amalgm 0.0.0 → 0.0.1

package/runtime/scripts/amalgm-mcp/server/http.js

@@ -0,0 +1,335 @@
+/**
+ * HTTP server — routes + lifecycle.
+ *
+ * Route table:
+ *   GET  /healthz                     → stats snapshot
+ *   *    /mcp                         → MCP streamable-HTTP (delegated to SDK transport)
+ *   POST /events                      → webhook ingress (signature match + agent run)
+ *   GET  /events                      → recent events (in-memory ring buffer)
+ *   GET  /tasks/list                  → list tasks
+ *   POST /tasks/create                → create task
+ *   POST /tasks/update                → update task
+ *   POST /tasks/delete                → delete task
+ *   POST /tasks/run-now               → run task immediately
+ *   GET  /event-triggers/list         → list triggers
+ *   POST /event-triggers/{create,update,delete}
+ *   GET  /workspace/projects          → list projects
+ *   POST /github/clone               → clone repository onto the computer
+ *   GET  /workspace/branches          → list git branches
+ *   POST /workspace/checkout          → checkout git branch
+ *   GET  /workspace/diff              → git diff summary + patch
+ *   GET  /workspace/worktree          → list worktrees
+ *   POST /workspace/worktree          → create worktree
+ *   DELETE /workspace/worktree        → remove worktree
+ *   GET  /fs/list                     → list files
+ *   GET  /fs/read                     → read file
+ *   POST /fs/{write,delete,mkdir,rename}
+ *   GET  /mcp-connections             → list sanitized MCP connections
+ *   POST /mcp-connections             → save/update MCP connection
+ *   DELETE /mcp-connections           → remove MCP connection
+ *   POST /local/init                  → init local computer state
+ *   GET  /local/credentials           → discover local agent auth
+ *   POST /local/credentials/resolve   → resolve spawn env for agent auth
+ *   POST /email/inbound               → run a reply turn for inbound email
+ *   POST /slack/inbound               → run a reply turn for inbound Slack
+ *   GET  /credentials                 → list local Amalgm credential profiles
+ *   POST /credentials                 → save local Amalgm credential profile
+ *   DELETE /credentials               → remove local Amalgm credential profile
+ *   POST /user-api-keys               → legacy save BYOK credential file
+ *   DELETE /user-api-keys             → legacy remove BYOK credential file
+ *   GET  /artifacts/list              → list artifacts
+ *   GET  /artifacts/routes            → artifact DNS routes for tunnel adverts
+ *   POST /artifacts/{register,redeploy,start,stop,connect-dns,disconnect-dns}
+ *   GET  /agents/list                 → list agents
+ *   POST /agents/{get,create,update,delete}
+ */
+
+const http = require('http');
+const { PORT, STORAGE_DIR } = require('../config');
+const { hasSupabase } = require('../lib/supabase');
+const { authorizeRuntimeHttp } = require('../../runtime-auth');
+
+const { loadTasks } = require('../tasks/store');
+const { loadAgents } = require('../agents/store');
+const { loadArtifacts } = require('../artifacts/store');
+const { activeAgentConversations } = require('../agents/talk');
+const { startScheduler, stopScheduler } = require('../tasks/scheduler');
+const { createTransport } = require('./mcp');
+const { handleEventsPost } = require('../events/ingress');
+const eventsRing = require('../events/ring-buffer');
+const eventsRest = require('../events/rest');
+const agentsRest = require('../agents/rest');
+const artifactsRest = require('../artifacts/rest');
+const emailInbound = require('../email/inbound');
+const slackInbound = require('../slack/inbound');
+const fsRest = require('../fs/rest');
+const localRest = require('../local/rest');
+const mcpConnectionsRest = require('../mcp-connections/rest');
+const tasksRest = require('../tasks/rest');
+const userApiKeysRest = require('../user-api-keys/rest');
+const credentialsRest = require('../credentials/rest');
+const workspaceRest = require('../workspace/rest');
+
+function createServer() {
+  return http.createServer(async (req, res) => {
+    if (!authorizeRuntimeHttp(req, res, { exposeHeaders: 'Mcp-Session-Id' })) return;
+
+    async function readJsonBody() {
+      const chunks = [];
+      for await (const chunk of req) chunks.push(chunk);
+      return JSON.parse(Buffer.concat(chunks).toString());
+    }
+    function sendJson(statusCode, data) {
+      res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(data));
+    }
+    function getQuery() {
+      return Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries());
+    }
+
+    try {
+      // ── MCP ─────────────────────────────────────────────────────────────────
+      // Delegate anything under /mcp directly to the SDK transport. A fresh
+      // transport + Server pair is created per request: the stateless
+      // StreamableHTTPServerTransport is single-shot in this mode, so reusing
+      // one across requests would fail on the second call with HTTP 500.
