@slashfi/agents-sdk 0.4.0 → 0.6.0

package/dist/server.d.ts

@@ -24,8 +24,8 @@
  * - Populates caller context from headers (X-Atlas-Actor-Id, etc.)
  * - Recognizes the root key for admin access
  */
+import { type SecretStore } from "./agent-definitions/secrets.js";
 import type { AgentRegistry } from "./registry.js";
-import { type SecretStore } from "./secrets.js";
 export interface AgentServerOptions {
     /** Port to listen on (default: 3000) */
     port?: number;
@@ -52,5 +52,32 @@ export interface AgentServer {
     /** Get the server URL (only available after start) */
     url: string | null;
 }
+interface ResolvedAuth {
+    callerId: string;
+    callerType: "agent" | "user" | "system";
+    scopes: string[];
+    isRoot: boolean;
+}
+export interface PendingCollection {
+    /** Partial params already provided by agent */
+    params: Record<string, unknown>;
+    /** Target agent + tool to call after collection */
+    agent: string;
+    tool: string;
+    /** Auth context from original request */
+    auth: ResolvedAuth | null;
+    /** Fields the form needs to collect */
+    fields: Array<{
+        name: string;
+        description?: string;
+        secret: boolean;
+        required: boolean;
+    }>;
+    /** Created timestamp for expiry */
+    createdAt: number;
+}
+export declare const pendingCollections: Map<string, PendingCollection>;
+export declare function generateCollectionToken(): string;
 export declare function createAgentServer(registry: AgentRegistry, options?: AgentServerOptions): AgentServer;
+export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,EAAE,KAAK,WAAW,EAAkD,MAAM,cAAc,CAAC;AAMhG,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iDAAiD;IACjD,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAoOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAiVb"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,KAAK,WAAW,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAgBnD,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iDAAiD;IACjD,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AA8BD,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAgCD,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,uCAAuC;IACvC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1F,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,kBAAkB,gCAAuC,CAAC;AAEvE,wBAAgB,uBAAuB,IAAI,MAAM,CAOhD;AAqND,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CA8wBb"}

package/dist/server.js

@@ -24,8 +24,48 @@
  * - Populates caller context from headers (X-Atlas-Actor-Id, etc.)
  * - Recognizes the root key for admin access
  */
+import { processSecretParams, } from "./agent-definitions/secrets.js";
 import { verifyJwt } from "./jwt.js";
-import { createInMemorySecretStore, processSecretParams } from "./secrets.js";
+import { renderLoginPage, renderDashboardPage, renderTenantPage } from "./web-pages.js";
+import { slackAuthUrl, exchangeSlackCode, getSlackProfile } from "./slack-oauth.js";
+function resolveBaseUrl(req, url) {
+    const proto = req.headers.get("x-forwarded-proto") || url.protocol.replace(":", "");
+    const host = req.headers.get("x-forwarded-host") || url.host;
+    return `${proto}://${host}`;
+}
+// ============================================
+// Secrets Collection (one-time tokens)
+// ============================================
+function escHtml(s) {
+    return s.replace(/&/g, "\&amp;").replace(/</g, "\&lt;").replace(/>/g, "\&gt;").replace(/"/g, "\&quot;");
+}
+function renderSecretForm(token, pending, baseUrl) {
+    const fields = pending.fields.map(f => `
+    <div class="field">
+      <label>${escHtml(f.name)}${f.secret ? ` <span class="badge">SECRET</span>` : ""}${f.required ? ` <span class="req">*</span>` : ""}</label>
+      ${f.description ? `<p class="desc">${escHtml(f.description)}</p>` : ""}
+      <input type="${f.secret ? "password" : "text"}" name="${escHtml(f.name)}" ${f.required ? "required" : ""} autocomplete="off" />
+    </div>`).join("");
+    return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Secure Setup</title>
