sparkecoder 0.1.107 → 0.1.109

package/dist/db/index.d.ts

@@ -1,5 +1,5 @@
-import { C as Checkpoint, F as FileBackup, M as ModelMessage, a as Message, S as Session, L as LoadedSkill, T as TodoItem, b as ToolExecution, A as ActiveStream, I as IndexStatusRecord, c as IndexedChunk, d as SubagentExecution, e as SubagentStep, f as Terminal } from '../schema-ecQSnCMz.js';
-export { N as NewActiveStream, g as NewCheckpoint, h as NewFileBackup, i as NewIndexStatusRecord, j as NewIndexedChunk, k as NewMessage, l as NewSession, m as NewSubagentExecution, n as NewTerminal, o as NewTodoItem, p as NewToolExecution, q as SessionConfig, r as TaskConfig, U as UserContentPart, s as UserFilePart, t as UserImagePart, u as UserModelMessage, v as UserTextPart } from '../schema-ecQSnCMz.js';
+import { C as Checkpoint, F as FileBackup, M as ModelMessage, a as Message, S as Session, L as LoadedSkill, T as TodoItem, b as ToolExecution, A as ActiveStream, I as IndexStatusRecord, c as IndexedChunk, d as SubagentExecution, e as SubagentStep, f as Terminal } from '../schema-CYSKJZ3m.js';
+export { N as NewActiveStream, g as NewCheckpoint, h as NewFileBackup, i as NewIndexStatusRecord, j as NewIndexedChunk, k as NewMessage, l as NewSession, m as NewSubagentExecution, n as NewTerminal, o as NewTodoItem, p as NewToolExecution, q as SessionConfig, r as TaskConfig, U as UserContentPart, s as UserFilePart, t as UserImagePart, u as UserModelMessage, v as UserTextPart } from '../schema-CYSKJZ3m.js';
 import 'drizzle-orm/sqlite-core';
 
 /**

package/dist/{index-D5l-DMGC.d.ts → index-Biy5JTop.d.ts}

@@ -1,7 +1,7 @@
 import { ModelMessage, streamText } from 'ai';
-import { S as Session, b as ToolExecution, r as TaskConfig } from './schema-ecQSnCMz.js';
+import { S as Session, b as ToolExecution, r as TaskConfig } from './schema-CYSKJZ3m.js';
 import { z } from 'zod';
-import { B as BashToolProgress, W as WriteFileProgress, S as SearchToolProgress } from './search-DOzC4ojH.js';
+import { B as BashToolProgress, W as WriteFileProgress, S as SearchToolProgress } from './search-CVVfuBPZ.js';
 
 declare const ToolApprovalConfigSchema: z.ZodObject<{
     bash: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -38,25 +38,25 @@ declare const SessionConfigSchema: z.ZodObject<{
         iterations: z.ZodOptional<z.ZodNumber>;
         parentTaskId: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        status: "completed" | "failed" | "running";
+        status: "running" | "completed" | "failed";
         enabled: boolean;
         outputSchema: Record<string, unknown>;
-        error?: string | undefined;
-        maxIterations?: number | undefined;
         webhookUrl?: string | undefined;
-        parentTaskId?: string | undefined;
+        maxIterations?: number | undefined;
         result?: unknown;
+        error?: string | undefined;
         iterations?: number | undefined;
+        parentTaskId?: string | undefined;
     }, {
-        status: "completed" | "failed" | "running";
+        status: "running" | "completed" | "failed";
         enabled: boolean;
         outputSchema: Record<string, unknown>;
-        error?: string | undefined;
-        maxIterations?: number | undefined;
         webhookUrl?: string | undefined;
-        parentTaskId?: string | undefined;
+        maxIterations?: number | undefined;
         result?: unknown;
+        error?: string | undefined;
         iterations?: number | undefined;
+        parentTaskId?: string | undefined;
     }>>;
     computerUseEnabled: z.ZodOptional<z.ZodBoolean>;
     computerUseDisplayWidth: z.ZodOptional<z.ZodNumber>;
@@ -87,20 +87,20 @@ declare const SessionConfigSchema: z.ZodObject<{
         lastFiredAt: z.ZodOptional<z.ZodString>;
         createdAt: z.ZodString;
     }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
         id: string;
         name: string;
-        enabled: boolean;
-        createdAt: string;
-        prompt: string;
         cron: string;
+        prompt: string;
+        createdAt: string;
         replyChannel?: string | undefined;
         lastFiredAt?: string | undefined;
     }, {
         id: string;