+      if (req.url === '/mcp' || req.url === '/mcp/' || req.url.startsWith('/mcp?')) {
+        const transport = await createTransport();
+        await transport.handleRequest(req, res);
+        return;
+      }
+
+      // ── Health ──────────────────────────────────────────────────────────────
+      if (req.url === '/healthz') {
+        const tasks = loadTasks();
+        const agents = loadAgents();
+        return sendJson(200, {
+          status: 'ok',
+          tasks: tasks.tasks.length,
+          enabledTasks: tasks.tasks.filter((t) => t.enabled).length,
+          artifacts: loadArtifacts().artifacts.length,
+          customAgents: agents.agents.length,
+          activeAgentConversations: activeAgentConversations.size,
+        });
+      }
+
+      // ── /agents (REST, not MCP) ─────────────────────────────────────────────
+      if (req.url === '/agents/list' && req.method === 'GET') {
+        return agentsRest.handleList(sendJson);
+      }
+      if (req.url === '/agents/get' && req.method === 'POST') {
+        return agentsRest.handleGet(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/create' && req.method === 'POST') {
+        return agentsRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/update' && req.method === 'POST') {
+        return agentsRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/delete' && req.method === 'POST') {
+        return agentsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /events — webhook ingress ───────────────────────────────────────────
+      if (req.url === '/events' && req.method === 'POST') {
+        return handleEventsPost(req, sendJson);
+      }
+      if (req.url === '/events' && req.method === 'GET') {
+        return sendJson(200, { events: eventsRing.recent(50) });
+      }
+
+      // ── /tasks REST ─────────────────────────────────────────────────────────
+      if (req.url === '/tasks/list' && req.method === 'GET') {
+        return tasksRest.handleList(sendJson);
+      }
+      if (req.url === '/tasks/create' && req.method === 'POST') {
+        return tasksRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/update' && req.method === 'POST') {
+        return tasksRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/delete' && req.method === 'POST') {
+        return tasksRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/run-now' && req.method === 'POST') {
+        return tasksRest.handleRunNow(await readJsonBody(), sendJson);
+      }
+
+      // ── /event-triggers REST ────────────────────────────────────────────────
+      if (req.url === '/event-triggers/list' && req.method === 'GET') {
+        return eventsRest.handleList(req, sendJson);
+      }
+      if (req.url === '/event-triggers/create' && req.method === 'POST') {
+        return eventsRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/event-triggers/update' && req.method === 'POST') {
+        return eventsRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/event-triggers/delete' && req.method === 'POST') {
+        return eventsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /workspace REST ─────────────────────────────────────────────────────
+      if (req.url === '/workspace/projects' && req.method === 'GET') {
+        return workspaceRest.handleProjects(sendJson);
+      }
+      if (req.url === '/github/clone' && req.method === 'POST') {
+        return workspaceRest.handleClone(await readJsonBody(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/branches') && req.method === 'GET') {
+        return workspaceRest.handleBranches(getQuery(), sendJson);
+      }
+      if (req.url === '/workspace/checkout' && req.method === 'POST') {
+        return workspaceRest.handleCheckout(await readJsonBody(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/diff') && req.method === 'GET') {
+        return workspaceRest.handleDiff(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/worktree') && req.method === 'GET') {
+        return workspaceRest.handleWorktreeList(getQuery(), sendJson);
+      }
+      if (req.url === '/workspace/worktree' && req.method === 'POST') {
+        return workspaceRest.handleWorktreeCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/workspace/worktree' && req.method === 'DELETE') {
+        return workspaceRest.handleWorktreeDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /fs REST ────────────────────────────────────────────────────────────
+      if (req.url.startsWith('/fs/list') && req.method === 'GET') {
+        return fsRest.handleList(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/fs/read') && req.method === 'GET') {
+        return fsRest.handleRead(getQuery(), sendJson);
+      }