+<style>*{box-sizing:border-box;margin:0;padding:0}body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;background:#0d1117;color:#c9d1d9;min-height:100vh;display:flex;align-items:center;justify-content:center}.card{background:#161b22;border:1px solid #30363d;border-radius:12px;padding:32px;max-width:480px;width:100%}.header{display:flex;align-items:center;gap:12px;margin-bottom:8px}.lock{font-size:24px}h1{font-size:20px;font-weight:600}.subtitle{color:#8b949e;font-size:14px;margin-bottom:24px}.shield{display:inline-flex;align-items:center;gap:4px;background:#1a2332;border:1px solid #1f6feb33;color:#58a6ff;font-size:12px;padding:2px 8px;border-radius:12px;margin-bottom:20px}label{display:block;font-size:14px;font-weight:500;margin-bottom:6px}.desc{font-size:12px;color:#8b949e;margin-bottom:4px}.badge{background:#3d1f00;color:#f0883e;font-size:10px;padding:1px 6px;border-radius:4px}.req{color:#f85149}input{width:100%;padding:10px 12px;background:#0d1117;border:1px solid #30363d;border-radius:6px;color:#c9d1d9;font-size:14px;margin-bottom:16px;outline:none}input:focus{border-color:#58a6ff;box-shadow:0 0 0 3px #1f6feb33}button{width:100%;padding:12px;background:#238636;border:none;border-radius:6px;color:#fff;font-size:14px;font-weight:600;cursor:pointer}button:hover{background:#2ea043}button:disabled{opacity:.5;cursor:not-allowed}.footer{text-align:center;margin-top:16px;font-size:12px;color:#484f58}.error{background:#3d1418;border:1px solid #f8514966;color:#f85149;padding:10px 12px;border-radius:6px;font-size:13px;margin-bottom:16px;display:none}.ok{text-align:center;padding:40px 0}.ok .icon{font-size:48px;margin-bottom:12px}.ok h2{font-size:18px;margin-bottom:8px;color:#3fb950}.ok p{color:#8b949e;font-size:14px}.field{position:relative}</style></head><body>
+<div class="card" id="fc"><div class="header"><span class="lock">🔐</span><h1>${escHtml(pending.tool)} on ${escHtml(pending.agent)}</h1></div>
+<p class="subtitle">Enter credentials below. They are encrypted and stored securely — they never pass through the AI.</p>
+<div class="shield">🛡️ End-to-end encrypted</div><div id="err" class="error"></div>
+<form id="f">${fields}<button type="submit">Submit Securely</button></form>
+<p class="footer">Expires in 10 minutes</p></div>
+<div class="card ok" id="ok" style="display:none"><div class="icon">✅</div><h2>Done</h2><p>Credentials stored securely. You can close this window.</p></div>
+<script>document.getElementById("f").addEventListener("submit",async e=>{e.preventDefault();const b=e.target.querySelector("button");b.disabled=true;b.textContent="Submitting...";try{const fd=new FormData(e.target),vals=Object.fromEntries(fd.entries());const r=await fetch("${baseUrl}/secrets/collect",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:"${token}",values:vals})});const d=await r.json();if(d.success){document.getElementById("fc").style.display="none";document.getElementById("ok").style.display="block";}else throw new Error(d.error?.message||JSON.stringify(d));}catch(err){const el=document.getElementById("err");el.textContent=err.message;el.style.display="block";b.disabled=false;b.textContent="Submit Securely";}});</script></body></html>`;
+}
+export const pendingCollections = new Map();
+export function generateCollectionToken() {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    let token = "sc_";
+    for (let i = 0; i < 32; i++) {
+        token += chars[Math.floor(Math.random() * chars.length)];
+    }
+    return token;
+}
 // ============================================
 // Helpers
 // ============================================
@@ -46,7 +86,11 @@ function jsonRpcSuccess(id, result) {
     return { jsonrpc: "2.0", id, result };
 }
 function jsonRpcError(id, code, message, data) {
-    return { jsonrpc: "2.0", id, error: { code, message, ...(data !== undefined && { data }) } };
+    return {
+        jsonrpc: "2.0",
+        id,
+        error: { code, message, ...(data !== undefined && { data }) },
+    };
 }
 /** Wrap a value as MCP tool result content */
 function mcpResult(value, isError = false) {
@@ -81,7 +125,12 @@ async function resolveAuth(req, authConfig) {
     if (scheme?.toLowerCase() !== "bearer" || !credential)
         return null;
     if (credential === authConfig.rootKey) {
-        return { callerId: "root", callerType: "system", scopes: ["*"], isRoot: true };
+        return {
+            callerId: "root",
+            callerType: "system",
+            scopes: ["*"],
+            isRoot: true,
+        };
     }
     // Try JWT verification first (stateless)
     // JWT is signed with the client's secret hash
@@ -126,7 +175,9 @@ async function resolveAuth(req, authConfig) {
     };
 }
 function canSeeAgent(agent, auth) {
-    const visibility = (agent.visibility ?? agent.config?.visibility ?? "internal");
+    const visibility = (agent.visibility ??