         name: string;
-        createdAt: string;
-        prompt: string;
         cron: string;
+        prompt: string;
+        createdAt: string;
         enabled?: boolean | undefined;
         replyChannel?: string | undefined;
         lastFiredAt?: string | undefined;
@@ -137,36 +137,36 @@ declare const SessionConfigSchema: z.ZodObject<{
     maxContextChars: number;
     toolApprovals?: Record<string, boolean> | undefined;
     approvalWebhook?: string | undefined;
-    slack?: {
-        channel?: string | undefined;
-        threadTs?: string | undefined;
-        teamId?: string | undefined;
-    } | undefined;
+    skillsDirectory?: string | undefined;
     task?: {
-        status: "completed" | "failed" | "running";
+        status: "running" | "completed" | "failed";
         enabled: boolean;
         outputSchema: Record<string, unknown>;
-        error?: string | undefined;
-        maxIterations?: number | undefined;
         webhookUrl?: string | undefined;
-        parentTaskId?: string | undefined;
+        maxIterations?: number | undefined;
         result?: unknown;
+        error?: string | undefined;
         iterations?: number | undefined;
+        parentTaskId?: string | undefined;
     } | undefined;
-    skillsDirectory?: string | undefined;
     computerUseEnabled?: boolean | undefined;
     computerUseDisplayWidth?: number | undefined;
     computerUseDisplayHeight?: number | undefined;
     role?: "orchestrator" | "worker" | "chat" | undefined;
     personality?: string | undefined;
     orchestratorSessionId?: string | undefined;
+    slack?: {
+        channel?: string | undefined;
+        threadTs?: string | undefined;
+        teamId?: string | undefined;
+    } | undefined;
     schedules?: {
+        enabled: boolean;
         id: string;
         name: string;
-        enabled: boolean;
-        createdAt: string;
-        prompt: string;
         cron: string;
+        prompt: string;
+        createdAt: string;
         replyChannel?: string | undefined;
         lastFiredAt?: string | undefined;
     }[] | undefined;
@@ -183,36 +183,36 @@ declare const SessionConfigSchema: z.ZodObject<{
 }, {
     toolApprovals?: Record<string, boolean> | undefined;
     approvalWebhook?: string | undefined;
-    slack?: {
-        channel?: string | undefined;
-        threadTs?: string | undefined;
-        teamId?: string | undefined;
-    } | undefined;
+    skillsDirectory?: string | undefined;
+    maxContextChars?: number | undefined;
     task?: {
-        status: "completed" | "failed" | "running";
+        status: "running" | "completed" | "failed";
         enabled: boolean;
         outputSchema: Record<string, unknown>;
-        error?: string | undefined;
-        maxIterations?: number | undefined;
         webhookUrl?: string | undefined;
-        parentTaskId?: string | undefined;
+        maxIterations?: number | undefined;
         result?: unknown;
+        error?: string | undefined;
         iterations?: number | undefined;
+        parentTaskId?: string | undefined;
     } | undefined;
-    skillsDirectory?: string | undefined;
-    maxContextChars?: number | undefined;
     computerUseEnabled?: boolean | undefined;
     computerUseDisplayWidth?: number | undefined;
     computerUseDisplayHeight?: number | undefined;
     role?: "orchestrator" | "worker" | "chat" | undefined;
     personality?: string | undefined;
     orchestratorSessionId?: string | undefined;
+    slack?: {
+        channel?: string | undefined;
+        threadTs?: string | undefined;
+        teamId?: string | undefined;
+    } | undefined;
     schedules?: {
         id: string;
         name: string;
-        createdAt: string;
-        prompt: string;
         cron: string;
+        prompt: string;
+        createdAt: string;
         enabled?: boolean | undefined;
         replyChannel?: string | undefined;
         lastFiredAt?: string | undefined;
@@ -287,6 +287,13 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         host?: string | undefined;
         publicUrl?: string | undefined;
     }>>;
