create-walle 0.4.1 → 0.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/package.json +1 -1
  2. package/template/README.md +29 -1
  3. package/template/claude-task-manager/server.js +23 -39
  4. package/template/docs/site/guides/configuration.md +56 -26
  5. package/template/docs/site/src/content/docs/guides/configuration.md +56 -25
  6. package/template/wall-e/api-walle.js +6 -2
  7. package/template/wall-e/brain.js +27 -0
  8. package/template/wall-e/tools/slack-mcp.js +83 -90
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "create-walle",
3
- "version": "0.4.1",
3
+ "version": "0.4.3",
4
4
  "description": "Set up Wall-E — your personal digital twin",
5
5
  "bin": {
6
6
  "create-walle": "bin/create-walle.js"
package/template/README.md CHANGED
@@ -56,16 +56,44 @@ The first run auto-creates `.env`, `wall-e-config.json`, and `~/.walle/data/`. F
56
56
 
57
57
  All configuration lives in `.env` (auto-generated on first run). Edit directly or use the browser setup page.
58
58
 
59
+ ### API Authentication
60
+
61
+ Wall-E supports three ways to connect to Claude:
62
+
63
+ **Option A: Direct Anthropic API key**
64
+ ```env
65
+ ANTHROPIC_API_KEY=sk-ant-...
66
+ ```
67
+
68
+ **Option B: Portkey / API gateway**
69
+ ```env
70
+ ANTHROPIC_BASE_URL=https://your-gateway.example.com/v1
71
+ ANTHROPIC_AUTH_TOKEN=sk-ant-api03-unused
72
+ ANTHROPIC_CUSTOM_HEADERS_B64=<base64-encoded headers>
73
+ ```
74
+
75
+ **Option C: Corporate devbox (auto-detected)**
76
+ If you use `devbox ai -c claude`, Wall-E auto-reads your gateway credentials from `~/.devbox/secrets/claude/auth_headers` — no config needed.
77
+
78
+ ### Environment Variables
79
+
59
80
  | Variable | Required | Description |
60
81
  |---|---|---|
61
- | `ANTHROPIC_API_KEY` | Yes | Your Anthropic API key (set via browser setup) |
82
+ | `ANTHROPIC_API_KEY` | Yes* | Anthropic API key or Portkey key |
83
+ | `ANTHROPIC_BASE_URL` | No | API gateway URL (for Portkey, corporate proxies) |
84
+ | `ANTHROPIC_AUTH_TOKEN` | No | Auth token when using a gateway |
85
+ | `ANTHROPIC_CUSTOM_HEADERS_B64` | No | Base64-encoded custom headers (Portkey virtual keys, metadata) |
62
86
  | `WALLE_OWNER_NAME` | Auto | Your name (auto-detected from `git config`) |
87
+ | `CTM_PORT` | No | Dashboard port (default: `3456`) |
88
+ | `WALL_E_PORT` | No | Wall-E API port (default: `CTM_PORT + 1`) |
63
89
  | `WALL_E_DATA_DIR` | No | Data directory (default: `~/.walle/data`) |
64
90
  | `CTM_DATA_DIR` | No | CTM data directory (default: `~/.walle/data`) |
65
91
  | `SLACK_TOKEN` | No | Slack token (set via OAuth — click "Connect" in setup) |
66
92
  | `SLACK_OWNER_USER_ID` | No | Your Slack user ID |
67
93
  | `SLACK_OWNER_HANDLE` | No | Your Slack handle |
68
94
 
95
+ *Not required if using a gateway (`ANTHROPIC_BASE_URL`) or devbox auto-detection.
96
+
69
97
  ## Bundled Skills
70
98
 
71
99
  Wall-E ships with skills that run on a schedule to keep your brain up to date:
package/template/claude-task-manager/server.js CHANGED
@@ -107,26 +107,6 @@ const server = http.createServer((req, res) => {
107
107
  }
108
108
  }
109
109
 