+        agent.config?.visibility ??
+        "internal");
     if (auth?.isRoot)
         return true;
     if (visibility === "public")
@@ -189,7 +240,7 @@ function getToolDefinitions() {
 // Create Server
 // ============================================
 export function createAgentServer(registry, options = {}) {
-    const { port = 3000, hostname = "localhost", basePath = "", cors = true, serverName = "agents-sdk", serverVersion = "1.0.0", secretStore = createInMemorySecretStore(), } = options;
+    const { port = 3000, hostname = "localhost", basePath = "", cors = true, serverName = "agents-sdk", serverVersion = "1.0.0", secretStore, } = options;
     let serverInstance = null;
     let serverUrl = null;
     const authConfig = detectAuth(registry);
@@ -248,6 +299,7 @@ export function createAgentServer(registry, options = {}) {
                     req.callerType = "system";
                 }
                 // Process secret params: resolve refs, store raw secrets
+                // Auto-resolve secret:xxx refs in tool params before execution
                 if (req.params && secretStore) {
                     const ownerId = auth?.callerId ?? "anonymous";
                     // Find the tool schema to check for secret: true fields
@@ -270,6 +322,7 @@ export function createAgentServer(registry, options = {}) {
                         name: agent.config?.name,
                         description: agent.config?.description,
                         supportedActions: agent.config?.supportedActions,
+                        integration: agent.config?.integration || null,
                         tools: agent.tools
                             .filter((t) => {
                             const tv = t.visibility ?? "internal";
@@ -314,29 +367,56 @@ export function createAgentServer(registry, options = {}) {
             clientSecret = body.client_secret ?? "";
         }
         if (grantType !== "client_credentials") {
-            return jsonResponse({ error: "unsupported_grant_type", error_description: "Only client_credentials is supported" }, 400);
+            return jsonResponse({
+                error: "unsupported_grant_type",
+                error_description: "Only client_credentials is supported",
+            }, 400);
         }
         if (!clientId || !clientSecret) {
-            return jsonResponse({ error: "invalid_request", error_description: "Missing client_id or client_secret" }, 400);
+            return jsonResponse({
+                error: "invalid_request",
+                error_description: "Missing client_id or client_secret",
+            }, 400);
         }
         const client = await authConfig.store.validateClient(clientId, clientSecret);
         if (!client) {
-            return jsonResponse({ error: "invalid_client", error_description: "Invalid client credentials" }, 401);
+            return jsonResponse({
+                error: "invalid_client",
+                error_description: "Invalid client credentials",
+            }, 401);
         }
-        const tokenString = `at_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`;
-        const now = Date.now();
-        await authConfig.store.storeToken({
-            token: tokenString,
-            clientId: client.clientId,
-            scopes: client.scopes,
-            issuedAt: now,
-            expiresAt: now + authConfig.tokenTtl * 1000,
+        // Delegate to @auth agent's token tool which generates proper JWTs
+        const tokenResult = await registry.call({
+            action: "execute_tool",
+            path: "@auth",
+            tool: "token",
+            params: {
+                grantType: "client_credentials",
+                clientId,
+                clientSecret,
+            },
+            context: {
+                tenantId: "default",
+                agentPath: "@auth",
+                callerId: "oauth_endpoint",
+                callerType: "system",
+            },
         });
+        // Extract the result - registry.call returns { success, result: { accessToken, tokenType, expiresIn, scopes } }
+        const callResponse = tokenResult;
+        if (!callResponse.success) {
+            return jsonResponse({ error: "token_generation_failed", error_description: callResponse.error ?? "Unknown error" }, 500);
+        }
+        const tokenData = callResponse.result;
+        // accessToken may be wrapped as { $agent_type: "secret", value: "<jwt>" }
+        const accessToken = tokenData.accessToken?.$agent_type === "secret"
+            ? tokenData.accessToken.value
+            : tokenData.accessToken;
         return jsonResponse({
-            access_token: tokenString,
-            token_type: "Bearer",
-            expires_in: authConfig.tokenTtl,
-            scope: client.scopes.join(" "),
+            access_token: accessToken,