+    webhooks: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        token?: string | undefined;
+    }, {
+        token?: string | undefined;
+    }>>;
     databasePath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     remoteServer: z.ZodOptional<z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
@@ -385,15 +392,15 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
                 expiresAt?: string | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
-            enabled: boolean;
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;
@@ -406,13 +413,13 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         }, {
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            enabled?: boolean | undefined;
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
-            enabled?: boolean | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;
@@ -425,15 +432,15 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         }>, "many">>>>;
     }, "strip", z.ZodTypeAny, {
         servers?: {
+            enabled: boolean;
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
-            enabled: boolean;
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;
@@ -448,13 +455,13 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         servers?: {
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            enabled?: boolean | undefined;
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
-            enabled?: boolean | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;
@@ -497,7 +504,6 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         allowedEmails?: string[] | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    defaultModel: string;
     toolApprovals: {
         bash: boolean;
         write_file: boolean;
@@ -505,6 +511,7 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         load_skill: boolean;
         todo: boolean;
     };
+    defaultModel: string;
     skills: {
         directory: string;
         additionalDirectories: string[];
@@ -520,8 +527,21 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         publicUrl?: string | undefined;
     };
     databasePath: string;
-    workingDirectory?: string | undefined;
     approvalWebhook?: string | undefined;
+    slack?: {
+        botToken?: string | undefined;
+        signingSecret?: string | undefined;
+        defaultOrchestratorName?: string | undefined;
+        allowedUsers?: string[] | undefined;
+        allowedChannels?: string[] | undefined;
+        allowDmsFromAnyone?: boolean | undefined;
+        deniedReplyEnabled?: boolean | undefined;
+        deniedReplyTemplate?: string | undefined;
+    } | undefined;
+    webhooks?: {
+        token?: string | undefined;
+    } | undefined;
+    workingDirectory?: string | undefined;
     remoteServer?: {
         url?: string | undefined;
         authKey?: string | undefined;
@@ -534,27 +554,17 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         httpUrl?: string | undefined;
         namespace?: string | undefined;
     } | undefined;
-    slack?: {
-        botToken?: string | undefined;
-        signingSecret?: string | undefined;
-        defaultOrchestratorName?: string | undefined;
-        allowedUsers?: string[] | undefined;
-        allowedChannels?: string[] | undefined;
-        allowDmsFromAnyone?: boolean | undefined;
-        deniedReplyEnabled?: boolean | undefined;
-        deniedReplyTemplate?: string | undefined;
-    } | undefined;
     mcp?: {
         servers?: {
+            enabled: boolean;
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
-            enabled: boolean;
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;
@@ -575,8 +585,6 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         allowedEmails?: string[] | undefined;
     } | undefined;
 }, {
-    defaultModel?: string | undefined;
-    workingDirectory?: string | undefined;
     toolApprovals?: {
         bash?: boolean | undefined;
         write_file?: boolean | undefined;
@@ -585,6 +593,21 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         todo?: boolean | undefined;