110
- // Slack OAuth callback (browser redirect — no auth token, must be before auth check)
111
- if (url.pathname === '/api/slack/callback' && req.method === 'GET') {
112
- try {
113
- const slackMcp = require('../wall-e/tools/slack-mcp');
114
- const code = url.searchParams.get('code');
115
- const state = url.searchParams.get('state');
116
- slackMcp.handleOAuthCallback(code, state).then(result => {
117
- res.writeHead(200, { 'Content-Type': 'text/html' });
118
- res.end(result.html);
119
- }).catch(err => {
120
- res.writeHead(500, { 'Content-Type': 'text/html' });
121
- res.end('<html><body>OAuth error: ' + err.message + '</body></html>');
122
- });
123
- } catch (e) {
124
- res.writeHead(500, { 'Content-Type': 'text/html' });
125
- res.end('<html><body>Slack module not available: ' + e.message + '</body></html>');
126
- }
127
- return;
128
- }
129
-
130
110
  // API routes
131
111
  if (url.pathname.startsWith('/api/')) {
132
112
  if (!isLocalhost(req)) {
@@ -311,34 +291,38 @@ function handleApi(req, res, url) {
311
291
  const apiKey = typeof data.api_key === 'string'
312
292
  ? data.api_key.replace(/[\r\n\s]/g, '').slice(0, 200)
313
293
  : '';
314
- // Gateway config (corporate Portkey/cybertron setups)
315
- const gw = data.gateway;
294
+ // Gateway config (corporate Portkey/cybertron setups) — sanitize values
295
+ let gw = null;
296
+ if (data.gateway && data.gateway.base_url) {
297
+ gw = {
298
+ base_url: String(data.gateway.base_url).replace(/[\r\n]/g, '').slice(0, 500),
299
+ auth_token: String(data.gateway.auth_token || 'sk-ant-api03-unused').replace(/[\r\n]/g, '').slice(0, 500),
300
+ custom_headers_b64: String(data.gateway.custom_headers_b64 || '').replace(/[\r\n\s]/g, '').slice(0, 2000),
301
+ };
302
+ }
316
303
  // Accept any non-empty key (Anthropic, Portkey, or other providers)
317
304
  const envPath = path.resolve(__dirname, '..', '.env');
318
305
  const lines = [];
319
- // Read existing .env, strip lines we're about to replace
320
- const stripPatterns = [/^#?\s*WALLE_OWNER_NAME=/, /^#?\s*ANTHROPIC_API_KEY=/, /^#?\s*ANTHROPIC_BASE_URL=/, /^#?\s*ANTHROPIC_AUTH_TOKEN=/, /^#?\s*ANTHROPIC_CUSTOM_HEADERS_B64=/];
306
+ // Build set of keys we're about to write
307
+ const keysToReplace = new Set();
308
+ if (ownerName) keysToReplace.add('WALLE_OWNER_NAME');
309
+ if (apiKey) keysToReplace.add('ANTHROPIC_API_KEY');
310
+ if (gw) { keysToReplace.add('ANTHROPIC_BASE_URL'); keysToReplace.add('ANTHROPIC_AUTH_TOKEN'); keysToReplace.add('ANTHROPIC_CUSTOM_HEADERS_B64'); }
311
+ // Read existing .env, keep lines that aren't being replaced
321
312
  try {
322
313
  const existing = fs.readFileSync(envPath, 'utf8');
323
314
  for (const line of existing.split('\n')) {
324
- const shouldStrip = (apiKey || gw) && stripPatterns.some(p => p.test(line));
325
- if (!shouldStrip || (!apiKey && !gw)) lines.push(line);
326
- else if (!ownerName || !line.match(/WALLE_OWNER_NAME/)) {
327
- // Only strip if we have a replacement
328
- if (stripPatterns.some(p => p.test(line))) continue;
329
- lines.push(line);
330
- }
331
- }
332
- // Also strip owner name line if we have a new one
333
- if (ownerName) {
334
- const idx = lines.findIndex(l => /^#?\s*WALLE_OWNER_NAME=/.test(l));
335
- if (idx >= 0) lines.splice(idx, 1);
315
+ const m = line.match(/^\s*#?\s*([A-Z_]+)\s*=/);
316
+ if (m && keysToReplace.has(m[1])) continue; // skip — will re-add below
317
+ lines.push(line);
336
318
  }
337
319
  } catch { lines.push('# Wall-E configuration'); lines.push(''); }
338
- // Add values
320
+ // Strip trailing blank lines
321
+ while (lines.length > 0 && lines[lines.length - 1].trim() === '') lines.pop();
322
+ lines.push('');
323
+ // Add new values
339
324
  if (ownerName) {
340
- const insertIdx = lines.findIndex(l => !l.startsWith('#') && l.trim() !== '') || lines.length;
341
- lines.splice(insertIdx, 0, `WALLE_OWNER_NAME=${ownerName}`);
325
+ lines.push(`WALLE_OWNER_NAME=${ownerName}`);
342
326
  process.env.WALLE_OWNER_NAME = ownerName;
343
327
  }
344
328
  if (gw) {
package/template/docs/site/guides/configuration.md CHANGED
@@ -1,4 +1,3 @@
1
- # Configuration
2
1
 