+            token_type: tokenData.tokenType ?? "Bearer",
+            expires_in: tokenData.expiresIn ?? authConfig.tokenTtl,
+            scope: Array.isArray(tokenData.scopes) ? tokenData.scopes.join(" ") : client.scopes.join(" "),
         });
     }
     // ──────────────────────────────────────────
@@ -389,6 +469,7 @@ export function createAgentServer(registry, options = {}) {
                         name: agent.config?.name,
                         description: agent.config?.description,
                         supportedActions: agent.config?.supportedActions,
+                        integration: agent.config?.integration || null,
                         tools: agent.tools
                             .filter((t) => {
                             const tv = t.visibility ?? "internal";
@@ -404,11 +485,381 @@ export function createAgentServer(registry, options = {}) {
                     })),
                 }));
             }
-            return addCors(jsonResponse({ jsonrpc: "2.0", id: null, error: { code: -32601, message: `Not found: ${req.method} ${path}` } }, 404));
+            // GET /integrations/callback/:provider - OAuth callback
+            if (path.startsWith("/integrations/callback/") && req.method === "GET") {
+                const provider = path.split("/integrations/callback/")[1]?.split("?")[0];
+                if (!provider) {
+                    return addCors(jsonResponse({ error: "Missing provider" }, 400));
+                }
+                const url = new URL(req.url);
+                const code = url.searchParams.get("code");
+                const state = url.searchParams.get("state");
+                const oauthError = url.searchParams.get("error");
+                const errorDescription = url.searchParams.get("error_description");
+                if (oauthError) {
+                    return new Response(`<html><body><h1>Authorization Failed</h1><p>${errorDescription ?? oauthError}</p></body></html>`, { status: 400, headers: { "Content-Type": "text/html", ...corsHeaders() } });
+                }
+                if (!code) {
+                    return addCors(jsonResponse({ error: "Missing authorization code" }, 400));
+                }
+                // Call handle_oauth_callback tool on @integrations
+                try {
+                    await registry.call({
+                        action: "execute_tool",
+                        path: "@integrations",
+                        tool: "handle_oauth_callback",
+                        params: { provider, code, state: state ?? undefined },
+                        context: {
+                            tenantId: "default",
+                            agentPath: "@integrations",
+                            callerId: "oauth_callback",
+                            callerType: "system",
+                        },
+                    });
+                    // Parse redirect URL from state
+                    let redirectUrl = "/";
+                    if (state) {
+                        try {
+                            const parsed = JSON.parse(state);
+                            if (parsed.redirectUrl)
+                                redirectUrl = parsed.redirectUrl;
+                        }
+                        catch { }
+                    }
+                    const sep = redirectUrl.includes("?") ? "&" : "?";
+                    return Response.redirect(`${redirectUrl}${sep}connected=${provider}`, 302);
+                }
+                catch (err) {
+                    return new Response(`<html><body><h1>Connection Failed</h1><p>${err instanceof Error ? err.message : String(err)}</p></body></html>`, { status: 500, headers: { "Content-Type": "text/html", ...corsHeaders() } });
+                }
+            }
+            // GET /secrets/form/:token - Serve hosted secrets form
+            if (path.startsWith("/secrets/form/") && req.method === "GET") {
+                const token = path.split("/").pop() ?? "";
+                const pending = pendingCollections.get(token);
+                if (!pending) {
+                    return addCors(new Response("Invalid or expired form link", { status: 404 }));
+                }
+                if (Date.now() - pending.createdAt > 10 * 60 * 1000) {
+                    pendingCollections.delete(token);
+                    return addCors(new Response("Form link expired", { status: 410 }));
+                }
+                const reqUrl = new URL(req.url);
+                const baseUrl = resolveBaseUrl(req, reqUrl);
+                const html = renderSecretForm(token, pending, baseUrl);
+                return addCors(new Response(html, { headers: { "Content-Type": "text/html" } }));
+            }
+            // POST /secrets/collect - Submit collected secrets and auto-forward to tool
