slackhive 0.1.37 → 0.1.39

package/apps/web/src/lib/diff.ts

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview LCS-based line diff utility.
+ *
+ * Extracted from the agent detail page so it can be imported in Node
+ * test environments without pulling in React/Next.js dependencies.
+ *
+ * @module web/lib/diff
+ */
+
+/** A single line in a diff result, annotated with its change type. */
+export type DiffLine = { type: 'same' | 'add' | 'remove'; line: string };
+
+/**
+ * Computes a line-level diff between two text strings using the
+ * Longest Common Subsequence algorithm.
+ *
+ * @param {string} oldText - The original text.
+ * @param {string} newText - The updated text.
+ * @returns {DiffLine[]} Ordered diff entries annotated as same/add/remove.
+ */
+export function lineDiff(oldText: string, newText: string): DiffLine[] {
+  const a = oldText.split('\n');
+  const b = newText.split('\n');
+  const m = a.length, n = b.length;
+  // Build LCS table
+  const dp: number[][] = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 1; i <= m; i++)
+    for (let j = 1; j <= n; j++)
+      dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] + 1 : Math.max(dp[i - 1][j], dp[i][j - 1]);
+  // Trace back
+  const result: DiffLine[] = [];
+  let i = m, j = n;
+  while (i > 0 || j > 0) {
+    if (i > 0 && j > 0 && a[i - 1] === b[j - 1]) {
+      result.unshift({ type: 'same', line: a[i - 1] }); i--; j--;
+    } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
+      result.unshift({ type: 'add', line: b[j - 1] }); j--;
+    } else {
+      result.unshift({ type: 'remove', line: a[i - 1] }); i--;
+    }
+  }
+  return result;
+}

package/apps/web/src/lib/mcp-mask.ts

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview MCP server config masking utilities.
+ *
+ * Sensitive values in MCP configs (env vars for stdio, headers for sse/http)
+ * must never be returned to the client in plaintext. This module provides
+ * masking for API GET responses and merge logic for PATCH requests so that
+ * a client sending back "********" placeholders does not overwrite real values.
+ *
+ * @module web/lib/mcp-mask
+ */
+
+import type { McpServer, McpServerConfig } from '@slackhive/shared';
+
+const MASK = '********';
+
+/**
+ * Returns a copy of the MCP config with all secret values replaced by MASK.
+ * - stdio: masks each value in `config.env`
+ * - sse/http: masks each value in `config.headers`
+ *
+ * @param {McpServerConfig} config - Raw config from DB.
+ * @returns {McpServerConfig} Masked config safe for API responses.
+ */
+export function maskMcpConfig(config: McpServerConfig): McpServerConfig {
+  const c = config as unknown as Record<string, unknown>;
+  if (c.env && typeof c.env === 'object') {
+    const masked: Record<string, string> = {};
+    for (const key of Object.keys(c.env as Record<string, string>)) {
+      masked[key] = MASK;
+    }
+    // envRefs and tsSource are not secrets — pass through unchanged
+    return { ...c, env: masked } as McpServerConfig;
+  }
+  if (c.headers && typeof c.headers === 'object') {
+    const masked: Record<string, string> = {};
+    for (const key of Object.keys(c.headers as Record<string, string>)) {
+      masked[key] = MASK;
+    }
+    return { ...c, headers: masked } as McpServerConfig;
+  }
+  return config;
+}
+
+/**
+ * Returns a copy of the MCP server with its config secrets masked.
+ *
+ * @param {McpServer} server - Full server record from DB.
+ * @returns {McpServer} Server safe for API responses.
+ */
+export function maskMcpServer(server: McpServer): McpServer {
+  return { ...server, config: maskMcpConfig(server.config) };
+}
+
+/**
+ * Merges an incoming (possibly masked) config from a PATCH request with the
+ * existing config stored in the DB. Any value equal to MASK is replaced with
+ * the corresponding existing value, preserving secrets the client never saw.
+ *
+ * @param {McpServerConfig} existing - Current config from DB (unmasked).
+ * @param {McpServerConfig} incoming - Config from PATCH body (may contain MASK values).
+ * @returns {McpServerConfig} Merged config safe to write back to DB.
+ */
+export function mergeMcpConfig(existing: McpServerConfig, incoming: McpServerConfig): McpServerConfig {
+  const e = existing as unknown as Record<string, unknown>;
+  const i = incoming as unknown as Record<string, unknown>;
+
+  if (i.env && typeof i.env === 'object' && e.env && typeof e.env === 'object') {
+    const merged: Record<string, string> = { ...(e.env as Record<string, string>) };
+    for (const [key, val] of Object.entries(i.env as Record<string, string>)) {
+      merged[key] = val === MASK ? (merged[key] ?? val) : val;
+    }
+    // Remove keys not present in incoming (user deleted them)
+    for (const key of Object.keys(merged)) {
+      if (!(key in (i.env as Record<string, string>))) delete merged[key];
+    }
+    return { ...i, env: merged } as McpServerConfig;
+  }
+
+  if (i.headers && typeof i.headers === 'object' && e.headers && typeof e.headers === 'object') {
+    const merged: Record<string, string> = { ...(e.headers as Record<string, string>) };
+    for (const [key, val] of Object.entries(i.headers as Record<string, string>)) {
+      merged[key] = val === MASK ? (merged[key] ?? val) : val;
+    }
+    for (const key of Object.keys(merged)) {
+      if (!(key in (i.headers as Record<string, string>))) delete merged[key];
+    }
+    return { ...i, headers: merged } as McpServerConfig;
+  }
+
+  return incoming;
+}

