feat: add Slack message memory addon

Author: lcalderon

.env.example

@@ -91,6 +91,9 @@ DISCORD_BOT_TOKEN=
 DISCORD_PUBLIC_KEY=
 SLACK_BOT_TOKEN=
 SLACK_SIGNING_SECRET=
+MESSAGE_MEMORY_SLACK_ALLOW_TEAM_IDS=
+MESSAGE_MEMORY_SLACK_INCLUDE_BOT_MESSAGES=0
+MESSAGE_MEMORY_SLACK_MAX_SKEW_SECONDS=300
 
 # ── Public Eval API (Phase 62) ───────────────────────────────────────────────
 # URL used by the internal SDK client for dogfood calls (SEAL/autogen loop).

apps/memroos/src/app/api/integrations/slack/events/__tests__/route.test.ts

@@ -0,0 +1,188 @@
+// @vitest-environment node
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const TEST_DB_DIR = path.join(os.tmpdir(), `memroos-slack-events-${crypto.randomUUID()}`);
+const TEST_DB_PATH = path.join(TEST_DB_DIR, "routes.db");
+const SIGNING_SECRET = "test-slack-signing-secret";
+
+let closeDb: (() => void) | null = null;
+
+function signedRequest(body: unknown, options: { secret?: string; timestamp?: number; signature?: string } = {}): Request {
+  const rawBody = typeof body === "string" ? body : JSON.stringify(body);
+  const timestamp = String(options.timestamp ?? Math.floor(Date.now() / 1000));
+  const signature =
+    options.signature ??
+    `v0=${crypto.createHmac("sha256", options.secret ?? SIGNING_SECRET).update(`v0:${timestamp}:${rawBody}`).digest("hex")}`;
+
+  return new Request("http://localhost/api/integrations/slack/events", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "x-slack-request-timestamp": timestamp,
+      "x-slack-signature": signature,
+    },
+    body: rawBody,
+  });
+}
+
+function slackMessageEvent(overrides: Record<string, unknown> = {}) {
+  return {
+    type: "event_callback",
+    team_id: "T123",
+    api_app_id: "A123",
+    event_id: "Ev123",
+    event_time: 1782763200,
+    authorizations: [{ team_id: "T123" }],
+    event: {
+      type: "message",
+      channel: "C123",
+      user: "U123",
+      text: "Slack can be a MemroOS memory source.",
+      ts: "1782763200.123456",
+      thread_ts: "1782763000.000000",
+    },
+    ...overrides,
+  };
+}
+
+async function loadRoute() {
+  process.env.SQLITE_DB_PATH = TEST_DB_PATH;
+  process.env.SLACK_SIGNING_SECRET = SIGNING_SECRET;
+  process.env.MESSAGE_MEMORY_SLACK_ALLOW_TEAM_IDS = "T123";
+  vi.resetModules();
+  const route = await import("../route");
+  const dbModule = await import("@/lib/db");
+  closeDb = dbModule.closeDb;
+  return { ...route, getDb: dbModule.getDb };
+}
+
+describe("Slack Events API memory route", () => {
+  beforeEach(() => {
+    fs.rmSync(TEST_DB_DIR, { recursive: true, force: true });
+    fs.mkdirSync(TEST_DB_DIR, { recursive: true });
+  });
+
+  afterEach(() => {
+    closeDb?.();
+    closeDb = null;
+    fs.rmSync(TEST_DB_DIR, { recursive: true, force: true });
+    delete process.env.SQLITE_DB_PATH;
+    delete process.env.SLACK_SIGNING_SECRET;
+    delete process.env.MESSAGE_MEMORY_SLACK_ALLOW_TEAM_IDS;
+    delete process.env.MESSAGE_MEMORY_SLACK_INCLUDE_BOT_MESSAGES;
+    delete process.env.MESSAGE_MEMORY_SLACK_MAX_SKEW_SECONDS;
+    delete process.env.MEMROOS_PUBLIC_BASE_URL;
+    vi.restoreAllMocks();
+  });
+
+  it("returns a Slack app manifest with the configured Events API URL", async () => {
+    process.env.MEMROOS_PUBLIC_BASE_URL = "https://memroos.example";
+    const { GET } = await loadRoute();
+
+    const response = await GET(new Request("http://localhost/api/integrations/slack/events"));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body.display_information.name).toBe("MemroOS Memory");
+    expect(body.settings.event_subscriptions.request_url).toBe("https://memroos.example/api/integrations/slack/events");
