paperclip-plugin-mattermost 0.12.0 → 0.13.0

package/README.md

@@ -13,6 +13,10 @@ Your [Paperclip](https://github.com/paperclipai/paperclip) agents as Mattermost
   - **Confirmations and suggested tasks** get Accept / Reject buttons.
   - **Single-choice questions** get a button per option. Your pick is posted on the task as a comment from you, which wakes the agent.
 - **Access control.** Choose who may talk to agents: everyone, or only the people you pick. Each person can be limited to some agents, and people outside Paperclip can be added by email.
+- **Agents work in Mattermost themselves.** Through plugin API routes that only agents can call, each agent reads the channels its bot is in, posts, reacts, searches, and DMs the people allowed to talk to it, always as its own bot. `GET /api/plugins/mattermost-bridge/api/mm/help` tells an agent how.
+- **Agents work with agents.** An agent mentioning another agent starts it, and it answers in the thread. After a set number of agent-to-agent messages in a thread (10 by default, set in settings), they pause until a person replies.
+- **Work channels.** For an investigation, incident or project, an agent opens a private channel (`inc-checkout-5xx`), pulls in the people and agents it needs, and ties it to a Paperclip task. Task comments and status changes show up in the channel. When the task is done or cancelled, the channel is archived and the outcome is posted back where the work was asked for.
+- **Ask first.** Some actions wait for an approver to click Approve: `@channel`, `@all` and `@here`, public channels, and adding people to a channel the agent didn't create. Agents can't change or archive channels they didn't create, remove anyone, or touch team and server settings.
 - **One install, many companies.** Each Paperclip company connects its own Mattermost, with its own settings, bots and state.
 
 ## Requirements
@@ -78,7 +82,7 @@ PAPERCLIP_REF=<commit> node build.mjs   # build for another Paperclip version
 Bump `version` in `package.json` and `src/manifest.ts`, commit, then tag and push:
 
 ```bash
-git tag v0.12.0 && git push origin main v0.12.0
+git tag -a v0.13.0 -m v0.13.0 && git push origin main v0.13.0
 ```
 
 GitHub Actions builds, tests and publishes to npm through npm trusted publishing, so no npm token is involved.

package/dist/manifest.js

@@ -1,8 +1,9 @@
 // src/manifest.ts
+var route = (routeKey, method, path) => ({ routeKey, method, path, auth: "agent", capability: "api.routes.register" });
 var manifest = {
   id: "mattermost-bridge",
   apiVersion: 1,
-  version: "0.12.0",
+  version: "0.13.0",
   displayName: "Mattermost",
   description: "Every agent becomes its own Mattermost bot. DM an agent or mention it in a channel and it answers in the thread, showing its steps as it works; follow-ups continue the conversation. Paperclip approvals arrive with Approve / Reject buttons.",
   author: "Haseeb Azhar",
@@ -26,11 +27,32 @@ var manifest = {
     "issue.interactions.read",
     "issue.interactions.respond",
     "issue.comments.create",
-    "issue.comments.create_human_attributed"
+    "issue.comments.create_human_attributed",
+    "issue.comments.read",
+    "api.routes.register"
   ],
   entrypoints: { worker: "./dist/worker.js", ui: "./dist/ui" },
   // Replaces the generated form: approvers picked from members, URL detected and checked.
   ui: { slots: [{ type: "settingsPage", id: "mattermost-settings", displayName: "Mattermost", exportName: "SettingsPage" }] },
+  // What agents do in Mattermost as their own bot (src/actions.ts). Agent-only: the host
+  // checks the caller is an agent and scopes it to that agent's company.
+  apiRoutes: [
+    route("help", "GET", "/mm/help"),
+    route("channels", "GET", "/mm/channels"),
+    route("channel-posts", "GET", "/mm/channels/:channel/posts"),
+    route("thread", "GET", "/mm/posts/:postId/thread"),
+    route("channel-members", "GET", "/mm/channels/:channel/members"),
+    route("search", "GET", "/mm/search"),
+    route("people", "GET", "/mm/people"),
+    route("request", "GET", "/mm/requests/:id"),
+    route("post", "POST", "/mm/post"),
+    route("react", "POST", "/mm/react"),
+    route("dm", "POST", "/mm/dm"),
+    route("create-channel", "POST", "/mm/channels"),
+    route("invite", "POST", "/mm/channels/:channel/invite"),
+    route("update-channel", "POST", "/mm/channels/:channel/update"),
+    route("archive", "POST", "/mm/channels/:channel/archive")
+  ],
   webhooks: [
     { endpointKey: "actions", displayName: "Mattermost buttons", description: "Approve / Reject clicks on approval posts. Every click carries a signature the plugin checks." }
   ],
@@ -80,6 +102,14 @@ var manifest = {
         description: "Each person by email, with `agents` listing the agent ids they may talk to (absent: all agents). People outside Paperclip have no userId.",
         items: { type: "object", properties: { userId: { type: "string" }, email: { type: "string" }, name: { type: "string" }, agents: { type: "array", items: { type: "string" } } }, required: ["email"] }
       },
+      agentTurnLimit: {
+        type: "integer",
+        minimum: 1,
+        maximum: 100,
+        default: 10,
+        title: "Agent-to-agent turns",
+        description: "How many messages agents may trade in one thread, mentioning each other, before a person must reply."