+            if (path === "/secrets/collect" && req.method === "POST") {
+                const body = (await req.json());
+                const pending = pendingCollections.get(body.token);
+                if (!pending) {
+                    return addCors(jsonResponse({ error: "Invalid or expired collection token" }, 400));
+                }
+                // One-time use
+                pendingCollections.delete(body.token);
+                // Check expiry (10 min)
+                if (Date.now() - pending.createdAt > 10 * 60 * 1000) {
+                    return addCors(jsonResponse({ error: "Collection token expired" }, 400));
+                }
+                // Encrypt secret values and store as refs
+                const mergedParams = { ...pending.params };
+                for (const [fieldName, value] of Object.entries(body.values)) {
+                    const fieldDef = pending.fields.find((f) => f.name === fieldName);
+                    if (fieldDef?.secret && secretStore) {
+                        // Store encrypted, get ref
+                        const ownerId = pending.auth?.callerId ?? "anonymous";
+                        const secretId = await secretStore.store(value, ownerId);
+                        mergedParams[fieldName] = `secret:${secretId}`;
+                    }
+                    else {
+                        mergedParams[fieldName] = value;
+                    }
+                }
+                // Auto-forward to the target tool
+                const callRequest = {
+                    action: "execute_tool",
+                    path: pending.agent,
+                    tool: pending.tool,
+                    params: mergedParams,
+                };
+                const toolCtx = {
+                    tenantId: "default",
+                    agentPath: pending.agent,
+                    callerId: pending.auth?.callerId ?? "anonymous",
+                    callerType: pending.auth?.callerType ?? "system",
+                };
+                const result = await registry.call({
+                    ...callRequest,
+                    context: toolCtx,
+                });
+                return addCors(jsonResponse({ success: true, result }));
+            }
+            // --- Web pages (plain HTML, served from same server) ---
+            const htmlRes = (body) => addCors(new Response(body, { headers: { "Content-Type": "text/html; charset=utf-8" } }));
+            const reqUrl = new URL(req.url);
+            const baseUrl = resolveBaseUrl(req, reqUrl);
+            const slackConfig = process.env.SLACK_CLIENT_ID && process.env.SLACK_CLIENT_SECRET
+                ? {
+                    clientId: process.env.SLACK_CLIENT_ID,
+                    clientSecret: process.env.SLACK_CLIENT_SECRET,
+                    redirectUri: `${baseUrl}/auth/slack/callback`,
+                }
+                : null;
+            // Helper: read session from cookie
+            function getSession(r) {
+                const c = r.headers.get("Cookie") || "";
+                const m = c.match(/s_session=([^;]+)/);
+                if (!m)
+                    return null;
+                try {
+                    return JSON.parse(Buffer.from(m[1], "base64url").toString());
+                }
+                catch {
+                    return null;
+                }
+            }
+            // Helper: generate JWT from client credentials
+            async function generateMcpToken() {
+                const clientRes = await registry.call({ action: "execute_tool", path: "@auth", tool: "create_client", callerType: "system", params: {
+                        name: "mcp-" + Date.now(),
+                        scopes: ["*"],
+                    } });
+                const cid = clientRes?.result?.clientId;
+                const csec = clientRes?.result?.clientSecret;
+                if (!cid || !csec)
+                    throw new Error("Failed to create client: " + JSON.stringify(clientRes));
+                const tokenRes = await globalThis.fetch(`http://localhost:${port}/oauth/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({ grant_type: "client_credentials", client_id: cid, client_secret: csec }),
+                });
+                const tokenData = await tokenRes.json();
+                if (!tokenData.access_token)
+                    throw new Error("Failed to get JWT: " + JSON.stringify(tokenData));
+                return tokenData.access_token;
+            }
+            // Helper: set session cookie and redirect
+            function sessionRedirect(location, session) {
+                const data = Buffer.from(JSON.stringify(session)).toString("base64url");
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        Location: location,