package/apps/web/src/lib/portal.tsx

@@ -0,0 +1,23 @@
+'use client';
+
+/**
+ * @fileoverview React portal — renders children into document.body.
+ * Ensures modals escape any parent overflow/transform constraints.
+ *
+ * @module web/lib/portal
+ */
+
+import { useEffect, useState } from 'react';
+import { createPortal } from 'react-dom';
+
+/**
+ * Renders children into document.body via a React portal.
+ *
+ * @param {{ children: React.ReactNode }} props
+ */
+export function Portal({ children }: { children: React.ReactNode }) {
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => { setMounted(true); }, []);
+  if (!mounted) return null;
+  return createPortal(children, document.body);
+}

package/apps/web/src/lib/skill-templates.ts

@@ -0,0 +1,148 @@
+/**
+ * @fileoverview Built-in skill templates for bootstrapping new agents.
+ *
+ * When creating a new agent, users choose a template that provides starter
+ * skill files. These are seeded into the `skills` table and compiled into
+ * the agent's initial CLAUDE.md.
+ *
+ * Templates:
+ * - `blank`        — Minimal identity skill only
+ * - `data-analyst` — SQL/data analysis (based on NLQ bot patterns)
+ * - `writer`       — Content generation and summarization
+ * - `developer`    — Code review and development assistance
+ *
+ * @module web/lib/skill-templates
+ */
+
+import type { Agent, SkillTemplate } from '@slackhive/shared';
+
+/** A skill file definition for seeding. */
+interface SkillSeed {
+  category: string;
+  filename: string;
+  content: string;
+  sortOrder: number;
+}
+
+/**
+ * Map of template name → function that generates initial skill seeds.
+ * Each function receives the newly created agent for name/persona interpolation.
+ */
+export const SKILL_TEMPLATES: Record<SkillTemplate, (agent: Agent) => SkillSeed[]> = {
+
+  blank: (agent) => [
+    {
+      category: '00-core',
+      filename: 'identity.md',
+      sortOrder: 0,
+      content: `# ${agent.name}
+
+${agent.persona ?? `You are ${agent.name}, a helpful AI assistant.`}
+
+${agent.description ? `## What you do\n\n${agent.description}` : ''}
+`,
+    },
+  ],
+
+  'data-analyst': (agent) => [
+    {
+      category: '00-core',
+      filename: 'identity.md',
+      sortOrder: 0,
+      content: `# ${agent.name}
+
+${agent.persona ?? `You are ${agent.name}, a data analyst AI agent.`}
+
+Users ask business questions in plain English. You investigate the data,
+run queries when needed, and deliver clear, concise insights.
+`,
+    },
+    {
+      category: '00-core',
+      filename: 'workflow.md',
+      sortOrder: 1,
+      content: `# Workflow
+
+1. **Understand** the question — identify metrics, dimensions, and time range
+2. **Discover** schema if needed — describe tables, find columns
+3. **Plan** the query — identify joins, aggregations, filters
+4. **Execute** — run the query and validate results
+5. **Respond** — present findings clearly with numbers from actual query results
+
+## Rules
+- Always run queries before stating numbers — never guess
+- Validate JOIN fan-out before returning aggregations
+- If a query returns no results, investigate why before concluding
+`,
+    },
+    {
+      category: '00-core',
+      filename: 'response-format.md',
+      sortOrder: 2,
+      content: `# Response Format
+
+- Lead with the answer, then supporting data
+- Use Slack formatting: *bold* for metrics, \`code\` for table/column names
+- Format numbers: 1,234 (comma-separated), percentages with 1 decimal
+- Use tables for comparisons (pipe-delimited Markdown)
+- Keep responses concise — no filler phrases
+`,
+    },
+  ],
+
+  writer: (agent) => [
+    {
+      category: '00-core',
+      filename: 'identity.md',
+      sortOrder: 0,
+      content: `# ${agent.name}
+
+${agent.persona ?? `You are ${agent.name}, a content writing and summarization AI agent.`}
+
+You help teams generate clear, well-structured written content: summaries,