+      },
       approvers: {
         type: "array",
         title: "Approvers",

package/dist/ui/index.js

@@ -323,6 +323,17 @@ function SettingsPage({ context }) {
       /* @__PURE__ */ jsx("option", { value: "", children: "None: only in the agent's thread" }),
       setup.data.channels.map((ch) => /* @__PURE__ */ jsx("option", { value: ch.name, children: ch.displayName }, ch.name))
     ] }) : /* @__PURE__ */ jsx("input", { style: s.input, value: String(config.approvalsChannel ?? ""), onChange: (e) => set({ approvalsChannel: e.target.value }), placeholder: "channel name, e.g. approvals" }) }),
+    /* @__PURE__ */ jsx(Field, { label: "Agent-to-agent turns", help: "Agents hand work to each other by mentioning one another in a thread. After this many agent messages in a row, they pause until a person replies.", children: /* @__PURE__ */ jsx(
+      "input",
+      {
+        style: { ...s.input, maxWidth: 120 },
+        type: "number",
+        min: 1,
+        max: 100,
+        value: String(config.agentTurnLimit ?? 10),
+        onChange: (e) => set({ agentTurnLimit: Math.min(100, Math.max(1, Math.round(Number(e.target.value) || 10))) })
+      }
+    ) }),
     /* @__PURE__ */ jsxs(Field, { label: "Agents in Mattermost", error: fieldErrors.agents, help: "Each agent shown here gets its own Mattermost bot. Unticking an agent switches its bot off but keeps it, with its history, for when you tick it again.", children: [
       /* @__PURE__ */ jsx(
         Modes,

package/dist/worker.js

@@ -844,14 +844,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str3 = "";
+  let str4 = "";
   for (let i = 0; i < length; i++) {
-    str3 += chars[Math.floor(Math.random() * chars.length)];
+    str4 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str3;
+  return str4;
 }
-function esc(str3) {
-  return JSON.stringify(str3);
+function esc(str4) {
+  return JSON.stringify(str4);
 }
 function slugify(input2) {
   return input2.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -965,8 +965,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str3) {
-  return str3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str4) {
+  return str4.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def2, params) {
   const cl = new inst._zod.constr(def2 ?? inst._zod.def);
@@ -1232,13 +1232,13 @@ function getSizableOrigin(input2) {
   return "unknown";
 }
 var highSurrogate = /[\uD800-\uDBFF]/;
-function codePointLength(str3) {
-  const units = str3.length;
-  if (!highSurrogate.test(str3))
+function codePointLength(str4) {
+  const units = str4.length;
+  if (!highSurrogate.test(str4))
     return units;
   let count = units;
   for (let i = 0; i < units - 1; i++) {
-    if ((str3.charCodeAt(i) & 64512) === 55296 && (str3.charCodeAt(i + 1) & 64512) === 56320) {
+    if ((str4.charCodeAt(i) & 64512) === 55296 && (str4.charCodeAt(i + 1) & 64512) === 56320) {
       count--;
       i++;
     }
@@ -16214,8 +16214,8 @@ var contributors = {
 function aggregateChecks(schema) {
   const agg = {};
   const def2 = schema._zod.def;
-  const list = schema._zod.traits.has("$ZodCheck") ? [schema, ...def2.checks ?? []] : def2.checks ?? [];
-  for (const ch of list)
+  const list2 = schema._zod.traits.has("$ZodCheck") ? [schema, ...def2.checks ?? []] : def2.checks ?? [];
+  for (const ch of list2)
     contributors[ch._zod.def.check]?.(agg, ch._zod.def);
   const bag = schema._zod.bag;
   if (bag.minimum !== void 0)
@@ -30482,28 +30482,28 @@ var aiProviderRoutingSchema = external_exports.object({
       label: external_exports.string().trim().max(160).optional()
     }).strict()
   ).max(200).default([])
-}).strict().superRefine((route, ctx2) => {
+}).strict().superRefine((route2, ctx2) => {
   const invalid = (message2) => ctx2.addIssue({ code: "custom", message: message2 });
-  if (route.kind === "bedrock") {
-    if (route.protocol !== "bedrock" || !route.region || route.auth !== "bearer" || route.baseUrl)
+  if (route2.kind === "bedrock") {
+    if (route2.protocol !== "bedrock" || !route2.region || route2.auth !== "bearer" || route2.baseUrl)
       invalid(
         "Bedrock requires a region and a Bedrock API key."
       );
-  } else if (route.protocol === "bedrock" || route.region)
+  } else if (route2.protocol === "bedrock" || route2.region)
     invalid("AWS settings require Bedrock.");
-  if (route.kind === "openrouter" && (route.baseUrl || route.auth !== "bearer"))
+  if (route2.kind === "openrouter" && (route2.baseUrl || route2.auth !== "bearer"))
     invalid("OpenRouter uses its official endpoint and an API key.");
-  if (route.auth === "api_key" && route.protocol !== "messages")
+  if (route2.auth === "api_key" && route2.protocol !== "messages")
     invalid("API-key header authentication requires Anthropic Messages.");
-  if (route.kind === "gateway" || route.kind === "local") {
+  if (route2.kind === "gateway" || route2.kind === "local") {
     try {
-      const url2 = new URL(route.baseUrl ?? "");
+      const url2 = new URL(route2.baseUrl ?? "");
       const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(
         url2.hostname
       );
       if (url2.username || url2.password || url2.search || url2.hash || url2.protocol !== "https:" && !(url2.protocol === "http:" && loopback))
         throw new Error();
-      if (route.kind === "local" && !loopback)
+      if (route2.kind === "local" && !loopback)
         invalid("A local endpoint must use localhost or a loopback address.");
     } catch {
       invalid(
@@ -33606,7 +33606,7 @@ var pluginManifestV1Schema = external_exports.object({
     }
   }
   if (manifest2.apiRoutes) {
-    const routeKeys = manifest2.apiRoutes.map((route) => route.routeKey);
+    const routeKeys = manifest2.apiRoutes.map((route2) => route2.routeKey);
     const duplicateKeys = routeKeys.filter((key, i) => routeKeys.indexOf(key) !== i);
     if (duplicateKeys.length > 0) {
       ctx2.addIssue({
@@ -33615,7 +33615,7 @@ var pluginManifestV1Schema = external_exports.object({
         path: ["apiRoutes"]
       });
     }
-    const routeSignatures = manifest2.apiRoutes.map((route) => `${route.method} ${route.path}`);
+    const routeSignatures = manifest2.apiRoutes.map((route2) => `${route2.method} ${route2.path}`);
     const duplicateRoutes = routeSignatures.filter((sig2, i) => routeSignatures.indexOf(sig2) !== i);
     if (duplicateRoutes.length > 0) {
       ctx2.addIssue({
@@ -42172,17 +42172,17 @@ function aggregatorAppIdentity(value) {
   return SERVICE_IDENTITY_ALIASES.get(identity) ?? identity;
 }
 var entries = /* @__PURE__ */ new Map();
-function add(name, slug, aliases, route) {
+function add(name, slug, aliases, route2) {
   const identity = aggregatorAppIdentity(name);
   const existing = entries.get(identity);
   if (existing) {
     existing.aliases = [.../* @__PURE__ */ new Set([...existing.aliases, name, slug, ...aliases])];
-    if (!existing.routes.some((candidate) => candidate.provider === route.provider)) {
-      existing.routes.push(route);
+    if (!existing.routes.some((candidate) => candidate.provider === route2.provider)) {
+      existing.routes.push(route2);
     }
     return;
   }
-  entries.set(identity, { slug, name: name.replace(/\s+(MCP|API)$/i, ""), aliases, routes: [route] });
+  entries.set(identity, { slug, name: name.replace(/\s+(MCP|API)$/i, ""), aliases, routes: [route2] });
 }
 for (const [toolkit, name] of composio_search_catalog_default.toolkits) {
   add(name, toolkit.replaceAll("_", "-").replace(/^-+/, ""), [toolkit], {
@@ -44992,7 +44992,499 @@ function chosenProps(choice, who) {
   return { attachments: [{ text: `${who} chose **${choice}**`, actions: [] }] };
 }
 
+// src/policy.ts
+var ALLOW = { ok: true };
+var ask = (why) => ({ ok: false, askFirst: true, why });
+var refuse = (why) => ({ ok: false, askFirst: false, why });
+function broadcastMention(text2) {
+  const m = text2.match(/(?:^|[^\w@])@(channel|all|here)\b/i);
+  return m ? `@${m[1].toLowerCase()}` : null;
+}
+function canPost(text2) {
+  const b = broadcastMention(text2);