+                        "Set-Cookie": `s_session=${data}; Path=/; HttpOnly; SameSite=Lax; Max-Age=604800`,
+                    },
+                });
+            }
+            // GET / — login page (or redirect to dashboard if session exists)
+            if (path === "/" && req.method === "GET") {
+                const session = getSession(req);
+                if (session?.token)
+                    return Response.redirect(`${baseUrl}/dashboard`, 302);
+                return htmlRes(renderLoginPage(baseUrl, !!slackConfig));
+            }
+            // GET /auth/slack — start Slack OAuth
+            if (path === "/auth/slack" && req.method === "GET") {
+                if (!slackConfig)
+                    return htmlRes("<h1>Slack OAuth not configured</h1>");
+                return Response.redirect(slackAuthUrl(slackConfig), 302);
+            }
+            // GET /auth/slack/callback — handle Slack OAuth callback
+            if (path === "/auth/slack/callback" && req.method === "GET") {
+                if (!slackConfig)
+                    return htmlRes("<h1>Slack OAuth not configured</h1>");
+                const authCode = reqUrl.searchParams.get("code");
+                const authError = reqUrl.searchParams.get("error");
+                if (authError || !authCode)
+                    return Response.redirect(`${baseUrl}/?error=${authError || "no_code"}`, 302);
+                try {
+                    const tokens = await exchangeSlackCode(authCode, slackConfig);
+                    const profile = await getSlackProfile(tokens.access_token);
+                    const teamId = profile["https://slack.com/team_id"] || "";
+                    const teamName = profile["https://slack.com/team_name"] || "";
+                    // Check if user already exists
+                    console.log("[auth] Looking up slack user:", profile.sub, profile.email);
+                    const existing = await registry.call({
+                        action: "execute_tool", path: "@users", callerType: "system", tool: "resolve_identity",
+                        params: { provider: "slack", providerUserId: profile.sub },
+                    });
+                    console.log("[auth] resolve_identity:", JSON.stringify(existing));
+                    if (existing?.result?.found && existing?.result?.user?.tenantId) {
+                        // Returning user — generate token and go to dashboard
+                        console.log("[auth] Returning user, generating token...");
+                        const mcpToken = await generateMcpToken();
+                        return sessionRedirect(`${baseUrl}/dashboard`, {
+                            userId: existing.result.user.id,
+                            tenantId: existing.result.user.tenantId,
+                            email: existing.result.user.email,
+                            name: existing.result.user.name,
+                            token: mcpToken,
+                        });
+                    }
+                    // Check if Slack team already has a tenant
+                    if (teamId) {
+                        console.log("[auth] Checking tenant_identities for team:", teamId);
+                        try {
+                            // Direct DB query via the auth store's underlying connection
+                            // We'll use a simple fetch to our own MCP endpoint to call @db-connections
+                            // Actually, simpler: just query the DB directly via the server's context
+                            // For now, use registry.call to a custom tool or direct SQL
+                            // Simplest: call @auth list_tenants and check metadata
+                            // Even simpler: direct SQL via globalThis.fetch to ourselves
+                            const dbUrl = process.env.DATABASE_URL;
+                            if (dbUrl) {
+                                const { default: postgres } = await import("postgres");
+                                const sql = postgres(dbUrl);
+                                const rows = await sql `SELECT tenant_id FROM tenant_identities WHERE provider = 'slack' AND provider_org_id = ${teamId} LIMIT 1`;
+                                await sql.end();
+                                if (rows.length > 0) {
+                                    const existingTenantId = rows[0].tenant_id;
+                                    console.log("[auth] Found existing tenant for team:", existingTenantId);
+                                    // Create user on existing tenant
+                                    const userRes = await registry.call({ action: "execute_tool", path: "@users", callerType: "system", tool: "create_user", params: {
+                                            email: profile.email, name: profile.name, tenantId: existingTenantId,
