Skip to content

feat(adapters/slack): add the Web API methods that the Coder Agents Slack bot needs - #113

Open
ethanndickson wants to merge 2 commits into
sockets-j2dwfrom
slackapi-bot-methods
Open

feat(adapters/slack): add the Web API methods that the Coder Agents Slack bot needs#113
ethanndickson wants to merge 2 commits into
sockets-j2dwfrom
slackapi-bot-methods

Conversation

@ethanndickson

@ethanndickson ethanndickson commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

The Coder Agents Slack bot in coderd still needs a few Web API methods that slackapi doesn't have yet, so this adds them on top of #112. coderd will build against this branch with a go.mod replace until it merges.

There are typed methods for oauth.v2.access (to exchange an install code for a bot token), chat.postEphemeral, files.info with the file's shares, agents.sessions.setStatus, and apps.manifest.create and apps.manifest.delete, which you call with an app configuration token via WithToken. Manifest gains oauth_config.redirect_urls and features.agent_view, and Envelope can now decode agent_session_stopped and channel_shared events.

FileInfo returns a FileInfoResponse that embeds File and adds the shares, rather than putting the shares on File itself, since the maps would make File no longer comparable. OAuthV2Access never sends the client's token, and CreateApp sends the manifest as a JSON string, as Slack expects. I haven't tried these against a real workspace yet; they're only tested against slackapitest.

@ethanndickson
feat(slackapi): add the Web API pieces that the Coder Agents Slack bo…
bcf06e1 
…t needs

Add OAuthV2Access, PostEphemeral, FileInfo with shares, SetAgentSessionStatus, and CreateApp and DeleteApp for apps.manifest. Add redirect_urls and agent_view to Manifest, and decoders for agent_session_stopped and channel_shared events.
@ethanndickson
ethanndickson added this pull request to stack #114 October 19, 2026 05:01
@ethanndickson ethanndickson changed the title feat(slackapi): add the Web API pieces that the Coder Agents Slack bot needs feat(adapters/slack): add the Web API methods that the Coder Agents Slack bot needs Oct 19, 2026
@ethanndickson

ethanndickson commented Oct 19, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T06:33:07.783711Z d7c3e7f Manual request
🔒 Security Review ✅ Completed 2026-10-20T06:33:02.106129Z d7c3e7f Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 👍

Reviewed commit: bcf06e1416

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@ethanndickson
ethanndickson marked this pull request as ready for review October 19, 2026 08:06
@ethanndickson

ethanndickson commented Oct 19, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: bcf06e1416

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33

ThomasK33 commented Oct 19, 2026

Copy link
Copy Markdown
Member

Maintainer review. I accept this. The new methods fit slackapi, which is still experimental. They follow its conventions: form-encoded requests, typed responses, and WithToken for the app configuration token. I checked one point myself: OAuthV2Access goes through WithToken(""), and send sets no Authorization header for an empty token. oauth_test.go asserts that.

Every merge check passes on bcf06e1: CI is green, the Codex code review and security review are both clean, and no review threads are open.

Merge order: this PR is based on sockets-j2dw (#112). It merges only after #112, and #112 still waits on the owner's dependency decision. After #112 merges, GitHub retargets this PR to main. If that changes the head (a rebase or a conflict fix), please run both Codex reviews again on the new head.

Not blocking: these methods are only tested against slackapitest. The fake also missed #98, so when you can, please run OAuthV2Access and CreateApp/DeleteApp once against a real workspace. Adding them to TestLive would be ideal. Then post the result here, or on a follow-up issue if this has merged by then.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium

@ThomasK33 ThomasK33 mentioned this pull request Oct 19, 2026
Open
@ethanndickson
test(slackapi): live tests for the bot Web API methods
d7c3e7f 
TestLiveApp creates an app from a manifest and deletes it, after it checks
the invalid_manifest error list. TestLiveOAuth exchanges a code from a real
install. TestLive also checks FileInfo shares and PostEphemeral.

Document that agents.sessions.setStatus returns not_authorized when the
manifest has no features.agent_view.
@ethanndickson

ethanndickson commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

Thanks Thomas. I ran them against my test workspace and added them to the live tests.

  • TestLiveApp needs only an app configuration token. It sends a manifest that subscribes to app_mention without app_mentions:read and checks for invalid_manifest with app_mention_event_missing_scope in APIError.Raw. Then it creates the app with the scope added and deletes it on cleanup. Passes.
  • OAuthV2Access can't run unattended. Slack only gives you a code after someone clicks Allow, and it checks the code before anything else, so a fake code returns invalid_code even with an empty body. That check would prove nothing, so TestLiveOAuth is opt-in: it takes a code from a real install, exchanges it, calls auth.test with the new token, and checks that reusing the code returns invalid_code. Passes: I got a bot token with the right bot user, app and team.
  • I also added FileInfo and PostEphemeral steps to TestLive, since they need no extra setup. Both pass, and FileInfo returned the thread share for the uploaded file.

One finding: agents.sessions.setStatus returns not_authorized for an app whose manifest has no features.agent_view, so I've documented that on SetAgentSessionStatus.

@ethanndickson

ethanndickson commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

@codex review

@ethanndickson

ethanndickson commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: d7c3e7f5bb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: d7c3e7f5bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@ThomasK33

ThomasK33 commented Oct 20, 2026

Copy link
Copy Markdown
Member

Thanks. That covers the live check I asked for. The opt-in TestLiveOAuth is the right call, and the agent_view note on SetAgentSessionStatus is useful. Every merge check still passes on d7c3e7f: CI is green, the Codex code review and the security review are both clean on this head, and no threads are open.

This PR still merges after #112. I approved #112, and you are clear to merge it whenever you like. After GitHub retargets this PR to main, I check its head once more. If the head changed, run both Codex reviews again.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ethanndickson @ThomasK33