+  return b ? ask(`${b} notifies everyone in the channel`) : ALLOW;
+}
+function canCreateChannel(isPrivate) {
+  return isPrivate ? ALLOW : ask("a public channel is visible to the whole team");
+}
+function canManage(createdByThisAgent, action) {
+  if (createdByThisAgent) return ALLOW;
+  if (action === "invite") return ask("the agent did not create this channel");
+  return refuse("only the agent that created a channel may change or archive it");
+}
+function canDm(allowedToTalk) {
+  return allowedToTalk ? ALLOW : refuse("that person is not allowed to talk to this agent");
+}
+function channelSlug(name) {
+  return name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "work";
+}
+
+// src/actions.ts
+var ok = (body) => ({ status: 200, body });
+var bad = (status, error62) => ({ status, body: { error: error62 } });
+var str3 = (v) => typeof v === "string" ? v.trim() : "";
+var list = (v) => Array.isArray(v) ? v.map(str3).filter(Boolean) : typeof v === "string" && v.trim() ? v.split(",").map((s) => s.trim()).filter(Boolean) : [];
+var ID = /^[a-z0-9]{26}$/;
+var Actions = class {
+  d;
+  names = /* @__PURE__ */ new Map();
+  constructor(deps) {
+    this.d = deps;
+  }
+  /** One route call. `params` are the route's path parameters, `input` its query or body. */
+  async handle(agentId, routeKey, params, input2) {
+    const bot = this.d.bot(agentId);
+    if (!bot) return bad(409, "You have no Mattermost bot in this company yet (your agent may be switched off in the plugin's settings).");
+    try {
+      switch (routeKey) {
+        case "channels":
+          return ok(await this.myChannels(bot));
+        case "channel-posts":
+          return ok(await this.posts(bot, params.channel, input2));
+        case "thread":
+          return ok(await this.thread(bot, params.postId));
+        case "channel-members":
+          return ok(await this.members(bot, params.channel));
+        case "search":
+          return ok(await this.search(bot, str3(input2.q)));
+        case "people":
+          return ok(await this.people(str3(input2.q)));
+        case "post":
+          return await this.post(agentId, bot, input2);
+        case "react":
+          return await this.react(bot, input2);
+        case "dm":
+          return await this.dm(agentId, bot, input2);
+        case "create-channel":
+          return await this.createChannel(agentId, bot, input2);
+        case "invite":
+          return await this.invite(agentId, bot, params.channel, input2);
+        case "update-channel":
+          return await this.updateChannel(agentId, bot, params.channel, input2);
+        case "archive":
+          return await this.archive(agentId, bot, params.channel);
+        case "request":
+          return ok(await this.d.store.get(`req:${params.id}`) ?? { error: "no such request" });
+        default:
+          return bad(404, `unknown action ${routeKey}`);
+      }
+    } catch (err) {
+      const status = err?.status;
+      const message2 = String(err?.message ?? err).replace(/^Mattermost \w+ \S+: \d+ /, "");
+      return bad(status && status >= 400 && status < 500 ? status : 502, `Mattermost refused or failed: ${message2.slice(0, 300)}`);
+    }
+  }
+  // ---- reading -------------------------------------------------------------------
+  async teamOf(bot) {
+    const teams = await bot.request("GET", "/users/me/teams");
+    if (!teams.length) throw Object.assign(new Error("your bot is in no team"), { status: 409 });
+    return teams[0].id;
+  }
+  /** A channel by id, URL name ("decisions"), display name ("Decisions") or "~decisions". */
+  async channel(bot, ref) {
+    const want = str3(ref).replace(/^[~#]/, "");
+    if (ID.test(want)) return bot.request("GET", `/channels/${want}`);
+    for (const team of await bot.request("GET", "/users/me/teams")) {
+      try {
+        return await bot.request("GET", `/teams/${team.id}/channels/name/${encodeURIComponent(channelSlug(want))}`);
+      } catch {
+      }
+      const mine = await bot.request("GET", `/users/me/teams/${team.id}/channels`).catch(() => []);
+      const hit = mine.find((c) => c.display_name.toLowerCase() === want.toLowerCase());
+      if (hit) return hit;
+    }
+    throw Object.assign(new Error(`no channel "${ref}" that you can see; you can only use channels you are a member of`), { status: 404 });
+  }
+  async userName(id) {
+    if (!this.names.has(id)) {
+      const u = await this.d.manager.request("GET", `/users/${id}`).catch(() => ({ username: id }));
+      this.names.set(id, u.username);
+    }
+    return this.names.get(id);
+  }
+  async shape(p) {
+    return { id: p.id, from: `@${await this.userName(p.user_id)}`, at: new Date(p.create_at).toISOString(), threadId: p.root_id || null, text: p.message };
+  }
+  async ordered(res) {
+    const posts = res.order.map((id) => res.posts[id]).filter(Boolean).sort((a, b) => a.create_at - b.create_at);
+    return Promise.all(posts.map((p) => this.shape(p)));
+  }
+  async myChannels(bot) {
+    const team = await this.teamOf(bot);
+    const created = await this.created();
+    const channels = await bot.request("GET", `/users/me/teams/${team}/channels`);
+    return channels.filter((c) => c.type === "O" || c.type === "P").map((c) => ({
+      id: c.id,
+      name: c.name,
+      displayName: c.display_name,
+      private: c.type === "P",
+      purpose: c.purpose || "",
+      createdByYou: created[c.id] === bot.botUserId
+    }));
+  }
+  async posts(bot, ref, input2) {
+    const ch = await this.channel(bot, ref);
+    const limit = Math.min(Math.max(Number(input2.limit) || 30, 1), 100);
+    return { channel: ch.name, posts: await this.ordered(await bot.request(`GET`, `/channels/${ch.id}/posts?per_page=${limit}`)) };
+  }
+  async thread(bot, postId) {
+    return { posts: await this.ordered(await bot.request("GET", `/posts/${postId}/thread`)) };
+  }
+  async members(bot, ref) {
+    const ch = await this.channel(bot, ref);
+    const ms = await bot.request("GET", `/channels/${ch.id}/members?per_page=200`);
+    const agents = new Map(this.d.agents().map((a) => [a.botUserId, a]));
+    return Promise.all(ms.map(async (m) => {
+      const a = agents.get(m.user_id);
+      return a ? { username: a.username, agent: a.agentName } : { username: await this.userName(m.user_id) };
+    }));
+  }
+  async search(bot, q) {
+    if (!q) throw Object.assign(new Error("say what to search for (q)"), { status: 400 });
+    const team = await this.teamOf(bot);
+    return { posts: (await this.ordered(await bot.request("POST", `/teams/${team}/posts/search`, { terms: q, is_or_search: false }))).slice(-30) };
+  }
+  async people(q) {
+    const users = await this.d.manager.request(
+      "POST",
+      "/users/search",
+      { term: q, allow_inactive: false, limit: 25 }
+    );
+    const agents = new Map(this.d.agents().map((a) => [a.botUserId, a]));
+    return users.filter((u) => !u.delete_at && (!u.is_bot || agents.has(u.id))).map((u) => agents.has(u.id) ? { username: u.username, agent: agents.get(u.id).agentName } : { username: u.username, name: [u.first_name, u.last_name].filter(Boolean).join(" ") || u.username });
+  }
+  // ---- talking ---------------------------------------------------------------------
+  async gate(agentId, verdict, kind, summary, args) {
+    if (verdict.ok) return null;
+    if (!verdict.askFirst) return bad(403, `Not allowed: ${verdict.why}.`);
+    const request = {
+      id: this.d.newId(),
+      agentId,
+      agentName: this.agentName(agentId),
+      kind,
+      summary,
+      why: verdict.why,
+      args,
+      origin: this.d.origin(agentId),
+      status: "pending"
+    };
+    await this.d.store.set(`req:${request.id}`, request);
+    await this.d.askApproval(request);
+    return { status: 202, body: {
+      status: "waiting_for_approval",
+      requestId: request.id,
+      why: verdict.why,
+      note: "A person has been asked to approve this. Tell whoever you are working with, and carry on; if approved it runs as you, and the result is posted where you asked."