3
2
  Wall-E is configured through environment variables (`.env` file) and a JSON config file.
4
3
 
@@ -10,43 +9,74 @@ Copy `.env.example` to `.env` at the project root:
10
9
  cp .env.example .env
11
10
  ```
12
11
 
13
- ### Required
12
+ ### API Authentication
14
13
 
15
- | Variable | Description |
16
- |---|---|
17
- | `ANTHROPIC_API_KEY` | Your Anthropic API key. Required for Wall-E chat, think/reflect loops, and agent-mode skills. |
18
- | `WALLE_OWNER_NAME` | Your full name. Used in system prompts and memory attribution. |
14
+ Wall-E needs access to the Claude API. Three options:
19
15
 
20
- ### Data Storage
16
+ **Option A: Direct Anthropic API key**
21
17
 
22
- | Variable | Default | Description |
23
- |---|---|---|
24
- | `WALL_E_DATA_DIR` | `~/.walle/data` | Directory for Wall-E's brain database and backups |
25
- | `CTM_DATA_DIR` | `~/.walle/data` | Directory for CTM's database, images, and backups |
18
+ The simplest setup — get a key from [console.anthropic.com](https://console.anthropic.com/settings/keys):
26
19
 
27
- ### Slack Integration {#slack}
20
+ ```env
21
+ ANTHROPIC_API_KEY=sk-ant-...
22
+ ```
28
23
 
29
- | Variable | Description |
30
- |---|---|
31
- | `SLACK_TOKEN` | Slack user or bot token (starts with `xoxb-` or `xoxp-`) |
32
- | `SLACK_BOT_TOKEN` | Slack bot token (for DM channel) |
33
- | `SLACK_OWNER_USER_ID` | Your Slack user ID (e.g., `U0XXXXXXXX`). Used to detect message direction. |
34
- | `SLACK_OWNER_HANDLE` | Your Slack handle (e.g., `your.name`). Used in search queries. |
24
+ **Option B: Portkey / API gateway**
35
25
 
36
- ### API Gateway
26
+ For teams using [Portkey](https://portkey.ai) or a corporate API gateway:
37
27
 
38
- | Variable | Description |
39
- |---|---|
40
- | `ANTHROPIC_BASE_URL` | Override API endpoint (e.g., for Portkey gateway) |
41
- | `ANTHROPIC_CUSTOM_HEADERS_B64` | Base64-encoded JSON headers for the gateway |
28
+ ```env
29
+ ANTHROPIC_BASE_URL=https://your-gateway.example.com/v1
30
+ ANTHROPIC_AUTH_TOKEN=your-portkey-api-key
31
+ ANTHROPIC_CUSTOM_HEADERS_B64=<base64-encoded custom headers>
32
+ ```
33
+
34
+ The custom headers carry your Portkey virtual key, provider config, and metadata. Encode them as base64:
35
+
36
+ ```bash
37
+ echo -n 'x-portkey-api-key: YOUR_KEY
38
+ x-portkey-provider: anthropic
39
+ x-portkey-virtual-key: YOUR_VIRTUAL_KEY' | base64
40
+ ```
41
+
42
+ **Option C: Corporate devbox (auto-detected)**
43
+
44
+ If your company manages Claude Code via devbox (`devbox ai -c claude`), Wall-E auto-reads the gateway credentials from `~/.devbox/secrets/claude/auth_headers` on startup. No configuration needed.
45
+
46
+ ### Core Settings
47
+
48
+ | Variable | Required | Default | Description |
49
+ |---|---|---|---|
50
+ | `ANTHROPIC_API_KEY` | Yes* | — | Anthropic API key or Portkey key |
51
+ | `ANTHROPIC_BASE_URL` | No | — | API gateway URL (Portkey, corporate proxies) |
52
+ | `ANTHROPIC_AUTH_TOKEN` | No | — | Auth token when using a gateway |
53
+ | `ANTHROPIC_CUSTOM_HEADERS_B64` | No | — | Base64-encoded custom headers (Portkey virtual keys) |
54
+ | `WALLE_OWNER_NAME` | Auto | from `git config` | Your full name |
55
+
56
+ *Not required if using a gateway or devbox auto-detection.
42
57
 
43
58
  ### Server
44
59
 
45
60
  | Variable | Default | Description |
46
61
  |---|---|---|
47
- | `CTM_PORT` | `3456` | CTM HTTP server port |
48
- | `CTM_HOST` | `127.0.0.1` | CTM bind address |
49
- | `WALL_E_PORT` | `3457` | Wall-E standalone HTTP port (when running separately) |
62
+ | `CTM_PORT` | `3456` | Dashboard port |
63
+ | `WALL_E_PORT` | `CTM_PORT + 1` | Wall-E API port |
64
+ | `CTM_HOST` | `127.0.0.1` | Bind address |
65
+
66
+ ### Data Storage
67
+
68
+ | Variable | Default | Description |
69
+ |---|---|---|
70
+ | `WALL_E_DATA_DIR` | `~/.walle/data` | Wall-E's brain database and backups |
71
+ | `CTM_DATA_DIR` | `~/.walle/data` | CTM's database, images, and backups |
72
+
73
+ ### Slack Integration {#slack}
74
+
75
+ | Variable | Description |
76
+ |---|---|
77
+ | `SLACK_TOKEN` | Slack user or bot token (set via OAuth in the setup page) |
78
+ | `SLACK_OWNER_USER_ID` | Your Slack user ID (e.g., `U0XXXXXXXX`) — for message direction detection |
79
+ | `SLACK_OWNER_HANDLE` | Your Slack handle (e.g., `your.name`) — for search queries |
50
80
 
51
81
  ## Wall-E Config File
52
82
 
package/template/docs/site/src/content/docs/guides/configuration.md CHANGED
@@ -14,43 +14,74 @@ Copy `.env.example` to `.env` at the project root:
14
14
  cp .env.example .env
15
15
  ```
16
16
 