+announcements, reports, Slack messages, and documentation.
+`,
+    },
+    {
+      category: '00-core',
+      filename: 'style-guide.md',
+      sortOrder: 1,
+      content: `# Writing Style Guide
+
+- Be clear and concise — cut unnecessary words
+- Active voice over passive voice
+- Use bullet points for lists of 3+ items
+- Match the tone to the audience (technical vs. executive)
+- For Slack: use *bold* for key points, avoid walls of text
+`,
+    },
+  ],
+
+  developer: (agent) => [
+    {
+      category: '00-core',
+      filename: 'identity.md',
+      sortOrder: 0,
+      content: `# ${agent.name}
+
+${agent.persona ?? `You are ${agent.name}, a software development AI agent.`}
+
+You help with code review, debugging, architecture decisions, and
+implementation guidance. You prioritize correctness, security, and readability.
+`,
+    },
+    {
+      category: '00-core',
+      filename: 'code-standards.md',
+      sortOrder: 1,
+      content: `# Code Standards
+
+- Prefer simple, explicit code over clever abstractions
+- Always consider security implications (injection, XSS, auth)
+- Write tests for non-trivial logic
+- Follow the existing patterns in the codebase
+- Explain why, not just what
+`,
+    },
+  ],
+};

package/apps/web/src/lib/slack-manifest.ts

@@ -0,0 +1,85 @@
+/**
+ * @fileoverview Slack app manifest generator for the agent onboarding wizard.
+ *
+ * Generates a Slack app manifest JSON that users can paste directly into
+ * api.slack.com/apps to create a new Slack app with the correct permissions
+ * and configuration for a Claude Code agent.
+ *
+ * @module web/lib/slack-manifest
+ */
+
+import type { SlackAppManifest } from '@slackhive/shared';
+import { DEFAULT_SLACK_BOT_SCOPES, BOSS_ADDITIONAL_SCOPES } from '@slackhive/shared';
+
+/**
+ * Generates a complete Slack app manifest for an agent.
+ *
+ * The manifest is pre-configured with:
+ * - The agent's display name and description
+ * - All required OAuth bot scopes
+ * - Socket Mode enabled (required for the Bolt App)
+ * - Subscriptions to app_mention, message.im, and member_joined_channel events
+ *
+ * @param {object} opts - Manifest generation options.
+ * @param {string} opts.name - Agent display name.
+ * @param {string} [opts.description] - Short description of the agent.
+ * @param {boolean} [opts.isBoss] - Whether this is the boss agent (adds extra scopes).
+ * @returns {SlackAppManifest} Complete Slack app manifest object.
+ *
+ * @example
+ * const manifest = generateSlackManifest({ name: 'GILFOYLE', description: 'Data analyst' });
+ * // Copy JSON to api.slack.com/apps → Create from Manifest
+ */
+export function generateSlackManifest(opts: {
+  name: string;
+  description?: string;
+  isBoss?: boolean;
+}): SlackAppManifest {
+  const scopes = opts.isBoss
+    ? [...DEFAULT_SLACK_BOT_SCOPES, ...BOSS_ADDITIONAL_SCOPES]
+    : [...DEFAULT_SLACK_BOT_SCOPES];
+
+  // Deduplicate scopes
+  const uniqueScopes = [...new Set(scopes)];
+
+  return {
+    display_information: {
+      name: opts.name,
+      description: opts.description ?? `${opts.name} — Claude Code AI agent`,
+      background_color: '#1a1a1a',
+    },
+    features: {
+      bot_user: {
+        display_name: opts.name,
+        always_online: true,
+      },
+      app_home: {
+        home_tab_enabled: false,
+        messages_tab_enabled: true,
+        messages_tab_read_only_enabled: false,
+      },
+    },
+    oauth_config: {
+      scopes: {
+        bot: uniqueScopes,
+      },
+    },
+    settings: {
+      event_subscriptions: {
+        bot_events: [
+          'app_mention',
+          'message.channels',
+          'message.groups',
+          'message.im',
+          'member_joined_channel',
+        ],
+      },
+      interactivity: {
+        is_enabled: false,
+      },
+      socket_mode_enabled: true,
+      token_rotation_enabled: false,
+      org_deploy_enabled: false,
+    },
+  };
+}