+    } };
+  }
+  agentName(agentId) {
+    return this.d.agents().find((a) => a.agentId === agentId)?.agentName ?? "An agent";
+  }
+  async post(agentId, bot, input2) {
+    const text2 = str3(input2.text);
+    if (!text2) return bad(400, "text is empty");
+    const ch = await this.channel(bot, str3(input2.channel));
+    const threadId = str3(input2.threadId);
+    const waiting = await this.gate(agentId, canPost(text2), "post", `post in ~${ch.name}: "${text2.slice(0, 200)}"`, { channelId: ch.id, threadId, text: text2 });
+    if (waiting) return waiting;
+    return ok(await this.doPost(bot, ch.id, threadId, text2));
+  }
+  async doPost(bot, channelId, threadId, text2) {
+    const p = await bot.request("POST", "/posts", { channel_id: channelId, root_id: threadId, message: text2 });
+    return { posted: p.id, threadId: p.root_id || p.id };
+  }
+  async react(bot, input2) {
+    const emoji3 = str3(input2.emoji).replace(/^:|:$/g, "");
+    if (!str3(input2.postId) || !emoji3) return bad(400, "postId and emoji are required");
+    await bot.request("POST", "/reactions", { user_id: bot.botUserId, post_id: str3(input2.postId), emoji_name: emoji3 });
+    return ok({ reacted: emoji3 });
+  }
+  async dm(agentId, bot, input2) {
+    const text2 = str3(input2.text);
+    const username = str3(input2.person).replace(/^@/, "");
+    if (!text2 || !username) return bad(400, "person and text are required");
+    const user2 = await this.d.manager.request("GET", `/users/username/${encodeURIComponent(username)}`);
+    const verdict = canDm(await this.d.canTalk(user2.id, agentId));
+    if (!verdict.ok) return bad(403, `Not allowed: ${verdict.why}.`);
+    const channel2 = await bot.request("POST", "/channels/direct", [bot.botUserId, user2.id]);
+    return ok(await this.doPost(bot, channel2.id, "", text2));
+  }
+  // ---- channels ----------------------------------------------------------------------
+  async created() {
+    return await this.d.store.get("channels-created") ?? {};
+  }
+  async createdBy(channelId) {
+    return (await this.created())[channelId];
+  }
+  async resolvePeople(names) {
+    const agents = this.d.agents();
+    const ids = [];
+    const unknown2 = [];
+    for (const raw of names) {
+      const n = raw.replace(/^@/, "").toLowerCase();
+      const a = agents.find((x) => x.username === n || x.agentName.toLowerCase() === n);
+      if (a) {
+        ids.push(a.botUserId);
+        continue;
+      }
+      const u = await this.d.manager.request("GET", `/users/username/${encodeURIComponent(n)}`).catch(() => null);
+      if (u) ids.push(u.id);
+      else unknown2.push(raw);
+    }
+    return { ids, unknown: unknown2 };
+  }
+  async addMembers(channelId, ids) {
+    for (const id of ids) await this.d.manager.request("POST", `/channels/${channelId}/members`, { user_id: id }).catch(() => {
+    });
+  }
+  async createChannel(agentId, bot, input2) {
+    const isPrivate = input2.private !== false;
+    const display = str3(input2.name);
+    if (!display) return bad(400, "name is required, e.g. 'inc checkout 5xx'");
+    const taskId = str3(input2.taskId);
+    if (taskId && !await this.d.task(taskId)) return bad(404, `no task ${taskId} in this company`);
+    const args = { name: display, private: isPrivate, purpose: str3(input2.purpose), people: list(input2.people), agents: list(input2.agents), taskId };
+    const waiting = await this.gate(agentId, canCreateChannel(isPrivate), "create-channel", `open the public channel "${display}"`, args);
+    if (waiting) return waiting;
+    return ok(await this.doCreateChannel(agentId, bot, args, this.d.origin(agentId)));
+  }
+  async doCreateChannel(agentId, bot, args, origin) {
+    const team = await this.teamOf(bot);
+    const display = str3(args.name);
+    let ch = null;
+    for (const suffix of ["", "-2", "-3", "-4", "-5"]) {
+      try {
+        ch = await bot.request("POST", "/channels", {
+          team_id: team,
+          name: channelSlug(display) + suffix,
+          display_name: display.slice(0, 64),
+          type: args.private === false ? "O" : "P",
+          purpose: str3(args.purpose).slice(0, 250)
+        });
+        break;
+      } catch (err) {
+        if (err.status !== 400) throw err;
+      }
+    }
+    if (!ch) throw Object.assign(new Error(`a channel named like "${display}" exists already; pick another name`), { status: 409 });
+    const created = await this.created();
+    created[ch.id] = bot.botUserId;
+    await this.d.store.set("channels-created", created);
+    const { ids, unknown: unknown2 } = await this.resolvePeople([...list(args.people), ...list(args.agents)]);
+    await this.addMembers(ch.id, ids);
+    let task2 = null;
+    const taskId = str3(args.taskId);
+    if (taskId) {
+      const t = await this.d.task(taskId);
+      if (t) {
+        task2 = { issueId: t.id, identifier: t.identifier ?? null, title: t.title, agentId, origin };
+        await this.d.store.set(`worklink:${ch.id}`, task2);
+        await this.d.store.set(`taskchannel:${t.id}`, ch.id);
+      }
+    }
+    return { channel: ch.name, channelId: ch.id, private: ch.type === "P", added: ids.length, unknownPeople: unknown2, linkedTask: task2?.identifier ?? task2?.issueId ?? null };
+  }
+  async invite(agentId, bot, ref, input2) {
+    const ch = await this.channel(bot, ref);
+    const names = [...list(input2.people), ...list(input2.agents)];
+    if (!names.length) return bad(400, "people or agents to invite are required");
+    const mine = await this.createdBy(ch.id) === bot.botUserId;
+    const waiting = await this.gate(agentId, canManage(mine, "invite"), "invite", `add ${names.join(", ")} to ~${ch.name}`, { channelId: ch.id, names });
+    if (waiting) return waiting;
+    return ok(await this.doInvite(ch.id, names));
+  }
+  async doInvite(channelId, names) {
+    const { ids, unknown: unknown2 } = await this.resolvePeople(names);
+    await this.addMembers(channelId, ids);
+    return { added: ids.length, unknownPeople: unknown2 };
+  }
+  async updateChannel(agentId, bot, ref, input2) {
+    const ch = await this.channel(bot, ref);
+    const verdict = canManage(await this.createdBy(ch.id) === bot.botUserId, "update");
+    if (!verdict.ok) return bad(403, `Not allowed: ${verdict.why}.`);
+    const patch = {};
+    if (typeof input2.purpose === "string") patch.purpose = input2.purpose.slice(0, 250);
+    if (typeof input2.header === "string") patch.header = input2.header.slice(0, 1024);
+    if (typeof input2.name === "string" && input2.name.trim()) patch.display_name = input2.name.trim().slice(0, 64);
+    if (!Object.keys(patch).length) return bad(400, "nothing to change: purpose, header or name");
+    await this.d.manager.request("PUT", `/channels/${ch.id}/patch`, patch);
+    return ok({ updated: Object.keys(patch) });
+  }
+  async archive(agentId, bot, ref) {
+    const ch = await this.channel(bot, ref);
+    const verdict = canManage(await this.createdBy(ch.id) === bot.botUserId, "archive");
+    if (!verdict.ok) return bad(403, `Not allowed: ${verdict.why}.`);
+    await this.d.manager.request("DELETE", `/channels/${ch.id}`);
+    return ok({ archived: ch.name });
+  }
+  /** A person approved or rejected a request: run it as the agent, then report where it was asked. */
+  async decide(requestId, approved, who) {
+    const req = await this.d.store.get(`req:${requestId}`);
+    if (!req || req.status !== "pending") return req;