17
- ### Required
17
+ ### API Authentication
18
18
 
19
- | Variable | Description |
20
- |---|---|
21
- | `ANTHROPIC_API_KEY` | Your Anthropic API key. Required for Wall-E chat, think/reflect loops, and agent-mode skills. |
22
- | `WALLE_OWNER_NAME` | Your full name. Used in system prompts and memory attribution. |
19
+ Wall-E needs access to the Claude API. Three options:
23
20
 
24
- ### Data Storage
21
+ **Option A: Direct Anthropic API key**
25
22
 
26
- | Variable | Default | Description |
27
- |---|---|---|
28
- | `WALL_E_DATA_DIR` | `~/.walle/data` | Directory for Wall-E's brain database and backups |
29
- | `CTM_DATA_DIR` | `~/.walle/data` | Directory for CTM's database, images, and backups |
23
+ The simplest setup — get a key from [console.anthropic.com](https://console.anthropic.com/settings/keys):
30
24
 
31
- ### Slack Integration {#slack}
25
+ ```env
26
+ ANTHROPIC_API_KEY=sk-ant-...
27
+ ```
32
28
 
33
- | Variable | Description |
34
- |---|---|
35
- | `SLACK_TOKEN` | Slack user or bot token (starts with `xoxb-` or `xoxp-`) |
36
- | `SLACK_BOT_TOKEN` | Slack bot token (for DM channel) |
37
- | `SLACK_OWNER_USER_ID` | Your Slack user ID (e.g., `U0XXXXXXXX`). Used to detect message direction. |
38
- | `SLACK_OWNER_HANDLE` | Your Slack handle (e.g., `your.name`). Used in search queries. |
29
+ **Option B: Portkey / API gateway**
39
30
 
40
- ### API Gateway
31
+ For teams using [Portkey](https://portkey.ai) or a corporate API gateway:
41
32
 