+    expect(body.settings.event_subscriptions.bot_events).toContain("message.channels");
+  });
+
+  it("answers Slack URL verification challenges after signature verification", async () => {
+    const { POST } = await loadRoute();
+
+    const response = await POST(signedRequest({ type: "url_verification", challenge: "challenge-token" }));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ challenge: "challenge-token" });
+  });
+
+  it("ingests signed Slack message events into provider-agnostic memory", async () => {
+    const { POST, getDb } = await loadRoute();
+
+    const response = await POST(signedRequest(slackMessageEvent()));
+    const body = await response.json();
+
+    expect(response.status).toBe(201);
+    expect(body).toMatchObject({ ok: true, created: true, duplicate: false });
+
+    const memoryRow = getDb()
+      .prepare("SELECT provider, workspace_id, channel_id, thread_id, author_id, content FROM platform_message_memory")
+      .get() as Record<string, unknown>;
+    expect(memoryRow).toMatchObject({
+      provider: "slack",
+      workspace_id: "T123",
+      channel_id: "C123",
+      thread_id: "1782763000.000000",
+      author_id: "U123",
+      content: "Slack can be a MemroOS memory source.",
+    });
+
+    const recallRow = getDb().prepare("SELECT session_id, project, request_id, policy FROM messages").get() as Record<string, unknown>;
+    expect(recallRow).toMatchObject({
+      session_id: "platform:slack:T123:C123",
+      project: "platform:slack",
+      request_id: body.dedupeKey,
+      policy: "indexable",
+    });
+  });
+
+  it("dedupes retried Slack events by provider/team/channel/thread/message id", async () => {
+    const { POST, getDb } = await loadRoute();
+    const event = slackMessageEvent();
+
+    const first = await POST(signedRequest(event));
+    const second = await POST(signedRequest(event));
+
+    expect(first.status).toBe(201);
+    expect(second.status).toBe(200);
+    expect(await second.json()).toMatchObject({ ok: true, created: false, duplicate: true });
+    expect((getDb().prepare("SELECT COUNT(*) AS count FROM platform_message_memory").get() as { count: number }).count).toBe(1);
+    expect((getDb().prepare("SELECT COUNT(*) AS count FROM messages").get() as { count: number }).count).toBe(1);
+  });
+
+  it("rejects invalid signatures before reading events", async () => {
+    const { POST } = await loadRoute();
+
+    const response = await POST(signedRequest(slackMessageEvent(), { signature: "v0=bad" }));
+    const body = await response.json();
+
+    expect(response.status).toBe(401);
+    expect(body).toEqual({ ok: false, error: "invalid_signature" });
+  });
+
+  it("skips bot messages by default", async () => {
+    const { POST } = await loadRoute();
+    const botEvent = slackMessageEvent({
+      event: {
+        type: "message",
+        channel: "C123",
+        bot_id: "B123",
+        username: "summary-bot",
+        text: "Automated message",
+        ts: "1782763201.000000",
+      },
+    });
+
+    const response = await POST(signedRequest(botEvent));
+    const body = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(body).toEqual({ ok: true, ignored: true, reason: "bot_message" });
+  });
+
+  it("rejects non-allowlisted Slack teams", async () => {
+    const { POST } = await loadRoute();
+
+    const response = await POST(signedRequest(slackMessageEvent({ team_id: "T999", authorizations: [{ team_id: "T999" }] })));
+    const body = await response.json();
+
+    expect(response.status).toBe(403);
+    expect(body).toEqual({ ok: false, error: "Slack team is not allowlisted" });
+  });
+});