+    req.decidedBy = who;
+    if (!approved) {
+      req.status = "rejected";
+    } else {
+      const bot2 = this.d.bot(req.agentId);
+      try {
+        if (!bot2) throw new Error("the agent has no bot any more");
+        const a = req.args;
+        req.result = req.kind === "post" ? await this.doPost(bot2, str3(a.channelId), str3(a.threadId), str3(a.text)) : req.kind === "create-channel" ? await this.doCreateChannel(req.agentId, bot2, a, req.origin) : await this.doInvite(str3(a.channelId), list(a.names));
+        req.status = "approved";
+      } catch (err) {
+        req.status = "failed";
+        req.result = { error: String(err?.message ?? err).slice(0, 300) };
+      }
+    }
+    await this.d.store.set(`req:${requestId}`, req);
+    const bot = this.d.bot(req.agentId);
+    if (bot && req.origin) {
+      const line = req.status === "approved" ? `:white_check_mark: ${who} approved: ${req.summary}.` : req.status === "rejected" ? `:x: ${who} rejected: ${req.summary}.` : `:warning: Approved by ${who}, but it failed: ${req.result?.error}`;
+      await bot.request("POST", "/posts", { channel_id: req.origin.channelId, root_id: req.origin.rootId, message: line }).catch(() => {
+      });
+    }
+    return req;
+  }
+};
+
+// src/worklinks.ts
+var FROM_PAPERCLIP = { from_paperclip: "true" };
+var CLOSED = /* @__PURE__ */ new Set(["done", "cancelled"]);
+var STATUS_WORDS = {
+  todo: "to do",
+  in_progress: "in progress",
+  in_review: "in review",
+  blocked: "blocked",
+  backlog: "in the backlog",
+  done: "done",
+  cancelled: "cancelled"
+};
+var WorkLinks = class {
+  d;
+  constructor(deps) {
+    this.d = deps;
+  }
+  async linked(issueId) {
+    const channelId = await this.d.store.get(`taskchannel:${issueId}`);
+    const link = channelId ? await this.d.store.get(`worklink:${channelId}`) : null;
+    return channelId && link && !link.closed ? { channelId, link } : null;
+  }
+  label(link) {
+    return link.identifier ?? link.title;
+  }
+  /** A new comment on a task with a work channel. */
+  async comment(issueId, commentId) {
+    const hit = await this.linked(issueId);
+    if (!hit) return;
+    const c = (await this.d.comments(issueId)).find((x) => x.id === commentId);
+    if (!c?.body?.trim()) return;
+    const body = c.body.trim().slice(0, 12e3);
+    const own2 = c.authorAgentId && this.d.hasBot(c.authorAgentId);
+    const text2 = own2 ? body : `**${c.authorAgentId ? this.d.agentName(c.authorAgentId) : "A team member"}** commented on ${this.label(hit.link)}:
+
+${body}`;
+    await this.d.post(own2 ? c.authorAgentId : hit.link.agentId, hit.channelId, "", text2);
+  }
+  /** The task changed: note a new status; on done or cancelled, archive and report back. */
+  async updated(issueId) {
+    const hit = await this.linked(issueId);
+    if (!hit) return;
+    const task2 = await this.d.task(issueId);
+    if (!task2 || task2.status === hit.link.status) return;
+    const { channelId, link } = hit;
+    const known = link.status !== void 0;
+    link.status = task2.status;
+    if (!CLOSED.has(task2.status)) {
+      await this.d.store.set(`worklink:${channelId}`, link);
+      if (known) await this.d.post(link.agentId, channelId, "", `_${this.label(link)} is now ${STATUS_WORDS[task2.status] ?? task2.status}._`);
+      return;
+    }
+    link.closed = true;
+    await this.d.store.set(`worklink:${channelId}`, link);
+    const last = (await this.d.comments(issueId)).at(-1)?.body?.trim();
+    const outcome = last ? `
+
+${last.length > 1500 ? last.slice(0, 1500) + "\u2026" : last}` : "";
+    const done = task2.status === "done";
+    const name = await this.d.channelName(channelId).catch(() => "the work channel");
+    await this.d.post(link.agentId, channelId, "", `${done ? ":white_check_mark:" : ":no_entry_sign:"} ${this.label(link)} is ${task2.status}. Archiving this channel; it stays readable under archived channels.`);
+    await this.d.archive(channelId);
+    if (link.origin) {
+      await this.d.post(
+        link.agentId,
+        link.origin.channelId,
+        link.origin.rootId,
+        `${done ? ":white_check_mark: Done" : ":no_entry_sign: Cancelled"}: **${this.label(link)}** ${task2.title}${outcome}
+
+_~${name} is archived._`
+      );
+    }
+  }
+};
+
+// src/help.ts
+var HELP = `# Working in Mattermost
+
+You have your own Mattermost account (a bot). Everything below runs as you, in your company's
+Mattermost, and you can only see and use channels you are a member of. Call these with your
+Paperclip API credentials, the same way you call the Paperclip API:
+
+  <your Paperclip API URL>/api/plugins/mattermost-bridge/api/mm/...
+
+Answers are JSON. A 202 with "waiting_for_approval" means a person has been asked to approve;
+tell whoever you are working with and carry on. A 403 says why something is not allowed.
+
+## How to work
+
+- **Pick the size of the work.** A quick question: answer in the thread. A task: create a Paperclip
+  task (assign it to yourself or delegate it) and say so in the thread with its identifier. An
+  investigation, incident or project, or anything involving several agents or more than a day:
+  create the task, then open a work channel for it (below), with the person who asked and whoever
+  you need. Name it for what it is: "inc checkout 5xx", "inv q3 conversion drop", "proj crm migration".
+- **Announce a work channel where the request came in**, in one message: what it is for, who you
+  pulled in, and that you will report back there. When the task is done or cancelled the plugin
+  archives the channel and posts the outcome back where you asked; you do not need to.
+- **Hand work to another agent by mentioning it** (@cto) in a channel or thread it is in; invite it
+  first if it is not. Give it the context it needs in that message. It replies in the thread.
+  Mention an agent only when you want it to act: every mention starts it.
+- **Say something before going quiet.** If an answer will take a while, post one line ("On it,
+  checking what shipped this morning") and then do the work.
+- Do not write @channel, @all or @here unless everyone in the channel must be notified: it needs
+  approval.
+
+## Calls
+
+Reading (GET):
+- /mm/channels                              channels you are in
+- /mm/channels/{channel}/posts?limit=30     recent posts in a channel (oldest first)
+- /mm/posts/{postId}/thread                 a whole thread
+- /mm/channels/{channel}/members            who is in a channel (people and agents)
+- /mm/search?q=words                        search messages in your channels
+- /mm/people?q=name                         find people and agents by name
+- /mm/requests/{id}                         an approval request you made
+
+Talking (POST, JSON body):
+- /mm/post      {"channel": "...", "text": "...", "threadId": "optional post id to reply to"}
+- /mm/react     {"postId": "...", "emoji": "white_check_mark"}
+- /mm/dm        {"person": "username", "text": "..."}   only people allowed to talk to you
+
+Channels (POST, JSON body):
+- /mm/channels                   {"name": "inc checkout 5xx", "purpose": "...", "people": ["username"],
+                                  "agents": ["cto"], "taskId": "BAD-123 or task id", "private": true}
+  Private by default. A public channel needs approval. With taskId, the channel is tied to the
+  task: its comments and status show up there, and it is archived when the task closes.