42
- | Variable | Description |
43
- |---|---|
44
- | `ANTHROPIC_BASE_URL` | Override API endpoint (e.g., for Portkey gateway) |
45
- | `ANTHROPIC_CUSTOM_HEADERS_B64` | Base64-encoded JSON headers for the gateway |
33
+ ```env
34
+ ANTHROPIC_BASE_URL=https://your-gateway.example.com/v1
35
+ ANTHROPIC_AUTH_TOKEN=your-portkey-api-key
36
+ ANTHROPIC_CUSTOM_HEADERS_B64=<base64-encoded custom headers>
37
+ ```
38
+
39
+ The custom headers carry your Portkey virtual key, provider config, and metadata. Encode them as base64:
40
+
41
+ ```bash
42
+ echo -n 'x-portkey-api-key: YOUR_KEY
43
+ x-portkey-provider: anthropic
44
+ x-portkey-virtual-key: YOUR_VIRTUAL_KEY' | base64
45
+ ```
46
+
47
+ **Option C: Corporate devbox (auto-detected)**
48
+
49
+ If your company manages Claude Code via devbox (`devbox ai -c claude`), Wall-E auto-reads the gateway credentials from `~/.devbox/secrets/claude/auth_headers` on startup. No configuration needed.
50
+
51
+ ### Core Settings
52
+
53
+ | Variable | Required | Default | Description |
54
+ |---|---|---|---|
55
+ | `ANTHROPIC_API_KEY` | Yes* | — | Anthropic API key or Portkey key |
56
+ | `ANTHROPIC_BASE_URL` | No | — | API gateway URL (Portkey, corporate proxies) |
57
+ | `ANTHROPIC_AUTH_TOKEN` | No | — | Auth token when using a gateway |
58
+ | `ANTHROPIC_CUSTOM_HEADERS_B64` | No | — | Base64-encoded custom headers (Portkey virtual keys) |
59
+ | `WALLE_OWNER_NAME` | Auto | from `git config` | Your full name |
60
+
61
+ *Not required if using a gateway or devbox auto-detection.
46
62
 
47
63
  ### Server
48
64
 
49
65
  | Variable | Default | Description |
50
66
  |---|---|---|
51
- | `CTM_PORT` | `3456` | CTM HTTP server port |
52
- | `CTM_HOST` | `127.0.0.1` | CTM bind address |
53
- | `WALL_E_PORT` | `3457` | Wall-E standalone HTTP port (when running separately) |
67
+ | `CTM_PORT` | `3456` | Dashboard port |
68
+ | `WALL_E_PORT` | `CTM_PORT + 1` | Wall-E API port |
69
+ | `CTM_HOST` | `127.0.0.1` | Bind address |
70
+
71
+ ### Data Storage
72
+
73
+ | Variable | Default | Description |
74
+ |---|---|---|
75
+ | `WALL_E_DATA_DIR` | `~/.walle/data` | Wall-E's brain database and backups |
76
+ | `CTM_DATA_DIR` | `~/.walle/data` | CTM's database, images, and backups |
77
+
78
+ ### Slack Integration {#slack}
79
+
80
+ | Variable | Description |
81
+ |---|---|
82
+ | `SLACK_TOKEN` | Slack user or bot token (set via OAuth in the setup page) |
83
+ | `SLACK_OWNER_USER_ID` | Your Slack user ID (e.g., `U0XXXXXXXX`) — for message direction detection |
84
+ | `SLACK_OWNER_HANDLE` | Your Slack handle (e.g., `your.name`) — for search queries |
54
85
 
55
86
  ## Wall-E Config File
56
87
 
package/template/wall-e/api-walle.js CHANGED
@@ -213,8 +213,12 @@ function handleWalleApi(req, res, url) {
213
213
  jsonResponse(res, { ok: true, already: true });
214
214
  return true;
215
215
  }
216
- // Start OAuth — opens browser, callback handled by CTM server route
217
- slackMcp.authenticate();
216
+ // Start OAuth — opens browser, temp server on port 3118 handles callback
217
+ slackMcp.authenticate().then(() => {
218
+ console.log('[wall-e] Slack OAuth completed');
219
+ }).catch(err => {
220
+ console.error('[wall-e] Slack OAuth failed:', err.message);
221
+ });
218
222
  jsonResponse(res, { ok: true, pending: true });
219
223
  } catch (e) {
220
224
  jsonResponse(res, { error: e.message }, 500);
package/template/wall-e/brain.js CHANGED
@@ -13,6 +13,33 @@ try {
13
13
  });
14
14
  } catch {}
15
15
 