+      if (req.url === '/fs/write' && req.method === 'POST') {
+        return fsRest.handleWrite(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/delete' && req.method === 'POST') {
+        return fsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/mkdir' && req.method === 'POST') {
+        return fsRest.handleMkdir(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/rename' && req.method === 'POST') {
+        return fsRest.handleRename(await readJsonBody(), sendJson);
+      }
+
+      // ── /mcp-connections REST ──────────────────────────────────────────────
+      if (req.url === '/mcp-connections' && req.method === 'GET') {
+        return mcpConnectionsRest.handleList(sendJson);
+      }
+      if (req.url === '/mcp-connections' && req.method === 'POST') {
+        return mcpConnectionsRest.handleUpsert(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/mcp-connections' && req.method === 'DELETE') {
+        return mcpConnectionsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /local REST ────────────────────────────────────────────────────────
+      if (req.url === '/local/init' && req.method === 'POST') {
+        return localRest.handleInit(sendJson);
+      }
+      if (req.url === '/local/credentials' && req.method === 'GET') {
+        return localRest.handleCredentials(sendJson);
+      }
+      if (req.url === '/local/credentials/resolve' && req.method === 'POST') {
+        return localRest.handleResolve(await readJsonBody(), sendJson);
+      }
+
+      // ── /credentials REST ─────────────────────────────────────────────────
+      if (req.url === '/credentials' && req.method === 'GET') {
+        return credentialsRest.handleList(sendJson);
+      }
+      if (req.url === '/credentials' && req.method === 'POST') {
+        return credentialsRest.handleSave(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/credentials' && req.method === 'DELETE') {
+        return credentialsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /email REST ────────────────────────────────────────────────────────
+      if (req.url === '/email/inbound' && req.method === 'POST') {
+        return emailInbound.handleEmailInbound(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/slack/inbound' && req.method === 'POST') {
+        return slackInbound.handleSlackInbound(await readJsonBody(), sendJson);
+      }
+
+      // ── /user-api-keys REST ───────────────────────────────────────────────
+      if (req.url === '/user-api-keys' && req.method === 'POST') {
+        return userApiKeysRest.handleSave(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/user-api-keys' && req.method === 'DELETE') {
+        return userApiKeysRest.handleDelete(sendJson);
+      }
+
+      // ── /artifacts REST ────────────────────────────────────────────────────
+      if (req.url === '/artifacts/list' && req.method === 'GET') {
+        return artifactsRest.handleList(sendJson);
+      }
+      if (req.url === '/artifacts/routes' && req.method === 'GET') {
+        return artifactsRest.handleRoutes(sendJson);
+      }
+      if (req.url === '/artifacts/register' && req.method === 'POST') {
+        return artifactsRest.handleRegister(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/redeploy' && req.method === 'POST') {
+        return artifactsRest.handleRedeploy(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/start' && req.method === 'POST') {
+        return artifactsRest.handleStart(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/stop' && req.method === 'POST') {
+        return artifactsRest.handleStop(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/delete' && req.method === 'POST') {
+        return artifactsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/connect-dns' && req.method === 'POST') {
+        return artifactsRest.handleConnectDns(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/disconnect-dns' && req.method === 'POST') {
+        return artifactsRest.handleDisconnectDns(await readJsonBody(), sendJson);
+      }
+
+      res.writeHead(404, { 'Content-Type': 'text/plain' });
+      res.end('Not found');
+    } catch (err) {
+      console.error('[AmalgmMCP] Unhandled error:', err);
+      if (!res.headersSent) sendJson(500, { error: 'Internal server error' });
+    }
+  });
+}
+
+async function listen() {
+  const httpServer = createServer();
+
+  httpServer.listen(PORT, '127.0.0.1', async () => {
+    console.log(`[AmalgmMCP] Listening on 127.0.0.1:${PORT}`);
+    console.log(`[AmalgmMCP] Storage: ${STORAGE_DIR}`);
+    console.log(
+      `[AmalgmMCP] Supabase: ${hasSupabase() ? 'connected' : 'not configured (runs are local-only)'}`,
+    );
+    // Hydrate user model prefs non-blocking (requires Supabase).