+                                        } });
+                                    const newUserId = userRes?.result?.id || userRes?.result?.user?.id;
+                                    console.log("[auth] Created user on existing tenant:", newUserId);
+                                    // Link identity
+                                    if (newUserId) {
+                                        await registry.call({ action: "execute_tool", path: "@users", callerType: "system", tool: "link_identity", params: {
+                                                userId: newUserId, provider: "slack", providerUserId: profile.sub,
+                                                email: profile.email, name: profile.name,
+                                                metadata: { slackTeamId: teamId, slackTeamName: teamName },
+                                            } });
+                                    }
+                                    // Generate token and go to dashboard
+                                    const mcpToken = await generateMcpToken();
+                                    return sessionRedirect(`${baseUrl}/dashboard`, {
+                                        userId: newUserId, tenantId: existingTenantId,
+                                        email: profile.email, name: profile.name, token: mcpToken,
+                                    });
+                                }
+                            }
+                        }
+                        catch (e) {
+                            console.error("[auth] tenant_identity lookup error:", e.message);
+                        }
+                    }
+                    // New user — redirect to setup
+                    return sessionRedirect(`${baseUrl}/setup`, {
+                        email: profile.email,
+                        name: profile.name,
+                        picture: profile.picture,
+                        slackUserId: profile.sub,
+                        slackTeamId: teamId,
+                        slackTeamName: teamName,
+                    });
+                }
+                catch (err) {
+                    console.error("[auth] callback error:", err);
+                    return Response.redirect(`${baseUrl}/?error=oauth_failed`, 302);
+                }
+            }
+            // GET /setup — tenant creation page
+            if (path === "/setup" && req.method === "GET") {
+                const session = getSession(req);
+                if (!session?.email)
+                    return Response.redirect(`${baseUrl}/`, 302);
+                return htmlRes(renderTenantPage(baseUrl, session.email, session.name || ""));
+            }
+            // POST /setup — create tenant + user + link identity + generate token
+            if (path === "/setup" && req.method === "POST") {
+                try {
+                    const body = await req.json();
+                    const session = getSession(req);
+                    console.log("[setup] body:", JSON.stringify(body), "session:", JSON.stringify(session));
+                    // 1. Create tenant
+                    const tenantRes = await registry.call({ action: "execute_tool", path: "@auth", callerType: "system", tool: "create_tenant", params: { name: body.tenant } });
+                    const tenantId = tenantRes?.result?.tenantId;
+                    if (!tenantId)
+                        return addCors(jsonResponse({ error: "Failed to create tenant" }, 400));
+                    console.log("[setup] tenant created:", tenantId);
+                    // 2. Create user
+                    const userRes = await registry.call({ action: "execute_tool", path: "@users", callerType: "system", tool: "create_user", params: { email: body.email, name: session?.name, tenantId } });
+                    const userId = userRes?.result?.id || userRes?.result?.user?.id;
+                    console.log("[setup] user created:", userId);
+                    // 2b. Link tenant to Slack team
+                    if (session?.slackTeamId) {
+                        try {
+                            const dbUrl = process.env.DATABASE_URL;
+                            if (dbUrl) {
+                                const { default: postgres } = await import("postgres");
+                                const sql = postgres(dbUrl);
+                                const id = "ti_" + Math.random().toString(36).slice(2, 14);
+                                await sql `INSERT INTO tenant_identities (id, tenant_id, provider, provider_org_id, name) VALUES (${id}, ${tenantId}, 'slack', ${session.slackTeamId}, ${session.slackTeamName || ''})`;
+                                await sql.end();
+                                console.log("[setup] Created tenant_identity for slack team:", session.slackTeamId);