16
+ // Auto-detect corporate Claude Code gateway (devbox) if not already configured.
17
+ // The devbox `claude` wrapper stores auth headers at ~/.devbox/secrets/claude/auth_headers
18
+ // but only injects them as env vars when running `claude` directly.
19
+ // This lets Wall-E use the same gateway when started from a regular terminal.
20
+ // Skip if already configured with real credentials; detect if missing or only has dummy token
21
+ const _hasRealKey = process.env.ANTHROPIC_API_KEY && process.env.ANTHROPIC_API_KEY !== 'sk-ant-api03-unused';
22
+ if (!process.env.ANTHROPIC_CUSTOM_HEADERS_B64 && !_hasRealKey) {
23
+ try {
24
+ const _authFile = path.join(process.env.HOME, '.devbox', 'secrets', 'claude', 'auth_headers');
25
+ const _headers = fs.readFileSync(_authFile, 'utf8').trim();
26
+ if (_headers) {
27
+ process.env.ANTHROPIC_CUSTOM_HEADERS_B64 = Buffer.from(_headers).toString('base64');
28
+ if (!process.env.ANTHROPIC_CUSTOM_HEADERS) process.env.ANTHROPIC_CUSTOM_HEADERS = _headers;
29
+ if (!process.env.ANTHROPIC_AUTH_TOKEN) process.env.ANTHROPIC_AUTH_TOKEN = 'sk-ant-api03-unused';
30
+ // Detect gateway URL from devbox claude wrapper
31
+ if (!process.env.ANTHROPIC_BASE_URL) {
32
+ try {
33
+ const _claudeScript = fs.readFileSync(path.join(process.env.HOME, '.devbox', 'ai', 'claude', 'claude'), 'utf8');
34
+ const _vpnMatch = _claudeScript.match(/VPN_CHECK_URL="(https?:\/\/[^"]+)"/);
35
+ if (_vpnMatch) process.env.ANTHROPIC_BASE_URL = _vpnMatch[1] + '/v1';
36
+ } catch {}
37
+ }
38
+ console.log('[brain] Auto-detected devbox Claude gateway auth');
39
+ }
40
+ } catch {}
41
+ }
42
+
16
43
  const DATA_DIR = process.env.WALL_E_DATA_DIR || path.join(process.env.HOME, '.walle', 'data');
17
44
  const DEFAULT_DB_PATH = path.join(DATA_DIR, 'wall-e-brain.db');
18
45
  const BACKUP_DIR = path.join(DATA_DIR, 'backups');
package/template/wall-e/tools/slack-mcp.js CHANGED
@@ -6,15 +6,10 @@ const path = require('path');
6
6
 
7
7
  const SLACK_MCP_URL = 'https://mcp.slack.com/mcp';
8
8
  const CLIENT_ID = '1601185624273.8899143856786';
9
+ const CALLBACK_PORT = 3118; // Must match Slack's registered redirect_uri for this client_id
10
+ const CALLBACK_URL = `http://localhost:${CALLBACK_PORT}/callback`;
9
11
  const TOKEN_FILE = path.join(process.env.HOME, '.claude', 'wall-e-slack-token.json');
10
12
 
11
- // OAuth callback is handled by CTM server at /api/slack/callback
12
- // so it works on whatever port CTM is running on (no separate server needed).
13
- function getCallbackUrl() {
14
- const port = process.env.CTM_PORT || '3456';
15
- return `http://localhost:${port}/api/slack/callback`;
16
- }
17
-
18
13
  // ── Token persistence ──
19
14
 
20
15
  function loadToken() {
@@ -43,15 +38,15 @@ function generatePKCE() {
43
38
  return { verifier, challenge };
44
39
  }
45
40
 
46
- // Pending OAuth state (set during authenticate, consumed by handleOAuthCallback)
47
- let _pendingOAuth = null;
48
-
49
41
  /**
50
- * Start OAuth flow: opens browser, callback handled by CTM server.
51
- * Returns immediately — the token is saved when CTM receives the callback.
42
+ * Start OAuth flow: spins up a temporary callback server on port 3118
43
+ * (the registered redirect_uri for this Slack client_id), opens browser,
44
+ * and waits for Slack to redirect back with the auth code.
45
+ *
46
+ * The server runs inside the same Node process as CTM, so EDR/antivirus
47
+ * won't flag it as a new suspicious process.
52
48
  */
53
- function authenticate() {
54
- // Check if we already have a valid token
49
+ async function authenticate() {
55
50
  const existing = loadToken();
56
51
  if (existing && existing.access_token) {
57
52
  return existing.access_token;
@@ -59,89 +54,87 @@ function authenticate() {
59
54
 