+- /mm/channels/{channel}/invite  {"people": [...], "agents": [...]}   free on channels you created
+- /mm/channels/{channel}/update  {"purpose": "...", "header": "...", "name": "..."}  yours only
+- /mm/channels/{channel}/archive {}                                   yours only
+
+{channel} is a channel's id, its URL name (inc-checkout-5xx) or its display name.
+`;
+
+// src/worker.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
 // src/bridge.ts
+var DEFAULT_TURN_LIMIT = 10;
 var TYPING_EVERY_MS = 3e3;
 var OLD_PLACEHOLDER = /^_(thinking…|.+ is working on it…)_/;
 var MAX_POST = 15e3;
@@ -45032,9 +45524,11 @@ var Bridge = class {
   files;
   choiceButtons;
   canTalk;
+  turnLimit;
   constructor(roster, directory, agents, store, log = () => {
-  }, files = null, choiceButtons = null, canTalk = null) {
+  }, files = null, choiceButtons = null, canTalk = null, turnLimit = DEFAULT_TURN_LIMIT) {
     this.files = files;
+    this.turnLimit = turnLimit;
     this.canTalk = canTalk;
     this.choiceButtons = choiceButtons;
     this.roster = roster;
@@ -45064,6 +45558,42 @@ var Bridge = class {
   activeThread(agentId) {
     return this.active.get(agentId) ?? null;
   }
+  /** The agent another agent's post addresses: the first other agent it mentions. */
+  mentioned(evt, author) {
+    if (evt.channelType === "D") return void 0;
+    const roster = this.roster();
+    for (const name of mentions(evt.post.message)) {
+      const member = roster.byUsername(name);
+      if (member && member.agentId !== author.agentId) return member;
+    }
+    return void 0;
+  }
+  /**
+   * Agents may address agents, up to the turn limit per thread; a person posting in the
+   * thread resets it. At the limit the addressed agent says once that it is waiting.
+   */
+  async resetTurns(rootId) {
+    const turns = await this.store.get(`turns:${rootId}`);
+    if (turns?.n) await this.store.set(`turns:${rootId}`, { n: 0 });
+  }
+  async allowAgentTurn(rootId, fromAgent, member, channelId) {
+    if (!fromAgent) {
+      await this.resetTurns(rootId);
+      return true;
+    }
+    const key = `turns:${rootId}`;
+    const turns = await this.store.get(key) ?? { n: 0 };
+    if (turns.n >= this.turnLimit) {
+      if (!turns.paused) {
+        await this.store.set(key, { ...turns, paused: true });
+        await member.chat.createPost(channelId, rootId, `_Pausing here: agents have traded ${turns.n} messages in this thread. Reply to let us carry on._`).catch(() => {
+        });
+      }
+      return false;
+    }
+    await this.store.set(key, { n: turns.n + 1 });
+    return true;
+  }
   target(evt, thread) {
     const roster = this.roster();
     if (evt.channelType === "D") {
@@ -45091,15 +45621,21 @@ var Bridge = class {
   async process(evt, rootId) {
     const { post } = evt;
     const roster = this.roster();
-    if (roster.isBot(post.user_id) || post.type || post.props?.from_bot === "true" || post.props?.from_webhook === "true") return;
+    const fromAgent = roster.isBot(post.user_id) ? roster.byBotId(post.user_id) : void 0;
+    if (post.type || post.props?.from_webhook === "true" || post.props?.from_paperclip === "true") return;
+    if (post.props?.from_bot === "true" && !fromAgent) return;
     const threadKey = `thread:${rootId}`;
     const thread = await this.store.get(threadKey);
-    const member = this.target(evt, thread);
-    if (!member) return;
+    const member = fromAgent ? this.mentioned(evt, fromAgent) : this.target(evt, thread);
+    if (!member) {
+      if (!fromAgent && post.root_id) await this.resetTurns(rootId);
+      return;
+    }
+    if (!await this.allowAgentTurn(rootId, fromAgent, member, post.channel_id)) return;
     const text2 = stripMention(post.message, member.username);
     const fileIds = this.files ? post.file_ids ?? [] : [];
     if (!text2 && !fileIds.length) return;
-    if (this.canTalk && !await this.canTalk(post.user_id, member.agentId)) {
+    if (!fromAgent && this.canTalk && !await this.canTalk(post.user_id, member.agentId)) {
       await this.directory.notify(post.user_id, post.channel_id, post.root_id ?? "", `You don't have access to talk to ${member.agentName} here. Ask a Paperclip admin to add you in the Mattermost plugin's settings.`).catch(() => {
       });
       return;
@@ -45130,7 +45666,8 @@ var Bridge = class {
     const { sender, where, history, text: text2, fileIds } = m;
     const attached = fileIds.length ? await this.files.receive(member.chat, post.id, fileIds) : [];
     const outbox = this.files ? await this.files.outbox(post.id).catch(() => null) : null;
-    const prompt = `${sender.displayName} (@${sender.username}) wrote to you (@${member.username}) in ${where} on Mattermost. Your reply is posted back there, so answer in Markdown. To offer choices, end your reply with one line \`choices: First | Second\` (2 to ${MAX_CHOICES} short options); they are shown as buttons, and the pick comes back as the next message.` + (history ? `
+    const fromAgent = this.roster().isBot(post.user_id);
+    const prompt = `${sender.displayName} (@${sender.username}${fromAgent ? ", another agent" : ""}) wrote to you (@${member.username}) in ${where} on Mattermost. Your reply is posted back there, so answer in Markdown. To offer choices, end your reply with one line \`choices: First | Second\` (2 to ${MAX_CHOICES} short options); they are shown as buttons, and the pick comes back as the next message. You can also read channels, post, message people, mention other agents and open work channels in Mattermost: GET <your Paperclip API URL>/api/plugins/mattermost-bridge/api/mm/help shows how.` + (history ? `
 
 Earlier in this thread (oldest first):
 ${history}
@@ -45512,6 +46049,9 @@ var AgentBots = class {
       isBot: (id) => all.some((m) => m.botUserId === id)
     };
   }
+  all() {
+    return [...this.members.values()];
+  }
   /** The Mattermost client of an agent's bot, for posts beyond chat replies. */
   clientOf(agentId) {
     return this.members.get(agentId)?.client;
@@ -45654,10 +46194,11 @@ var AgentBots = class {
 };
 
 // src/manifest.ts
+var route = (routeKey, method, path3) => ({ routeKey, method, path: path3, auth: "agent", capability: "api.routes.register" });
 var manifest = {
   id: "mattermost-bridge",
   apiVersion: 1,
-  version: "0.12.0",
+  version: "0.13.0",
   displayName: "Mattermost",
   description: "Every agent becomes its own Mattermost bot. DM an agent or mention it in a channel and it answers in the thread, showing its steps as it works; follow-ups continue the conversation. Paperclip approvals arrive with Approve / Reject buttons.",
   author: "Haseeb Azhar",
@@ -45681,11 +46222,32 @@ var manifest = {
     "issue.interactions.read",
     "issue.interactions.respond",
     "issue.comments.create",
-    "issue.comments.create_human_attributed"
+    "issue.comments.create_human_attributed",
+    "issue.comments.read",
+    "api.routes.register"
   ],
   entrypoints: { worker: "./dist/worker.js", ui: "./dist/ui" },
   // Replaces the generated form: approvers picked from members, URL detected and checked.
   ui: { slots: [{ type: "settingsPage", id: "mattermost-settings", displayName: "Mattermost", exportName: "SettingsPage" }] },
+  // What agents do in Mattermost as their own bot (src/actions.ts). Agent-only: the host
+  // checks the caller is an agent and scopes it to that agent's company.