+                            }
+                        }
+                        catch (e) {
+                            console.error("[setup] tenant_identity insert error:", e.message);
+                        }
+                    }
+                    // 3. Link Slack identity
+                    if (session?.slackUserId && userId) {
+                        console.log("[setup] linking slack identity:", session.slackUserId);
+                        const linkRes = await registry.call({ action: "execute_tool", path: "@users", callerType: "system", tool: "link_identity", params: {
+                                userId,
+                                provider: "slack",
+                                providerUserId: session.slackUserId,
+                                email: body.email,
+                                name: session.name,
+                                metadata: { slackTeamId: session.slackTeamId, slackTeamName: session.slackTeamName }, callerType: "system"
+                            } });
+                        console.log("[setup] link_identity result:", JSON.stringify(linkRes));
+                    }
+                    // 4. Generate MCP token
+                    const mcpToken = await generateMcpToken();
+                    console.log("[setup] token generated, length:", mcpToken.length);
+                    return addCors(jsonResponse({ success: true, result: { tenantId, userId, token: mcpToken } }));
+                }
+                catch (err) {
+                    console.error("[setup] error:", err);
+                    return addCors(jsonResponse({ error: err.message }, 400));
+                }
+            }
+            // POST /logout — clear session
+            if (path === "/logout" && req.method === "POST") {
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        Location: `${baseUrl}/`,
+                        "Set-Cookie": "s_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0",
+                    },
+                });
+            }
+            // GET /dashboard — show MCP URL and setup instructions
+            if (path === "/dashboard" && req.method === "GET") {
+                const session = getSession(req);
+                let token = session?.token || reqUrl.searchParams.get("token") || "";
+                if (!token)
+                    return Response.redirect(`${baseUrl}/`, 302);
+                // Persist token in cookie
+                const sessData = Buffer.from(JSON.stringify({ ...session, token })).toString("base64url");
+                return new Response(renderDashboardPage(baseUrl, token, session || undefined), {
+                    headers: {
+                        "Content-Type": "text/html; charset=utf-8",
+                        "Set-Cookie": `s_session=${sessData}; Path=/; HttpOnly; SameSite=Lax; Max-Age=604800`,
+                    },
+                });
+            }
+            return addCors(jsonResponse({
+                jsonrpc: "2.0",
+                id: null,
+                error: {
+                    code: -32601,
+                    message: `Not found: ${req.method} ${path}`,
+                },
+            }, 404));
         }
         catch (err) {
             console.error("[server] Request error:", err);
-            return addCors(jsonResponse({ jsonrpc: "2.0", id: null, error: { code: -32603, message: "Internal error" } }, 500));
+            return addCors(jsonResponse({
+                jsonrpc: "2.0",
+                id: null,
+                error: { code: -32603, message: "Internal error" },
+            }, 500));
         }
     }
     // ──────────────────────────────────────────
@@ -421,14 +872,14 @@ export function createAgentServer(registry, options = {}) {
             serverInstance = Bun.serve({ port, hostname, fetch });
             serverUrl = `http://${hostname}:${port}${basePath}`;
             console.log(`Agent server running at ${serverUrl}`);
-            console.log(`  POST /     - MCP JSON-RPC endpoint`);
-            console.log(`  POST /mcp  - MCP JSON-RPC endpoint (alias)`);
-            console.log(`  GET  /health - Health check`);
+            console.log("  POST /     - MCP JSON-RPC endpoint");
+            console.log("  POST /mcp  - MCP JSON-RPC endpoint (alias)");
+            console.log("  GET  /health - Health check");
             if (authConfig) {
-                console.log(`  POST /oauth/token - OAuth2 token endpoint`);
+                console.log("  POST /oauth/token - OAuth2 token endpoint");
                 console.log("  Auth: enabled");
             }
-            console.log(`  MCP tools: call_agent, list_agents`);
+            console.log("  MCP tools: call_agent, list_agents");
         },
         async stop() {
             if (serverInstance) {