60
55
  const { verifier, challenge } = generatePKCE();
61
56
  const state = crypto.randomBytes(16).toString('hex');
62
- const redirectUri = getCallbackUrl();
63
-
64
- _pendingOAuth = { verifier, state, redirectUri, createdAt: Date.now() };
65
-
66
- const scopes = 'search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users,chat:write,channels:history,groups:history,mpim:history,im:history,canvases:read,users:read,users:read.email';
67
- const authUrl = `https://slack.com/oauth/v2_user/authorize?client_id=${CLIENT_ID}&scope=${encodeURIComponent(scopes)}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&code_challenge=${challenge}&code_challenge_method=S256`;
68
-
69
- console.log('[slack-mcp] Opening browser for Slack OAuth...');
70
- console.log('[slack-mcp] Callback URL:', redirectUri);
71
-
72
- const { execFile } = require('child_process');
73
- execFile('open', [authUrl], (err) => {
74
- if (err) console.error('[slack-mcp] Failed to open browser:', err.message);
75
- });
76
-
77
- return null; // Token not yet available — will be set by callback
78
- }
79
-
80
- /**
81
- * Handle the OAuth callback from Slack (called by CTM server route).
82
- * Returns { ok, html } or { error, html }.
83
- */
84
- async function handleOAuthCallback(code, returnedState) {
85
- if (!_pendingOAuth) {
86
- return { error: 'No pending OAuth flow. Click "Connect" again.', html: errorPage('No pending OAuth flow. Go back and click Connect again.') };
87
- }
88
-
89
- // Expire after 10 minutes
90
- if (Date.now() - _pendingOAuth.createdAt > 600000) {
91
- _pendingOAuth = null;
92
- return { error: 'OAuth flow expired.', html: errorPage('OAuth flow expired. Go back and click Connect again.') };
93
- }
94
-
95
- if (returnedState !== _pendingOAuth.state) {
96
- _pendingOAuth = null;
97
- return { error: 'State mismatch.', html: errorPage('OAuth state mismatch. Please try again.') };
98
- }
99
-
100
- if (!code) {
101
- _pendingOAuth = null;
102
- return { error: 'No code.', html: errorPage('No authorization code received from Slack.') };
103
- }
104
57
 
105
- try {
106
- const tokenResp = await fetch('https://slack.com/api/oauth.v2.user.access', {
107
- method: 'POST',
108
- headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
109
- body: new URLSearchParams({
110
- client_id: CLIENT_ID,
111
- code,
112
- code_verifier: _pendingOAuth.verifier,
113
- redirect_uri: _pendingOAuth.redirectUri,
114
- }),
58
+ return new Promise((resolve, reject) => {
59
+ const timeout = setTimeout(() => {
60
+ server.close();
61
+ reject(new Error('OAuth flow timed out (5min). Click Connect again.'));
62
+ }, 300000);
63
+
64
+ const server = http.createServer(async (req, res) => {
65
+ const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
66
+ if (url.pathname !== '/callback') { res.writeHead(404); res.end(); return; }
67
+
68
+ const code = url.searchParams.get('code');
69
+ const returnedState = url.searchParams.get('state');
70
+
71
+ if (returnedState !== state) {
72
+ res.writeHead(200, { 'Content-Type': 'text/html' });
73
+ res.end(errorPage('OAuth state mismatch. Please try again.'));
74
+ clearTimeout(timeout); server.close(); reject(new Error('State mismatch')); return;
75
+ }
76
+ if (!code) {
77
+ res.writeHead(200, { 'Content-Type': 'text/html' });
78
+ res.end(errorPage('No authorization code received.'));
79
+ clearTimeout(timeout); server.close(); reject(new Error('No code')); return;
80
+ }
81
+
82
+ try {
83
+ const tokenResp = await fetch('https://slack.com/api/oauth.v2.user.access', {
84
+ method: 'POST',
85
+ headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
86
+ body: new URLSearchParams({ client_id: CLIENT_ID, code, code_verifier: verifier, redirect_uri: CALLBACK_URL }),
87
+ });
88
+ const tokenData = await tokenResp.json();
89
+ if (!tokenData.ok) throw new Error(tokenData.error);
90
+
91
+ const tokenInfo = {
92
+ access_token: tokenData.access_token || tokenData.authed_user?.access_token,
93
+ refresh_token: tokenData.refresh_token,
94
+ team_id: tokenData.team?.id || tokenData.team_id,
95
+ team_name: tokenData.team?.name,
96
+ user_id: tokenData.user_id || tokenData.authed_user?.id,
97
+ scope: tokenData.scope || tokenData.authed_user?.scope,
98
+ obtained_at: new Date().toISOString(),
99
+ };
100
+ saveToken(tokenInfo);
101
+
102
+ res.writeHead(200, { 'Content-Type': 'text/html' });
103
+ res.end(successPage());
104
+ clearTimeout(timeout); server.close();
105
+ console.log('[slack-mcp] OAuth completed — team:', tokenInfo.team_name);
106
+ resolve(tokenInfo.access_token);
107
+ } catch (err) {
108
+ res.writeHead(200, { 'Content-Type': 'text/html' });
109
+ res.end(errorPage('Token exchange failed: ' + err.message));
110
+ clearTimeout(timeout); server.close(); reject(err);
111
+ }
115
112
  });
116
- const tokenData = await tokenResp.json();
117
113
 
