agor-live 0.23.1 → 0.23.2

package/dist/daemon/mcp/tools/artifacts.js

@@ -14739,11 +14739,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL,
   GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole2,
   ROLES as ROLES2
 } from "@agor/core/types";
@@ -14803,44 +14807,48 @@ var gatewayChannelCreateSchema = external_exports.strictObject({
   agenticConfig: agenticConfigSchema.optional()
 }).superRefine((value, issue2) => {
   const config2 = value.config ?? {};
-  if (value.channelType === "slack") {
-    if (!config2.bot_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "bot_token"],
-        message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-      });
-    }
-    if (config2.connection_mode === "socket" && !config2.app_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "app_token"],
-        message: "config.app_token is required for Slack Socket Mode."
-      });
-    }
-  }
-  if (value.channelType === "github") {
-    for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+  if (value.enabled !== false) {
+    const requiredSecretMessages = {
+      bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+      app_token: "config.app_token is required for Slack Socket Mode.",
+      private_key: "config.private_key is required for GitHub gateway channels.",
+      app_password: "config.app_password is required for Teams gateway channels."
+    };
+    for (const field of getRequiredSecretFields(value.channelType, config2)) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for GitHub gateway channels.`
+          message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
         });
       }
     }
   }
-  if (value.channelType === "teams") {
-    for (const field of ["app_id", "app_password"]) {
+  if (value.channelType === "github") {
+    for (const field of ["app_id", "installation_id", "watch_repos"]) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for Teams gateway channels.`
+          message: `config.${field} is required for GitHub gateway channels.`
         });
       }
     }
   }
+  if (value.channelType === "teams" && !config2.app_id) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["config", "app_id"],
+      message: "config.app_id is required for Teams gateway channels."
+    });
+  }
+  if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["agorUserId"],
+      message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+    });
+  }
 });
 var slackThreadHistorySchema = external_exports.strictObject({
   sessionId: mcpOptionalId(
@@ -14904,6 +14912,23 @@ var gatewayChannelUpdateSchema = external_exports.strictObject({
   ),
   agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
 });
+var slackManifestGenerateSchema = external_exports.strictObject({
+  appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+  botDisplayName: mcpOptionalNonEmptyString(
+    "botDisplayName",
+    "Bot user display name. Defaults to appName."
+  ),
+  publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+  privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+  groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+  alignUsers: external_exports.boolean().default(true).describe(
+    "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+  ),
+  outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+  restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+  )
+});
 
 // src/mcp/tools/knowledge.ts
 import { createHash, randomUUID } from "crypto";
@@ -15442,7 +15467,7 @@ var modelConfigInputSchema = external_exports.union([
 import { ROLES as ROLES4 } from "@agor/core/types";
 
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole2 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole5, MessageRole as MessageRole2, ROLES as ROLES6 } from "@agor/core/types";
 
 // src/utils/append-system-message.ts
 import { generateId as generateId2, SessionRepository as SessionRepository3 } from "@agor/core/db";
@@ -15525,6 +15550,30 @@ var envVarsSubmitSchema = external_exports.object({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole4,
+  ROLES as ROLES5
+} from "@agor/core/types";
+var MAX_TOKEN_LENGTH = 8192;
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+
 // src/mcp/server.ts
 var DEBUG_MCP_REQUESTS = process.env.AGOR_DEBUG_MCP_REQUESTS === "1" || process.env.DEBUG?.includes("mcp-requests");
 function coerceString(value) {