+    require('../lib/prefs').hydrateModelPreferences().catch(() => {});
+    startScheduler();
+  });
+
+  // Graceful shutdown. Running tasks get aborted via SIGTERM → process exit;
+  // we don't try to individually abort them here since chat-server owns its own
+  // runtime teardown paths.
+  function shutdown() {
+    console.log('[AmalgmMCP] Shutting down...');
+    stopScheduler();
+    httpServer.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 5000);
+  }
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+
+  return httpServer;
+}
+
+module.exports = { createServer, listen };

package/runtime/scripts/amalgm-mcp/server/mcp.js

@@ -0,0 +1,116 @@
+/**
+ * MCP server — built on @modelcontextprotocol/sdk.
+ *
+ * The SDK handles JSON-RPC framing, protocol-version negotiation, batching,
+ * and streamable-HTTP transport. We just register the two tool handlers.
+ *
+ * Each domain module (tasks, events, notify, agents, browser) exports a flat
+ * array of { name, description, inputSchema, handler }. We concatenate them
+ * into a single TOOLS list, look the tool up by name on each call, and pass
+ * the result through unchanged.
+ */
+
+const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
+const {
+  StreamableHTTPServerTransport,
+} = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+const {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+} = require('@modelcontextprotocol/sdk/types.js');
+
+const { AMALGM_USER_ID } = require('../config');
+const { hasSupabase, supabaseSelect } = require('../lib/supabase');
+const { attachActionDescriptor } = require('../lib/tool-result');
+
+const TOOLS = [
+  ...require('../tasks/tools'),
+  ...require('../events/tools'),
+  ...require('../notify'),
+  ...require('../agents/tools'),
+  ...require('../artifacts/tools'),
+  ...require('../browser/tools'),
+];
+
+/**
+ * Look up the caller's session to tag DB rows with origin metadata. Reads
+ * x-amalgm-session-id from the transport's passed-through HTTP headers.
+ */
+async function buildRequestContext(extra) {
+  const headers = extra?.requestInfo?.headers || {};
+  const h = headers['x-amalgm-session-id'];
+  const callerSessionId = Array.isArray(h) ? h[0] : h || null;
+  const ctx = { callerSessionId };
+
+  if (callerSessionId && hasSupabase()) {
+    const rows = await supabaseSelect(
+      'sessions',
+      `id=eq.${callerSessionId}&user_id=eq.${AMALGM_USER_ID}&select=id,title,harness,metadata`,
+    );
+    const parent = Array.isArray(rows) ? rows[0] : null;
+    if (parent) {
+      ctx.originName = parent.title || undefined;
+      ctx.originHarnessId = parent.harness || undefined;
+      ctx.originBaseHarnessId = parent.metadata?.baseHarnessId || undefined;
+    }
+  }
+  return ctx;
+}
+
+function createMcpServer() {
+  const server = new Server(
+    { name: 'amalgm', version: '1.0.0' },
+    { capabilities: { tools: {} } },
+  );
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOLS.map(({ name, description, inputSchema }) => ({
+      name,
+      description,
+      inputSchema,
+    })),
+  }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    const toolName = request.params?.name;
+    const toolArgs = request.params?.arguments || {};
+    const tool = TOOLS.find((t) => t.name === toolName);
+    if (!tool) {
+      return attachActionDescriptor({
+        content: [{ type: 'text', text: `Unknown tool: ${toolName}` }],
+        isError: true,
+      }, toolName || 'unknown', toolArgs);
+    }
+    const ctx = await buildRequestContext(extra);
+    try {
+      const result = await tool.handler(toolArgs, ctx);
+      return attachActionDescriptor(result, toolName, toolArgs);
+    } catch (err) {
+      return attachActionDescriptor({
+        content: [{ type: 'text', text: `Error: ${err.message}` }],
+        isError: true,
+      }, toolName, toolArgs);
+    }
+  });
+
+  return server;
+}
+
+/**
+ * One stateless streamable-HTTP transport + Server pair. The transport is
+ * reusable across requests because we don't use session IDs or bidirectional
+ * notifications — every tools/list and tools/call is self-contained.