     } | undefined;
     approvalWebhook?: string | undefined;
+    slack?: {
+        botToken?: string | undefined;
+        signingSecret?: string | undefined;
+        defaultOrchestratorName?: string | undefined;
+        allowedUsers?: string[] | undefined;
+        allowedChannels?: string[] | undefined;
+        allowDmsFromAnyone?: boolean | undefined;
+        deniedReplyEnabled?: boolean | undefined;
+        deniedReplyTemplate?: string | undefined;
+    } | undefined;
+    webhooks?: {
+        token?: string | undefined;
+    } | undefined;
+    workingDirectory?: string | undefined;
+    defaultModel?: string | undefined;
     skills?: {
         directory?: string | undefined;
         additionalDirectories?: string[] | undefined;
@@ -612,27 +635,17 @@ declare const SparkcoderConfigSchema: z.ZodObject<{
         include?: string[] | undefined;
         exclude?: string[] | undefined;
     } | undefined;
-    slack?: {
-        botToken?: string | undefined;
-        signingSecret?: string | undefined;
-        defaultOrchestratorName?: string | undefined;
-        allowedUsers?: string[] | undefined;
-        allowedChannels?: string[] | undefined;
-        allowDmsFromAnyone?: boolean | undefined;
-        deniedReplyEnabled?: boolean | undefined;
-        deniedReplyTemplate?: string | undefined;
-    } | undefined;
     mcp?: {
         servers?: {
             id: string;
             name: string;
-            transport: "http" | "sse" | "stdio";
             createdAt: string;
+            transport: "http" | "sse" | "stdio";
+            enabled?: boolean | undefined;
+            args?: string[] | undefined;
             url?: string | undefined;
             headers?: Record<string, string> | undefined;
             command?: string | undefined;
-            args?: string[] | undefined;
-            enabled?: boolean | undefined;
             oauth?: {
                 authorizationUrl?: string | undefined;
                 tokenUrl?: string | undefined;

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { R as ResolvedConfig } from './index-D5l-DMGC.js';
-export { A as Agent, a as AgentOptions, b as AgentRunOptions, c as AgentStreamResult, S as SparkcoderConfig, T as ToolApprovalConfig } from './index-D5l-DMGC.js';
+import { R as ResolvedConfig } from './index-Biy5JTop.js';
+export { A as Agent, a as AgentOptions, b as AgentRunOptions, c as AgentStreamResult, S as SparkcoderConfig, T as ToolApprovalConfig } from './index-Biy5JTop.js';
 export { ServerOptions, createApp, startServer, stopServer } from './server/index.js';
 export { checkpointQueries, closeDatabase, fileBackupQueries, getDb, initDatabase, messageQueries, sessionQueries, skillQueries, todoQueries, toolExecutionQueries } from './db/index.js';
-import { F as FileBackup, C as Checkpoint } from './schema-ecQSnCMz.js';
-export { a as Message, M as ModelMessage, S as Session, q as SessionConfig, f as Terminal, T as TodoItem, b as ToolExecution } from './schema-ecQSnCMz.js';
+import { F as FileBackup, C as Checkpoint } from './schema-CYSKJZ3m.js';
+export { a as Message, M as ModelMessage, S as Session, q as SessionConfig, f as Terminal, T as TodoItem, b as ToolExecution } from './schema-CYSKJZ3m.js';
 export { createLoadSkillTool, createReadFileTool, createTodoTool, createTools } from './tools/index.js';
-export { c as createBashTool, a as createWriteFileTool } from './search-DOzC4ojH.js';
+export { c as createBashTool, a as createWriteFileTool } from './search-CVVfuBPZ.js';
 import 'ai';
 import 'zod';
 import 'hono/types';

package/dist/index.js

@@ -340,6 +340,14 @@ var init_types = __esm({
         // If not set, defaults to http://{host}:{port}
         publicUrl: z.string().url().optional()
       }).default({ port: 3141, host: "127.0.0.1" }),
+      // Per-tunnel unguessable webhook URL prefix. Set by
+      // `cloudflared-setup --remote` from the response of POST
+      // /tunnels/ensure. When present, the local server mounts public
+      // inbound webhooks (Slack events, inbox) under /w/<token>/...
+      // instead of /api/*. When absent, falls back to /api/*.