+  apiRoutes: [
+    route("help", "GET", "/mm/help"),
+    route("channels", "GET", "/mm/channels"),
+    route("channel-posts", "GET", "/mm/channels/:channel/posts"),
+    route("thread", "GET", "/mm/posts/:postId/thread"),
+    route("channel-members", "GET", "/mm/channels/:channel/members"),
+    route("search", "GET", "/mm/search"),
+    route("people", "GET", "/mm/people"),
+    route("request", "GET", "/mm/requests/:id"),
+    route("post", "POST", "/mm/post"),
+    route("react", "POST", "/mm/react"),
+    route("dm", "POST", "/mm/dm"),
+    route("create-channel", "POST", "/mm/channels"),
+    route("invite", "POST", "/mm/channels/:channel/invite"),
+    route("update-channel", "POST", "/mm/channels/:channel/update"),
+    route("archive", "POST", "/mm/channels/:channel/archive")
+  ],
   webhooks: [
     { endpointKey: "actions", displayName: "Mattermost buttons", description: "Approve / Reject clicks on approval posts. Every click carries a signature the plugin checks." }
   ],
@@ -45735,6 +46297,14 @@ var manifest = {
         description: "Each person by email, with `agents` listing the agent ids they may talk to (absent: all agents). People outside Paperclip have no userId.",
         items: { type: "object", properties: { userId: { type: "string" }, email: { type: "string" }, name: { type: "string" }, agents: { type: "array", items: { type: "string" } } }, required: ["email"] }
       },
+      agentTurnLimit: {
+        type: "integer",
+        minimum: 1,
+        maximum: 100,
+        default: 10,
+        title: "Agent-to-agent turns",
+        description: "How many messages agents may trade in one thread, mentioning each other, before a person must reply."
+      },
       approvers: {
         type: "array",
         title: "Approvers",
@@ -45776,7 +46346,10 @@ var Tenant = class {
   bridge = null;
   approvals = null;
   cards = null;
+  actions = null;
+  work = null;
   key = "";
+  approvers = /* @__PURE__ */ new Map();
   timers = [];
   agents() {
     const companyId = this.companyId;
@@ -45857,8 +46430,8 @@ var Tenant = class {
           }
         }
         for (const team of teams) {
-          const list = await manager.request("GET", `/teams/${team.id}/channels?per_page=200`).catch(() => []);
-          const hit = list.find((ch) => ch.display_name.trim().toLowerCase() === wanted.toLowerCase());
+          const list2 = await manager.request("GET", `/teams/${team.id}/channels?per_page=200`).catch(() => []);
+          const hit = list2.find((ch) => ch.display_name.trim().toLowerCase() === wanted.toLowerCase());
           if (hit) return hit.id;
         }
         return null;
@@ -45882,6 +46455,7 @@ var Tenant = class {
     const paperclipUrl = typeof config2.paperclipUrl === "string" ? config2.paperclipUrl.trim().replace(/\/+$/, "") : "";
     const actionUrl = `${paperclipUrl}/api/plugins/${PLUGIN_KEY}/webhooks/actions`;
     const key = createHmac2("sha256", token).update("mattermost-approval-buttons").digest("hex");
+    const canTalk = accessCheck(manager, config2);
     const bridge = new Bridge(
       () => roster.roster(),
       directoryOf(manager),
@@ -45890,7 +46464,8 @@ var Tenant = class {
       warn,
       diskFiles(),
       paperclipUrl ? (where, choices) => this.tag(choiceProps(key, actionUrl, where, choices)) : null,
-      accessCheck(manager, config2)
+      canTalk,
+      Number(config2.agentTurnLimit) > 0 ? Number(config2.agentTurnLimit) : DEFAULT_TURN_LIMIT
     );
     onPosted = (evt) => {
       void bridge.handle(evt);
@@ -45930,7 +46505,41 @@ var Tenant = class {
       channel: approvalsChannel,
       approvers
     }) : null;
-    Object.assign(this, { manager, bots: roster, bridge, approvals, cards, key });
+    const poster = this.poster(manager, roster);
+    const actions = new Actions({
+      bot: (agentId) => roster.clientOf(agentId),
+      manager,
+      agents: () => roster.all().map((m) => ({ agentId: m.agentId, agentName: m.agentName, username: m.username, botUserId: m.botUserId })),
+      canTalk: async (userId, agentId) => !canTalk || canTalk(userId, agentId),
+      origin: (agentId) => bridge.activeThread(agentId),
+      task: async (taskId) => await ctx.issues.get(taskId, companyId),
+      askApproval: async (req) => {
+        if (!paperclipUrl || !approvers.size) throw Object.assign(new Error("this needs a person's approval, and nobody can approve from Mattermost yet (the plugin needs its Paperclip public URL and approvers set)"), { status: 403 });
+        const { message: message2, props } = requestCard(req, actionUrl, key);
+        const targets = [req.origin, approvalsChannel ? await poster.channel(approvalsChannel).then((id) => id && id !== req.origin?.channelId ? { channelId: id, rootId: "" } : null) : null];
+        const postIds = [];
+        for (const where of targets) if (where) postIds.push(await poster.post(req.agentId, where, message2, props));
+        await store.set(`reqcard:${req.id}`, postIds);
+      },
+      store,
+      newId: () => randomUUID2()
+    });
+    const work = new WorkLinks({
+      store,
+      post: async (agentId, channelId, rootId, text2) => {
+        const as = roster.clientOf(agentId) ?? manager;
+        await as.request("POST", "/posts", { channel_id: channelId, root_id: rootId, message: text2, props: FROM_PAPERCLIP });
+      },
+      hasBot: (agentId) => Boolean(roster.clientOf(agentId)),
+      agentName: (agentId) => agentName(agentId),
+      archive: async (channelId) => {
+        await manager.request("DELETE", `/channels/${channelId}`);
+      },
+      channelName: async (channelId) => (await manager.request("GET", `/channels/${channelId}`)).display_name,
+      task: async (issueId) => await ctx.issues.get(issueId, companyId),
+      comments: async (issueId) => (await ctx.issues.listComments(issueId, companyId)).map((c) => ({ id: c.id, body: c.body, authorAgentId: c.authorAgentId }))
+    });
+    Object.assign(this, { manager, bots: roster, bridge, approvals, cards, actions, work, key, approvers });
     this.status = `connecting to ${url2} as @${manager.botUsername}`;
     detached(() => {
       manager.connect(onPosted);
@@ -45953,7 +46562,28 @@ var Tenant = class {
     this.timers = [];
     this.bots?.close();
     this.manager?.close();
-    Object.assign(this, { manager: null, bots: null, bridge: null, approvals: null, cards: null });
+    Object.assign(this, { manager: null, bots: null, bridge: null, approvals: null, cards: null, actions: null, work: null });
+  }
+  /** Approve / Reject on an agent's ask-first request (a broadcast, a public channel, an invite). */
+  async decideRequest(req) {
+    const { requestId, action, sig: sig2 } = req.context ?? {};
+    if (!this.actions || !this.manager || !requestId || action !== "approve" && action !== "reject" || !signed(this.key, `req:${requestId}`, action, sig2)) return "This button is not valid.";