118
- _pendingOAuth = null;
114
+ server.listen(CALLBACK_PORT, () => {
115
+ const scopes = 'search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users,chat:write,channels:history,groups:history,mpim:history,im:history,canvases:read,users:read,users:read.email';
116
+ const authUrl = `https://slack.com/oauth/v2_user/authorize?client_id=${CLIENT_ID}&scope=${encodeURIComponent(scopes)}&redirect_uri=${encodeURIComponent(CALLBACK_URL)}&state=${state}&code_challenge=${challenge}&code_challenge_method=S256`;
117
+ console.log('[slack-mcp] OAuth callback listening on port', CALLBACK_PORT);
119
118
 
120
- if (!tokenData.ok) {
121
- return { error: tokenData.error, html: errorPage('Slack OAuth error: ' + tokenData.error) };
122
- }
119
+ const { execFile } = require('child_process');
120
+ execFile('open', [authUrl], (err) => {
121
+ if (err) console.error('[slack-mcp] Failed to open browser:', err.message);
122
+ });
123
+ });
123
124
 
124
- const tokenInfo = {
125
- access_token: tokenData.access_token || tokenData.authed_user?.access_token,
126
- refresh_token: tokenData.refresh_token,
127
- team_id: tokenData.team?.id || tokenData.team_id,
128
- team_name: tokenData.team?.name,
129
- user_id: tokenData.user_id || tokenData.authed_user?.id,
130
- scope: tokenData.scope || tokenData.authed_user?.scope,
131
- obtained_at: new Date().toISOString(),
132
- };
133
- saveToken(tokenInfo);
134
-
135
- console.log('[slack-mcp] OAuth completed — team:', tokenInfo.team_name);
136
- return { ok: true, html: successPage() };
137
- } catch (err) {
138
- _pendingOAuth = null;
139
- return { error: err.message, html: errorPage('Token exchange failed: ' + err.message) };
140
- }
125
+ server.on('error', (err) => {
126
+ clearTimeout(timeout);
127
+ if (err.code === 'EADDRINUSE') {
128
+ reject(new Error(`Port ${CALLBACK_PORT} is in use. Close any other OAuth flows and try again.`));
129
+ } else {
130
+ reject(new Error('OAuth callback server failed: ' + err.message));
131
+ }
132
+ });
133
+ });
141
134
  }
142
135
 
143
136
  function successPage() {
144
- return '<html><body style="font-family:system-ui;text-align:center;padding:60px;background:#0d1117;color:#e6edf3"><h2 style="color:#3fb950">Wall-E connected to Slack!</h2><p style="color:#8b949e">You can close this tab and return to the setup page.</p></body></html>';
137
+ return '<html><body style="font-family:system-ui;text-align:center;padding:60px;background:#0d1117;color:#e6edf3"><h2 style="color:#3fb950">Wall-E connected to Slack!</h2><p style="color:#8b949e">You can close this tab.</p></body></html>';
145
138
  }
146
139
 
147
140
  function errorPage(msg) {
@@ -282,4 +275,4 @@ if (require.main === module) {
282
275
  }
283
276
  }
284
277
 
285
- module.exports = { authenticate, handleOAuthCallback, callSlackMcp, listSlackTools, isAuthenticated, loadToken, clearToken };
278
+ module.exports = { authenticate, callSlackMcp, listSlackTools, isAuthenticated, loadToken, clearToken };