+      webhooks: z.object({
+        token: z.string().optional()
+      }).optional(),
       // Database path (used for local SQLite - ignored if remoteServer is configured)
       databasePath: z.string().optional().default("./sparkecoder.db"),
       // Remote server configuration (for centralized storage)
@@ -447,7 +455,9 @@ __export(config_exports, {
   saveAuthKey: () => saveAuthKey,
   setApiKey: () => setApiKey,
   setMcpServers: () => setMcpServers,
-  setSlackConfig: () => setSlackConfig
+  setPublicUrl: () => setPublicUrl,
+  setSlackConfig: () => setSlackConfig,
+  setWebhookToken: () => setWebhookToken
 });
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from "fs";
 import { resolve, dirname, join } from "path";
@@ -709,6 +719,55 @@ function setMcpServers(servers2) {
     console.warn("[config] failed to persist mcp config:", err?.message || err);
   }
 }
+function setWebhookToken(token) {
+  if (cachedConfig) {
+    cachedConfig.webhooks = {
+      ...cachedConfig.webhooks ?? {},
+      token
+    };
+  }
+  try {
+    const cwdPath = resolve(process.cwd(), "sparkecoder.config.json");
+    const target = existsSync(cwdPath) ? cwdPath : join(ensureAppDataDirectory(), "sparkecoder.config.json");
+    let raw = {};
+    if (existsSync(target)) {
+      try {
+        raw = JSON.parse(readFileSync(target, "utf-8"));
+      } catch {
+        raw = {};
+      }
+    } else {
+      raw = createDefaultConfig();
+    }
+    raw.webhooks = { ...raw.webhooks || {}, token };
+    writeFileSync(target, JSON.stringify(raw, null, 2));
+  } catch (err) {
+    console.warn("[config] failed to persist webhook token:", err?.message || err);
+  }
+}
+function setPublicUrl(publicUrl) {
+  if (cachedConfig) {
+    cachedConfig.server = { ...cachedConfig.server ?? {}, publicUrl };
+  }
+  try {
+    const cwdPath = resolve(process.cwd(), "sparkecoder.config.json");
+    const target = existsSync(cwdPath) ? cwdPath : join(ensureAppDataDirectory(), "sparkecoder.config.json");
+    let raw = {};
+    if (existsSync(target)) {
+      try {
+        raw = JSON.parse(readFileSync(target, "utf-8"));
+      } catch {
+        raw = {};
+      }
+    } else {
+      raw = createDefaultConfig();
+    }
+    raw.server = { ...raw.server || {}, publicUrl };
+    writeFileSync(target, JSON.stringify(raw, null, 2));
+  } catch (err) {
+    console.warn("[config] failed to persist publicUrl:", err?.message || err);
+  }
+}
 function clearSlackConfig() {
   if (cachedConfig) cachedConfig.slack = {};
   try {
@@ -8819,7 +8878,9 @@ function buildScheduleTool(opts) {
 }
 function buildWebhookUrl(opts, token) {
   const base = opts.publicBaseUrl?.replace(/\/$/, "") || opts.baseUrl.replace(/\/$/, "");
-  return `${base}/api/inbox/${token}`;
+  const cfg = getConfig();
+  const webhookPrefix2 = cfg?.webhooks?.token ? `/w/${cfg.webhooks.token}` : "/api";
+  return `${base}${webhookPrefix2}/inbox/${token}`;
 }
 function buildWebhookTool(opts) {
   return tool14({
@@ -8869,6 +8930,7 @@ var init_orchestrator_actions = __esm({
     "use strict";
     init_messenger();
     init_schedules_store();
+    init_config();
     init_webhooks_store();
     AGENT_STATUS_ENUM = z15.enum(["running", "needs_attention", "completed", "failed", "idle"]);
     agentInputSchema = z15.object({
@@ -13835,8 +13897,8 @@ async function findOrCreateOrchestratorId() {