+    const email3 = req.user_id ? (await this.manager.request("GET", `/users/${req.user_id}`).catch(() => ({ email: "" }))).email?.toLowerCase() : "";
+    if (!email3 || !this.approvers.has(email3)) return "You are not set up to approve agent requests from Mattermost. Ask an admin to add your email to the plugin's approvers.";
+    const decided = await this.actions.decide(requestId, action === "approve", req.user_name ? `@${req.user_name}` : email3);
+    if (!decided) return "That request is gone.";
+    const { message: message2, props } = requestCard(decided, "", this.key);
+    const store = this.store();
+    for (const postId of await store.get(`reqcard:${requestId}`) ?? []) {
+      await this.manager.request("PUT", `/posts/${postId}/patch`, { message: message2, props }).catch(() => {
+      });
+    }
+    return null;
+  }
+  /** An agent's call to one of the plugin's `/mm/...` routes. */
+  async api(agentId, routeKey, params, input2) {
+    if (!this.actions) return { status: 503, body: { error: `Mattermost is not connected for this company (${this.status})` } };
+    return this.actions.handle(agentId, routeKey, params, input2);
   }
   async notify(req, notice) {
     if (notice && req.user_id && req.channel_id) {
@@ -45969,6 +46599,10 @@ var Tenant = class {
       if (this.cards) await this.notify(req, await this.cards.click(req).catch(failed));
       return;
     }
+    if (kind === "request") {
+      await this.notify(req, await this.decideRequest(req).catch(failed));
+      return;
+    }
     if (kind === "choice") {
       const choice = req.context;
       if (!this.manager || !this.bridge || !req.user_id || !req.post_id || !verifyChoice(this.key, choice)) return;
@@ -45986,6 +46620,28 @@ var Tenant = class {
     if (this.approvals) await this.notify(req, await this.approvals.click(req).catch(failed));
   }
 };
+function requestCard(r, actionUrl, key) {
+  const pending2 = r.status === "pending";
+  const button = (id, name, style) => ({
+    id,
+    name,
+    style,
+    type: "button",
+    integration: { url: actionUrl, context: { kind: "request", requestId: r.id, action: id, sig: sign(key, `req:${r.id}`, id) } }
+  });
+  const outcome = r.status === "approved" ? ":white_check_mark: Approved" : r.status === "rejected" ? ":x: Rejected" : ":warning: Approved, but it failed";
+  return {
+    message: `**${r.agentName}** asks to ${r.summary}`,
+    props: {
+      attachments: [{
+        color: pending2 ? "#f2a900" : r.status === "approved" ? "#3db887" : "#d24b4e",
+        text: `Needs approval because ${r.why}.`,
+        footer: pending2 ? "Approvers decide here" : `${outcome} by ${r.decidedBy}`,
+        actions: pending2 ? [button("approve", "Approve", "primary"), button("reject", "Reject", "danger")] : []
+      }]
+    }
+  };
+}
 function directoryOf(manager) {
   return {
     userName: (id) => manager.userName(id),
@@ -46038,8 +46694,8 @@ var plugin = definePlugin({
       const accounts = {};
       if (manager) {
         for (const team of await manager.request("GET", "/users/me/teams").catch(() => [])) {
-          const list = await manager.request("GET", `/teams/${team.id}/channels?per_page=200`).catch(() => []);
-          channels.push(...list.filter((ch) => ch.type === "O").map((ch) => ({ name: ch.name, displayName: ch.display_name })));
+          const list2 = await manager.request("GET", `/teams/${team.id}/channels?per_page=200`).catch(() => []);
+          channels.push(...list2.filter((ch) => ch.type === "O").map((ch) => ({ name: ch.name, displayName: ch.display_name })));
         }
         channels = channels.sort((a, b) => a.displayName.localeCompare(b.displayName));
         for (const email3 of emails) {
@@ -46053,6 +46709,13 @@ var plugin = definePlugin({
     ctx.events.on("approval.created", (e) => quietly("could not post approval", async () => {
       if (e.entityId) await tenants.get(e.companyId)?.approvals?.created(e.entityId);
     }));
+    ctx.events.on("issue.comment.created", (e) => quietly("could not mirror a task comment", async () => {
+      const commentId = e.payload?.commentId;
+      if (e.entityId && commentId) await tenants.get(e.companyId)?.work?.comment(e.entityId, commentId);
+    }));
+    ctx.events.on("issue.updated", (e) => quietly("could not follow a task update", async () => {
+      if (e.entityId) await tenants.get(e.companyId)?.work?.updated(e.entityId);
+    }));
     ctx.events.on("approval.decided", (e) => quietly("could not update approval", async () => {
       if (e.entityId) await tenants.get(e.companyId)?.approvals?.decided(e.entityId);
     }));
@@ -46080,16 +46743,27 @@ var plugin = definePlugin({
     const tenant = typeof companyId === "string" ? tenants.get(companyId) : tenants.size === 1 ? [...tenants.values()][0] : void 0;
     await tenant?.click(req);
   },
+  async onApiRequest(input2) {
+    const agentId = input2.actor.agentId;
+    if (input2.actor.actorType !== "agent" || !agentId) return { status: 403, body: { error: "Only agents call these routes." } };
+    if (input2.routeKey === "help") return { status: 200, headers: { "content-type": "text/markdown; charset=utf-8" }, body: HELP };
+    const tenant = tenants.get(input2.companyId);
+    if (!tenant) return { status: 503, body: { error: "Mattermost is not set up for your company." } };
+    const query = Object.fromEntries(Object.entries(input2.query).map(([k, v]) => [k, Array.isArray(v) ? v[0] : v]));
+    const body = input2.body && typeof input2.body === "object" && !Array.isArray(input2.body) ? input2.body : {};
+    const res = await tenant.api(agentId, input2.routeKey, input2.params, { ...query, ...body });
+    return { status: res.status, body: res.body };
+  },
   async onHealth() {
     if (!tenants.size) return { status: "error", message: "not configured: set up Mattermost in this plugin's settings for a company" };
-    let ok = true;
+    let ok2 = true;
     const parts = [...tenants.values()].map((t) => {
       const live = t.bots?.connected ?? 0;
       const total = t.bots?.size ?? 0;
-      if (!t.manager?.connected || live !== total || !total) ok = false;
+      if (!t.manager?.connected || live !== total || !total) ok2 = false;
       return `${t.status}; ${live}/${total} agent bots connected`;
     });
-    return { status: ok ? "ok" : "degraded", message: parts.join(" | ") + (versionNote ? ` | Note: ${versionNote}` : "") };
+    return { status: ok2 ? "ok" : "degraded", message: parts.join(" | ") + (versionNote ? ` | Note: ${versionNote}` : "") };
   },
   async onShutdown() {
     for (const t of tenants.values()) t.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paperclip-plugin-mattermost",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Paperclip agents in Mattermost: a bot per agent, live progress, files, approval and decision buttons, and per-person access, for each Paperclip company.",
   "type": "module",
   "license": "MIT",