create-loopengine 0.1.61 → 0.1.63

package/dist/cli.js

@@ -199,7 +199,9 @@ function resolveLatestVersionFromNpm(pkg) {
     return execFileSync('npm', ['view', pkg, 'version'], { stdio: 'pipe' }).toString().trim();
 }
 function runRealNpmInstall(projectDir) {
-    execFileSync('npm', ['install'], { cwd: projectDir, stdio: 'pipe' });
+    // --include=dev: with NODE_ENV=production npm would drop devDependencies,
+    // and an older project still lists tsx, which runs it, as one.
+    execFileSync('npm', ['install', '--include=dev'], { cwd: projectDir, stdio: 'pipe' });
 }
 // Only loopengine/actauth/skillgarden — the three packages a scaffolded
 // project's own adapters/http.ts can import directly (see this repo's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-loopengine",
-  "version": "0.1.61",
+  "version": "0.1.63",
   "description": "Scaffold a new loopengine agent project — a runnable HTTP server with one example agent, in your own repo.",
   "license": "MIT",
   "type": "module",

package/template/_gitignore

@@ -2,6 +2,8 @@ node_modules
 dist
 .sessions
 .checkpoints
+# Slack threads matched to their requests (agents/<name>/.messaging).
+.messaging
 .scheduler
 .env
 *.log

package/template/adapters/http.ts

@@ -129,6 +129,10 @@ import {
   replyInSlack,
   slackOutcomeText,
   verifySlackRequest,
+  firstSighting,
+  handleInboundMessage,
+  createSlackConnector,
+  parseSlackEvent,
   removeAgentNotifier,
   saveAgentNotifier,
   testAgentNotifier,
@@ -1568,7 +1572,9 @@ async function handleAbilityInstallDepsPost(req: IncomingMessage, res: ServerRes
     return
   }
   try {
-    await execFileAsync('npm', ['install', ...deps], { cwd: process.cwd(), timeout: NPM_INSTALL_DEPS_TIMEOUT_MS })
+    // --include=dev: under NODE_ENV=production npm would otherwise drop
+    // devDependencies, including tsx, which runs this project.
+    await execFileAsync('npm', ['install', '--include=dev', ...deps], { cwd: process.cwd(), timeout: NPM_INSTALL_DEPS_TIMEOUT_MS })
     res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ installed: deps }))
   } catch (err) {
     const stderr = err && typeof err === 'object' && 'stderr' in err ? String((err as { stderr: unknown }).stderr) : undefined
@@ -2664,7 +2670,7 @@ function captureResponse(): { res: ServerResponse; done: Promise<{ status: numbe
   return { res: res as unknown as ServerResponse, done }
 }
 
-// A Slack app's Interactivity Request URL (core/slack-interactions.ts):
+// A Slack app's Interactivity Request URL (core/messaging/connectors/slack/interactions.ts):
 // Approve/Deny, an answer option, or the "Other…" modal, from a Slack
 // notifier's message. Outside the admin login on purpose — Slack can't
 // send it — and verified with that agent's Slack signing secret instead.
@@ -2703,6 +2709,52 @@ async function handleSlackInteraction(req: IncomingMessage, res: ServerResponse,
   }
 }
 
+// A Slack app's Event Subscriptions Request URL (core/messaging/):
+// a reply in the thread under an approval request or a question, which
+// the agent answers about that request. Outside the admin login like the
+// button endpoint above, and verified with the same signing secret.
+// Slack's URL check is answered before that, since the app is created
+// before its signing secret can be saved here; it only echoes Slack's
+// own challenge back.
+async function handleSlackEvents(req: IncomingMessage, res: ServerResponse, agentName: string): Promise<void> {
+  const rawBody = await readRawBody(req)
+  const entry = getEntry(agentName)
+  if (!entry) {
+    res.writeHead(404, { 'content-type': 'text/plain' }).end('No such agent.')
+    return
+  }
+  const event = parseSlackEvent(rawBody)
+  if (event.type === 'url_verification') {
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ challenge: event.challenge }))
+    return
+  }
+  const { botToken, signingSecret } = slackCredentialsFor(entry.config)
+  if (!signingSecret || !botToken) {
+    res.writeHead(404, { 'content-type': 'text/plain' }).end('No Slack bot token and signing secret are set for this agent.')
+    return
+  }
+  const timestamp = req.headers['x-slack-request-timestamp']
+  const signature = req.headers['x-slack-signature']
+  if (!verifySlackRequest(rawBody, typeof timestamp === 'string' ? timestamp : undefined, typeof signature === 'string' ? signature : undefined, signingSecret)) {
+    res.writeHead(401, { 'content-type': 'text/plain' }).end('Invalid Slack signature.')
+    return
+  }
+  // Slack wants an answer within three seconds; the reply is posted after.
+  res.writeHead(200).end()
+  if (event.type !== 'message' || !firstSighting(event)) return
+  const environment = process.env.LOOPENGINE_ENV ?? 'production'
+  await handleInboundMessage(event, {
+    agentName,
+    agentDir: agentDirFor(entry.config),
+    systemPrompt: entry.config.systemPrompt,
+    connector: createSlackConnector(botToken),
+    createModelCall: () => entry.createModelCall(),
+    getCheckpoint: (pendingId) => checkpoints.get(pendingId),
+    getHistory: (checkpoint) => sessions.getHistory(`${checkpoint.tenant}:${environment}:${checkpoint.agent}:${checkpoint.sessionId}`),
+    plan: process.env.LOOPENGINE_PLAN,
+  })
+}
+
 // Set once shutdown() starts, so /healthz turns 503 while the server
 // drains and a router or load balancer stops sending it new requests.
 let shuttingDown = false
@@ -2717,6 +2769,17 @@ const server = createServer(async (req, res) => {
     return
   }
 
+  const slackEventsMatch = req.method === 'POST' && (req.url ?? '/').split('?')[0].match(/^\/hooks\/slack\/([^/]+)\/events$/)
+  if (slackEventsMatch) {
+    try {
+      await handleSlackEvents(req, res, decodeURIComponent(slackEventsMatch[1]))
+    } catch (err) {
+      console.error('[loopengine] Slack event failed:', err)
+      if (!res.headersSent) res.writeHead(500).end()
+    }
+    return
+  }
+
   const slackHookMatch = req.method === 'POST' && (req.url ?? '/').split('?')[0].match(/^\/hooks\/slack\/([^/]+)$/)
   if (slackHookMatch) {
     try {

package/template/package.json

@@ -9,12 +9,12 @@
     "cli": "tsx adapters/cli.ts"
   },
   "dependencies": {
-    "loopengine": "^0.1.76",
-    "actauth": "^0.0.12"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.0",
+    "loopengine": "^0.1.78",
+    "actauth": "^0.0.12",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0"
   }
 }