# agent-team Slack app

Dedicated Slack app backing the Plane-2 clarifier human-gate (Socket Mode).
Kept separate from the webhook-only **Tech Notifications** app (`A0ARYQZU3KJ`)
that the nightly secrev sweep uses, to isolate the two-way bot's trust surface.

| Field | Value |
|---|---|
| App name | Sea Haven agent-team |
| App ID | `A0BC7AT8NUD` |
| Org / team | seahaven (`E0A524V806L`) |
| Manifest | [`agent-team-manifest.json`](./agent-team-manifest.json) (source of truth) |
| Settings | https://api.slack.com/apps/A0BC7AT8NUD |

## Why these scopes (verified against the code)

`agent_team/transport/slack_listener.py` subscribes over Socket Mode to
`message`, `app_mention`, and Block Kit `block_actions`; `slack_live.py` posts
questions via `chat.postMessage`.

| Capability | Scope / setting | Why |
|---|---|---|
| Post clarifier questions | `chat:write` | `slack_live.py` `chat.postMessage` |
| Hear thread replies in the channel | `channels:history` / `groups:history` + `message.channels`/`message.groups` events | `@app.event("message")` |
| Hear DM replies | `im:history` + `message.im` event | DM answer path |
| Hear @mentions | `app_mentions:read` + `app_mention` event | `@app.event("app_mention")` |
| Block Kit button/select answers | `interactivity.is_enabled` | `@app.action({})` |
| Inbound WebSocket | `socket_mode_enabled` + an app-level token w/ `connections:write` | VPN-only box, no public HTTPS endpoint |

Inbound auth is NOT scope-based: AUTHZ-01 (`AGENT_TEAM_SLACK_OWNER_IDS`) gates
the *sender* and fails closed. Socket membership alone is never authorization.

## Remaining manual token mints (operator, in browser)

Both produce secrets — paste them straight into `~/secrev.env` on the box
(mode 600), never into shell history.

1. **Bot token (`xoxb-`)** — https://api.slack.com/apps/A0BC7AT8NUD/oauth →
   *Install to Workspace* → approve → copy the **Bot User OAuth Token** →
   `SLACK_BOT_TOKEN`.
2. **App-level token (`xapp-`)** — https://api.slack.com/apps/A0BC7AT8NUD/general
   → *App-Level Tokens* → *Generate Token and Scopes* → add scope
   `connections:write` → copy → `SLACK_APP_TOKEN`.
3. **Channel** — create/choose the clarifier channel, `/invite @agent-team`,
   copy its `C0...` id → `SLACK_CHANNEL_ID`.
4. **Owner allowlist** — `AGENT_TEAM_SLACK_OWNER_IDS` = Adam's Slack user id
   (`U0A3SC48T47`), comma-separated if more than one. Gate fails closed if empty.

## Reproduce / update the app from the manifest

```bash
TOKEN=$(python3 -c "import json;print(json.load(open(os.path.expanduser('~/.slack/credentials.json')))['E0A524V806L']['token'])")
# validate
curl -s -X POST https://slack.com/api/apps.manifest.validate \
  -H "Authorization: Bearer $TOKEN" --data-urlencode "manifest=$(cat agent-team-manifest.json)"
# update existing app
curl -s -X POST https://slack.com/api/apps.manifest.update \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode "app_id=A0BC7AT8NUD" \
  --data-urlencode "manifest=$(cat agent-team-manifest.json)"
```