package/apps/web/src/middleware.ts

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Next.js middleware — protects all routes with auth.
+ *
+ * Redirects unauthenticated users to /login.
+ * Skips: /login, /api/auth/*, static assets.
+ *
+ * Uses crypto.subtle (Edge Runtime compatible) for HMAC verification.
+ *
+ * @module web/middleware
+ */
+
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+if (process.env.NODE_ENV === 'production' && !process.env.CI && !process.env.AUTH_SECRET) {
+  throw new Error('AUTH_SECRET must be set in production. See .env.example.');
+}
+
+const AUTH_SECRET = process.env.AUTH_SECRET || 'change-this-secret-in-production';
+const COOKIE_NAME = 'auth_session';
+
+/**
+ * Verifies HMAC signature using Edge-compatible crypto.subtle.
+ *
+ * @param {string} data - The base64url-encoded payload.
+ * @param {string} sig - The base64url-encoded signature.
+ * @returns {Promise<boolean>} True if valid.
+ */
+async function verifyHmac(data: string, sig: string): Promise<boolean> {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    'raw', enc.encode(AUTH_SECRET), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
+  );
+  const signature = await crypto.subtle.sign('HMAC', key, enc.encode(data));
+  const expected = btoa(String.fromCharCode(...new Uint8Array(signature)))
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+  return sig === expected;
+}
+
+/**
+ * Middleware function — checks auth cookie on every non-public route.
+ *
+ * @param {NextRequest} req - Incoming request.
+ * @returns {Promise<NextResponse>} Response or redirect.
+ */
+export async function middleware(req: NextRequest): Promise<NextResponse> {
+  const cookie = req.cookies.get(COOKIE_NAME)?.value;
+
+  if (!cookie) {
+    return NextResponse.redirect(new URL('/login', req.url));
+  }
+
+  const parts = cookie.split('.');
+  if (parts.length !== 2) {
+    return NextResponse.redirect(new URL('/login', req.url));
+  }
+
+  const valid = await verifyHmac(parts[0], parts[1]);
+  if (!valid) {
+    return NextResponse.redirect(new URL('/login', req.url));
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ['/((?!login|api/auth|_next/static|_next/image|favicon\\.ico|logo\\.svg).*)'],
+};

package/apps/web/tailwind.config.js

@@ -0,0 +1,6 @@
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: ['./src/**/*.{js,ts,jsx,tsx,mdx}'],
+  theme: { extend: {} },
+  plugins: [],
+};

package/apps/web/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/apps/web/vitest.config.mts

@@ -0,0 +1,21 @@
+import { defineConfig } from 'vitest/config';
+import path from 'path';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: true,
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'lcov'],
+      include: ['src/lib/**', 'src/app/agents/**'],
+      exclude: ['src/app/agents/[slug]/page.tsx'], // UI component — tested separately
+    },
+  },
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+      '@slackhive/shared': path.resolve(__dirname, '../../packages/shared/src'),
+    },
+  },
+});

package/cli/.claude/settings.local.json

@@ -0,0 +1,6 @@
+{
+  "enabledMcpjsonServers": [
+    "redshift"
+  ],
+  "enableAllProjectMcpServers": true
+}