package/dist/daemon/mcp/tools/boards.js

@@ -14752,11 +14752,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL,
   GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole2,
   ROLES as ROLES2
 } from "@agor/core/types";
@@ -14816,44 +14820,48 @@ var gatewayChannelCreateSchema = external_exports.strictObject({
   agenticConfig: agenticConfigSchema.optional()
 }).superRefine((value, issue2) => {
   const config2 = value.config ?? {};
-  if (value.channelType === "slack") {
-    if (!config2.bot_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "bot_token"],
-        message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-      });
-    }
-    if (config2.connection_mode === "socket" && !config2.app_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "app_token"],
-        message: "config.app_token is required for Slack Socket Mode."
-      });
-    }
-  }
-  if (value.channelType === "github") {
-    for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+  if (value.enabled !== false) {
+    const requiredSecretMessages = {
+      bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+      app_token: "config.app_token is required for Slack Socket Mode.",
+      private_key: "config.private_key is required for GitHub gateway channels.",
+      app_password: "config.app_password is required for Teams gateway channels."
+    };
+    for (const field of getRequiredSecretFields(value.channelType, config2)) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for GitHub gateway channels.`
+          message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
         });
       }
     }
   }
-  if (value.channelType === "teams") {
-    for (const field of ["app_id", "app_password"]) {
+  if (value.channelType === "github") {
+    for (const field of ["app_id", "installation_id", "watch_repos"]) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for Teams gateway channels.`
+          message: `config.${field} is required for GitHub gateway channels.`
         });
       }
     }
   }
+  if (value.channelType === "teams" && !config2.app_id) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["config", "app_id"],
+      message: "config.app_id is required for Teams gateway channels."
+    });
+  }
+  if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["agorUserId"],
+      message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+    });
+  }
 });
 var slackThreadHistorySchema = external_exports.strictObject({
   sessionId: mcpOptionalId(
@@ -14917,6 +14925,23 @@ var gatewayChannelUpdateSchema = external_exports.strictObject({
   ),
   agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
 });
+var slackManifestGenerateSchema = external_exports.strictObject({
+  appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+  botDisplayName: mcpOptionalNonEmptyString(
+    "botDisplayName",
+    "Bot user display name. Defaults to appName."
+  ),
+  publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+  privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+  groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+  alignUsers: external_exports.boolean().default(true).describe(
+    "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+  ),
+  outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+  restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+  )
+});
 
 // src/mcp/tools/knowledge.ts
 import { createHash, randomUUID } from "crypto";
@@ -15455,7 +15480,7 @@ var modelConfigInputSchema = external_exports.union([
 import { ROLES as ROLES4 } from "@agor/core/types";
 
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole2 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole5, MessageRole as MessageRole2, ROLES as ROLES6 } from "@agor/core/types";
 
 // src/utils/append-system-message.ts
 import { generateId as generateId2, SessionRepository as SessionRepository3 } from "@agor/core/db";
@@ -15538,6 +15563,30 @@ var envVarsSubmitSchema = external_exports.object({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole4,
+  ROLES as ROLES5
+} from "@agor/core/types";
+var MAX_TOKEN_LENGTH = 8192;
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+
 // src/mcp/server.ts
 var DEBUG_MCP_REQUESTS = process.env.AGOR_DEBUG_MCP_REQUESTS === "1" || process.env.DEBUG?.includes("mcp-requests");
 function coerceString(value) {

package/dist/daemon/mcp/tools/branches.js

@@ -15325,11 +15325,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL,
   GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole2,
   ROLES as ROLES2
 } from "@agor/core/types";
@@ -15389,44 +15393,48 @@ var gatewayChannelCreateSchema = external_exports.strictObject({
   agenticConfig: agenticConfigSchema.optional()
 }).superRefine((value, issue2) => {
   const config2 = value.config ?? {};
-  if (value.channelType === "slack") {
-    if (!config2.bot_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "bot_token"],
-        message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-      });
-    }
-    if (config2.connection_mode === "socket" && !config2.app_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "app_token"],
-        message: "config.app_token is required for Slack Socket Mode."
-      });
-    }
-  }
-  if (value.channelType === "github") {
-    for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+  if (value.enabled !== false) {
+    const requiredSecretMessages = {
+      bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+      app_token: "config.app_token is required for Slack Socket Mode.",
+      private_key: "config.private_key is required for GitHub gateway channels.",
+      app_password: "config.app_password is required for Teams gateway channels."
+    };
+    for (const field of getRequiredSecretFields(value.channelType, config2)) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for GitHub gateway channels.`
+          message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
         });
       }
     }
   }
-  if (value.channelType === "teams") {
-    for (const field of ["app_id", "app_password"]) {
+  if (value.channelType === "github") {
+    for (const field of ["app_id", "installation_id", "watch_repos"]) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for Teams gateway channels.`
+          message: `config.${field} is required for GitHub gateway channels.`
         });
       }
     }
   }
+  if (value.channelType === "teams" && !config2.app_id) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["config", "app_id"],
+      message: "config.app_id is required for Teams gateway channels."
+    });
+  }
+  if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["agorUserId"],
+      message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+    });
+  }
 });
 var slackThreadHistorySchema = external_exports.strictObject({
   sessionId: mcpOptionalId(
@@ -15490,6 +15498,23 @@ var gatewayChannelUpdateSchema = external_exports.strictObject({
   ),
   agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
 });
+var slackManifestGenerateSchema = external_exports.strictObject({
+  appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+  botDisplayName: mcpOptionalNonEmptyString(
+    "botDisplayName",
+    "Bot user display name. Defaults to appName."
+  ),
+  publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+  privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+  groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+  alignUsers: external_exports.boolean().default(true).describe(
+    "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+  ),
+  outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+  restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+  )
+});
 