+ */
+async function createTransport() {
+  const server = createMcpServer();
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: undefined,
+    // Return plain JSON responses instead of opening an SSE stream. We don't
+    // emit progress notifications, so there's nothing to stream.
+    enableJsonResponse: true,
+  });
+  await server.connect(transport);
+  return transport;
+}
+
+module.exports = { createTransport, TOOLS };

package/runtime/scripts/amalgm-mcp/slack/inbound.js

@@ -0,0 +1,200 @@
+/**
+ * Slack inbound handoff.
+ *
+ * The api-proxy verifies Slack, resolves/creates the Supabase session, then
+ * forwards a clean Slack payload here. This local route runs the agent through
+ * the same chat-server path as email/tasks/events, then asks the proxy to send
+ * the Slack reply with the bot token that lives outside the local computer.
+ */
+
+const crypto = require('crypto');
+
+const {
+  AMALGM_USER_ID,
+  DEFAULT_CWD,
+  PROXY_BASE_URL,
+  PROXY_TOKEN,
+} = require('../config');
+const { runThroughChatServer } = require('../lib/chat-runner');
+const { ensureFreshProxyToken, readProxyToken } = require('../../proxy-token-store');
+const {
+  hydrateModelPreferences,
+  getSelectedModel,
+  resolveModelSelection,
+  DEFAULT_SELECTED_MODELS,
+} = require('../lib/prefs');
+const { buildLocalMcpServerConfigs } = require('../lib/mcp-resolver');
+const {
+  chatInputToLegacyFields,
+  normalizeChatInput,
+} = require('../../../lib/chatInput');
+const credentialAdapter = require('../../credential-adapter');
+
+function harnessToAgent(harness) {
+  const map = { claude_code: 'claude', codex: 'codex', opencode: 'opencode', pi: 'pi', amp: 'amp', cursor: 'cursor' };
+  return map[harness] || 'claude';
+}
+
+function asString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function isDefaultSessionTitle(title) {
+  return ['', 'New Chat', 'New session', 'New code session'].includes(String(title || '').trim());
+}
+
+function resolveBaseHarness(session) {
+  const metadata = session?.metadata || {};
+  return (
+    asString(metadata.baseHarnessId) ||
+    asString(metadata.harness) ||
+    asString(session?.harness) ||
+    'claude_code'
+  );
+}
+
+function resolveDefaultAuthMethod(baseHarnessId) {
+  if (credentialAdapter.VALID_HARNESS_IDS.includes(baseHarnessId)) {
+    return credentialAdapter.getPersistedAuthMode(baseHarnessId);
+  }
+  return 'amalgm';
+}
+
+async function sendSlackReply({ sessionId, channel, threadTs, message }) {
+  const replyUrl = PROXY_BASE_URL
+    ? `${PROXY_BASE_URL.replace(/\/anthropic\/?$/, '')}/slack/reply`
+    : null;
+  const proxyToken = await ensureFreshProxyToken({ logger: console }) || readProxyToken() || PROXY_TOKEN;
+  if (!replyUrl || !proxyToken) {
+    throw new Error('Slack reply proxy is not configured.');
+  }
+
+  const res = await fetch(replyUrl, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${proxyToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      sessionId,
+      channel,
+      threadTs,
+      text: message,
+    }),
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    throw new Error(`Slack reply proxy failed: ${res.status} ${text.slice(0, 200)}`);
+  }
+  return await res.json().catch(() => ({}));
+}
+
+async function handleSlackInbound(body, sendJson) {
+  const session = body?.session;
+  const inbound = body?.inbound || {};
+  const sessionId = asString(session?.id);
+  const prompt = asString(inbound.text);
+  const channel = asString(inbound.channelId);
+
+  if (!sessionId) return sendJson(400, { error: 'session.id is required' });