apps/memroos/src/app/api/integrations/slack/events/route.ts

@@ -0,0 +1,103 @@
+import { getDb } from "@/lib/db";
+import { ingestPlatformMessageMemory, normalizeSlackEvent, type SlackEventPayload } from "@/lib/message-memory";
+import { loadSlackMessageMemoryConfig, slackManifest, verifySlackRequest } from "@/lib/message-memory/slack";
+
+export const dynamic = "force-dynamic";
+
+type SlackEventsEnvelope = SlackEventPayload & {
+  type?: string;
+  challenge?: string;
+  event_id?: string;
+  event_time?: number;
+  api_app_id?: string;
+  enterprise_id?: string;
+};
+
+function jsonError(error: string, status: number) {
+  return Response.json({ ok: false, error }, { status });
+}
+
+function configuredRequestUrl(request: Request): string {
+  const fallback = new URL(request.url);
+  const base = process.env.MEMROOS_PUBLIC_BASE_URL ?? `${fallback.protocol}//${fallback.host}`;
+  return new URL("/api/integrations/slack/events", base).toString();
+}
+
+function parseJson(rawBody: string): SlackEventsEnvelope | null {
+  try {
+    const parsed = JSON.parse(rawBody) as unknown;
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as SlackEventsEnvelope) : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function GET(request: Request) {
+  return Response.json(slackManifest(configuredRequestUrl(request)));
+}
+
+export async function POST(request: Request) {
+  const config = loadSlackMessageMemoryConfig();
+  if (!config.signingSecret) return jsonError("Slack signing secret not configured", 503);
+
+  const rawBody = await request.text();
+  const verification = verifySlackRequest({
+    headers: request.headers,
+    rawBody,
+    signingSecret: config.signingSecret,
+    maxSkewSeconds: config.maxSkewSeconds,
+  });
+  if (!verification.ok) return jsonError(verification.error ?? "invalid_signature", 401);
+
+  const body = parseJson(rawBody);
+  if (!body) return jsonError("invalid JSON body", 400);
+
+  if (body.type === "url_verification") {
+    if (typeof body.challenge !== "string" || body.challenge.length === 0) {
+      return jsonError("missing Slack challenge", 400);
+    }
+    return Response.json({ challenge: body.challenge });
+  }
+
+  if (body.type !== "event_callback") {
+    return Response.json({ ok: true, ignored: true, reason: "unsupported_envelope_type" });
+  }
+
+  const normalized = normalizeSlackEvent(body);
+  if (!normalized) {
+    return Response.json({ ok: true, ignored: true, reason: "unsupported_event" });
+  }
+
+  if (config.allowTeamIds.size > 0 && !config.allowTeamIds.has(normalized.workspaceId)) {
+    return jsonError("Slack team is not allowlisted", 403);
+  }
+
+  if (!config.includeBotMessages && normalized.author.isBot) {
+    return Response.json({ ok: true, ignored: true, reason: "bot_message" });
+  }
+
+  const result = ingestPlatformMessageMemory(getDb(), {
+    ...normalized,
+    visibility: "internal",
+    policy: "indexable",
+    metadata: {
+      provider: "slack",
+      eventId: body.event_id ?? null,
+      eventTime: body.event_time ?? null,
+      apiAppId: body.api_app_id ?? null,
+      enterpriseId: body.enterprise_id ?? null,
+      teamId: normalized.workspaceId,
+    },
+  });
+
+  return Response.json(
+    {
+      ok: true,
+      created: result.created,
+      duplicate: result.duplicate,
+      dedupeKey: result.dedupeKey,
+      messageRowId: result.messageRowId,
+    },
+    { status: result.created ? 201 : 200 }
+  );
+}

apps/memroos/src/lib/message-memory/__tests__/slack.test.ts

@@ -0,0 +1,63 @@
+// @vitest-environment node
+import crypto from "crypto";
+import { describe, expect, it } from "vitest";
+import { loadSlackMessageMemoryConfig, slackManifest, verifySlackRequest } from "../slack";
+
+function headersFor(body: string, secret: string, timestamp: number, signature?: string): Headers {
+  const computed = `v0=${crypto.createHmac("sha256", secret).update(`v0:${timestamp}:${body}`).digest("hex")}`;
+  return new Headers({
+    "x-slack-request-timestamp": String(timestamp),
+    "x-slack-signature": signature ?? computed,
+  });
+}
+
+describe("Slack message memory helpers", () => {
+  it("verifies Slack HMAC signatures", () => {
+    const body = JSON.stringify({ type: "event_callback" });
+    const timestamp = 1_782_763_200;
+
+    expect(
+      verifySlackRequest({
+        headers: headersFor(body, "secret", timestamp),
+        rawBody: body,
+        signingSecret: "secret",
+        nowMs: timestamp * 1000,
+      })
+    ).toEqual({ ok: true });
+  });
+
+  it("rejects stale Slack signatures", () => {
+    const body = "{}";
+    expect(
+      verifySlackRequest({
+        headers: headersFor(body, "secret", 100),
+        rawBody: body,
+        signingSecret: "secret",
+        nowMs: 1_000_000,
+        maxSkewSeconds: 300,
+      })
+    ).toEqual({ ok: false, error: "stale_request" });
+  });
+
+  it("loads allowlists and bot-message policy from env", () => {
+    const config = loadSlackMessageMemoryConfig({
+      SLACK_SIGNING_SECRET: "secret",
+      MESSAGE_MEMORY_SLACK_ALLOW_TEAM_IDS: "T1, T2",
+      MESSAGE_MEMORY_SLACK_INCLUDE_BOT_MESSAGES: "yes",
+      MESSAGE_MEMORY_SLACK_MAX_SKEW_SECONDS: "600",
+    } as unknown as NodeJS.ProcessEnv);
+
+    expect(config.signingSecret).toBe("secret");
+    expect([...config.allowTeamIds]).toEqual(["T1", "T2"]);
+    expect(config.includeBotMessages).toBe(true);
+    expect(config.maxSkewSeconds).toBe(600);
+  });
+
+  it("generates a public-safe Slack app manifest", () => {
+    const manifest = slackManifest("https://memroos.example/api/integrations/slack/events");
+
+    expect(manifest.settings.event_subscriptions.request_url).toBe("https://memroos.example/api/integrations/slack/events");
+    expect(manifest.oauth_config.scopes.bot).toContain("channels:history");
+    expect(JSON.stringify(manifest)).not.toContain("secret");
+  });
+});

apps/memroos/src/lib/message-memory/index.ts

@@ -1,4 +1,5 @@
 export * from "./adapters";
 export * from "./dedupe";
+export * from "./slack";
 export * from "./store";
 export * from "./types";