 // src/mcp/tools/knowledge.ts
 import { createHash, randomUUID } from "crypto";
@@ -16028,7 +16053,7 @@ var modelConfigInputSchema = external_exports.union([
 import { ROLES as ROLES4 } from "@agor/core/types";
 
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole2 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole5, MessageRole as MessageRole2, ROLES as ROLES6 } from "@agor/core/types";
 
 // src/utils/append-system-message.ts
 import { generateId as generateId2, SessionRepository as SessionRepository3 } from "@agor/core/db";
@@ -16111,6 +16136,30 @@ var envVarsSubmitSchema = external_exports.object({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole4,
+  ROLES as ROLES5
+} from "@agor/core/types";
+var MAX_TOKEN_LENGTH = 8192;
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+
 // src/mcp/server.ts
 var DEBUG_MCP_REQUESTS = process.env.AGOR_DEBUG_MCP_REQUESTS === "1" || process.env.DEBUG?.includes("mcp-requests");
 function coerceString(value) {

package/dist/daemon/mcp/tools/card-types.js

@@ -14747,11 +14747,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL,
   GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole2,
   ROLES as ROLES2
 } from "@agor/core/types";
@@ -14811,44 +14815,48 @@ var gatewayChannelCreateSchema = external_exports.strictObject({
   agenticConfig: agenticConfigSchema.optional()
 }).superRefine((value, issue2) => {
   const config2 = value.config ?? {};
-  if (value.channelType === "slack") {
-    if (!config2.bot_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "bot_token"],
-        message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-      });
-    }
-    if (config2.connection_mode === "socket" && !config2.app_token) {
-      issue2.addIssue({
-        code: "custom",
-        path: ["config", "app_token"],
-        message: "config.app_token is required for Slack Socket Mode."
-      });
-    }
-  }
-  if (value.channelType === "github") {
-    for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+  if (value.enabled !== false) {
+    const requiredSecretMessages = {
+      bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+      app_token: "config.app_token is required for Slack Socket Mode.",
+      private_key: "config.private_key is required for GitHub gateway channels.",
+      app_password: "config.app_password is required for Teams gateway channels."
+    };
+    for (const field of getRequiredSecretFields(value.channelType, config2)) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for GitHub gateway channels.`
+          message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
         });
       }
     }
   }
-  if (value.channelType === "teams") {
-    for (const field of ["app_id", "app_password"]) {
+  if (value.channelType === "github") {
+    for (const field of ["app_id", "installation_id", "watch_repos"]) {
       if (!config2[field]) {
         issue2.addIssue({
           code: "custom",
           path: ["config", field],
-          message: `config.${field} is required for Teams gateway channels.`
+          message: `config.${field} is required for GitHub gateway channels.`
         });
       }
     }
   }
+  if (value.channelType === "teams" && !config2.app_id) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["config", "app_id"],
+      message: "config.app_id is required for Teams gateway channels."
+    });
+  }
+  if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["agorUserId"],
+      message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+    });
+  }
 });
 var slackThreadHistorySchema = external_exports.strictObject({
   sessionId: mcpOptionalId(
@@ -14912,6 +14920,23 @@ var gatewayChannelUpdateSchema = external_exports.strictObject({
   ),
   agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
 });
+var slackManifestGenerateSchema = external_exports.strictObject({
+  appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+  botDisplayName: mcpOptionalNonEmptyString(
+    "botDisplayName",
+    "Bot user display name. Defaults to appName."
+  ),
+  publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+  privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+  groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+  alignUsers: external_exports.boolean().default(true).describe(
+    "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+  ),
+  outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+  restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+  )
+});
 
 // src/mcp/tools/knowledge.ts
 import { createHash, randomUUID } from "crypto";
@@ -15450,7 +15475,7 @@ var modelConfigInputSchema = external_exports.union([
 import { ROLES as ROLES4 } from "@agor/core/types";
 
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole2 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole5, MessageRole as MessageRole2, ROLES as ROLES6 } from "@agor/core/types";
 
 // src/utils/append-system-message.ts
 import { generateId as generateId2, SessionRepository as SessionRepository3 } from "@agor/core/db";
@@ -15533,6 +15558,30 @@ var envVarsSubmitSchema = external_exports.object({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole4,
+  ROLES as ROLES5
+} from "@agor/core/types";
+var MAX_TOKEN_LENGTH = 8192;
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+
 // src/mcp/server.ts
 var DEBUG_MCP_REQUESTS = process.env.AGOR_DEBUG_MCP_REQUESTS === "1" || process.env.DEBUG?.includes("mcp-requests");
 function coerceString(value) {