError
 } from "@opengeni/db";
 import { HTTPException as HTTPException25 } from "hono/http-exception";
-import { z as z6 } from "zod";
-var WorkspaceInstructionPolicyRevisionId = z6.string().uuid();
+import { z as z7 } from "zod";
+var WorkspaceInstructionPolicyRevisionId = z7.string().uuid();
 async function parseBody(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
@@ -16609,7 +17185,7 @@ function createApp(deps) {
     }
     const workspace = await getWorkspace2(routeDeps.db, workspaceId);
     const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-    const transport = new WebStandardStreamableHTTPServerTransport2({
+    const transport = new WebStandardStreamableHTTPServerTransport3({
       enableJsonResponse: true
     });
     const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
@@ -16683,7 +17259,7 @@ function createApp(deps) {
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
   const grant = await requireAccessGrant18(c, deps, workspaceId);
-  if (hasPermission7(grant.permissions, "workspace:read")) {
+  if (hasPermission10(grant.permissions, "workspace:read")) {
     return grant;
   }
   if (isToolspaceGrant(deps.settings, grant)) {
@@ -16864,6 +17440,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp\/docs$/,
     label: "/v1/workspaces/:workspaceId/mcp/docs"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/mcp\/files$/,
+    label: "/v1/workspaces/:workspaceId/mcp/files"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/default-rig$/,
     label: "/v1/workspaces/:workspaceId/default-rig"
@@ -17121,8 +17701,8 @@ var routeLabelPatterns = [
     label: "/v1/workspaces/:workspaceId/connections/oauth/start"
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot$/,
-    label: "/v1/workspaces/:workspaceId/connections/slack-bot"
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot\/install$/,
+    label: "/v1/workspaces/:workspaceId/connections/slack-bot/install"
   },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
@@ -17137,6 +17717,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/,
     label: "/v1/integrations/oauth/client-metadata.json"
   },
+  {
+    pattern: /^\/v1\/integrations\/slack\/callback$/,
+    label: "/v1/integrations/slack/callback"
+  },
   {
     pattern: /^\/v1\/enrollments\/device\/start$/,
     label: "/v1/enrollments/device/start"
@@ -17221,4 +17805,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-3JR6L6NJ.js.map
+//# sourceMappingURL=chunk-SD5GJTZ4.js.map