+  if (!prompt) return sendJson(400, { error: 'inbound.text is required' });
+  if (!channel) return sendJson(400, { error: 'inbound.channelId is required' });
+
+  await hydrateModelPreferences();
+
+  const metadata = session.metadata || {};
+  const baseHarnessId = resolveBaseHarness(session);
+  const fallbackModelId =
+    asString(metadata.baseModelId) ||
+    getSelectedModel(baseHarnessId) ||
+    DEFAULT_SELECTED_MODELS[baseHarnessId] ||
+    null;
+  const defaultAuthMethod = asString(metadata.authMethod) || resolveDefaultAuthMethod(baseHarnessId);
+  const cwd = asString(metadata.cwd) || DEFAULT_CWD;
+  const computerId = asString(metadata.computerId);
+  const slackSystemPrompt = [
+    asString(metadata.systemPrompt),
+    'You are replying in Slack. Keep responses clear, direct, and Slack-friendly. Use concise Markdown/mrkdwn when helpful.',
+  ].filter(Boolean).join('\n\n');
+
+  const normalizedChatInput = normalizeChatInput({
+    parts: [{ type: 'text', text: prompt }],
+    agent: {
+      harness: baseHarnessId,
+      model: fallbackModelId,
+      authMethod: defaultAuthMethod,
+      customAgentId: asString(metadata.agentId) || null,
+      systemPrompt: slackSystemPrompt || null,
+    },
+    tools: {
+      mcpAppIds: Array.isArray(metadata.mcpAppIds) ? metadata.mcpAppIds : [],
+    },
+    execution: {
+      cwd,
+      computerId,
+    },
+  }, {
+    prompt,
+    harness: baseHarnessId,
+    modelId: fallbackModelId,
+    authMethod: defaultAuthMethod,
+    cwd,
+    computerId,
+    systemPrompt: slackSystemPrompt || undefined,
+    mcpAppIds: Array.isArray(metadata.mcpAppIds) ? metadata.mcpAppIds : [],
+  });
+
+  const legacyChatFields = chatInputToLegacyFields(normalizedChatInput, {
+    prompt,
+    harness: baseHarnessId,
+    modelId: fallbackModelId,
+    authMethod: defaultAuthMethod,
+    cwd,
+    computerId,
+    systemPrompt: slackSystemPrompt || undefined,
+  });
+  const { modelId: uiModelId, cliModel, reasoningEffort } = resolveModelSelection(
+    baseHarnessId,
+    legacyChatFields.modelId || fallbackModelId,
+  );
+  const mcpServers = await buildLocalMcpServerConfigs(legacyChatFields.mcpAppIds || []);
+  const userMessageId = crypto.randomUUID();
+  const assistantMessageId = crypto.randomUUID();
+
+  const { outputText } = await runThroughChatServer({
+    chatInput: normalizedChatInput,
+    prompt: legacyChatFields.prompt,
+    userId: AMALGM_USER_ID || session.user_id,
+    codeSessionId: sessionId,
+    assistantMessageId,
+    userMessageId,
+    userParts: legacyChatFields.userParts,
+    agentId: harnessToAgent(baseHarnessId),
+    modelId: uiModelId,
+    cliModel,
+    ...(reasoningEffort ? { reasoningEffort } : {}),
+    cwd: legacyChatFields.cwd || DEFAULT_CWD,
+    authMethod: legacyChatFields.authMethod || defaultAuthMethod,
+    mcpServers,
+    ...(legacyChatFields.systemPrompt ? { systemPrompt: legacyChatFields.systemPrompt } : {}),
+    ...(!isDefaultSessionTitle(session.title) ? { resumeSessionId: sessionId } : {}),
+    origin: 'slack',
+    originId: inbound.originId || inbound.providerEventId || inbound.ts || null,
+    originName: 'Slack',
+    originHarnessId: session.harness || baseHarnessId,
+    originBaseHarnessId: baseHarnessId,
+  });
+
+  const responseText = outputText.trim() || 'Done.';
+  await sendSlackReply({
+    sessionId,
+    channel,
+    threadTs: asString(inbound.replyThreadTs),
+    message: responseText,
+  });
+
+  return sendJson(200, { ok: true, sessionId, responseLength: responseText.length });
+}
+
+module.exports = { handleSlackInbound };