     const all = await sessionQueries.list(500, 0);
     const existing = all.find((s) => s.config?.role === "orchestrator");
     if (existing) return existing.id;
-    const { getConfig: getConfig3 } = await Promise.resolve().then(() => (init_config(), config_exports));
-    const cfg = getConfig3();
+    const { getConfig: getConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    const cfg = getConfig2();
     const created = await sessionQueries.create({
       name: getDefaultOrchestratorName() || "Orchestrator",
       workingDirectory: cfg.resolvedWorkingDirectory,
@@ -13961,6 +14023,11 @@ function publicBase() {
   const cfg = getConfig();
   return cfg.server?.publicUrl?.replace(/\/$/, "") || `http://${cfg.server?.host || "127.0.0.1"}:${cfg.server?.port || 3141}`;
 }
+function webhookPrefix() {
+  const cfg = getConfig();
+  const token = cfg?.webhooks?.token;
+  return token ? `/w/${token}` : "/api";
+}
 integrations.get("/", async (c) => {
   const cfg = getConfig();
   return c.json({
@@ -13970,7 +14037,7 @@ integrations.get("/", async (c) => {
       botTokenSet: !!cfg?.slack?.botToken,
       signingSecretSet: !!cfg?.slack?.signingSecret,
       defaultOrchestratorName: cfg?.slack?.defaultOrchestratorName || null,
-      eventsUrl: `${publicBase()}/api/slack/events`,
+      eventsUrl: `${publicBase()}${webhookPrefix()}/slack/events`,
       allowedUsers: cfg?.slack?.allowedUsers ?? [],
       allowedChannels: cfg?.slack?.allowedChannels ?? [],
       allowDmsFromAnyone: cfg?.slack?.allowDmsFromAnyone !== false,
@@ -14063,7 +14130,7 @@ schedulesRouter.delete("/:id", async (c) => {
 });
 var webhooksRouter = new Hono8();
 function withUrl(row) {
-  return { ...row, url: `${publicBase()}/api/inbox/${row.token}` };
+  return { ...row, url: `${publicBase()}${webhookPrefix()}/inbox/${row.token}` };
 }
 webhooksRouter.get("/", async (c) => {
   const orcId = await getOrchestratorId();
@@ -14166,7 +14233,7 @@ mcpRouter.post("/:id/test", async (c) => {
 // src/server/auth/cf-access.ts
 init_config();
 import { createRemoteJWKSet, jwtVerify } from "jose";
-var EXEMPT_PATH_PREFIXES = ["/health", "/api/slack/events", "/api/inbox/"];
+var EXEMPT_PATH_PREFIXES = ["/health", "/api/slack/events", "/api/inbox/", "/w/"];
 var cachedJWKS = null;
 var cachedJWKSUrl = null;
 function getOrCreateJWKS(teamDomain) {
@@ -14595,13 +14662,23 @@ async function createApp(options = {}) {
   app.route("/sessions", terminals);
   app.route("/terminals", terminals);
   app.route("/tasks", tasks_default);
-  app.route("/api/slack", slack);
-  app.route("/api/inbox", inbox);
   app.route("/api/integrations", integrations);
   app.route("/api/schedules", schedulesRouter);
-  app.route("/api/webhooks", webhooksRouter);
   app.route("/api/orchestrator", orchestratorRouter);
   app.route("/api/mcp", mcpRouter);
+  app.route("/api/webhooks", webhooksRouter);
+  const config = getConfig();
+  const webhookToken = config?.webhooks?.token;
+  if (webhookToken) {
+    app.route(`/w/${webhookToken}/slack`, slack);
+    app.route(`/w/${webhookToken}/inbox`, inbox);
+    if (!options.quiet) {
+      console.log(`  \u2192 Public webhooks mounted at /w/${webhookToken.slice(0, 4)}\u2026/<service>`);
+    }
+  } else {
+    app.route("/api/slack", slack);
+    app.route("/api/inbox", inbox);
+  }
   app.get("/openapi.json", async (c) => {
     return c.json(generateOpenAPISpec());
   });