Use usertoken for slack search when bot search token expires

.env.example

@@ -12,6 +12,12 @@ NODE_ENV="development"
 SLACK_APP_TOKEN="xapp-your-app-token"
 # Bot User OAuth Token (OAuth & Permissions)
 SLACK_BOT_TOKEN="xoxb-your-bot-token"
+# Optional Slack user token, not the bot token, used for public-channel search
+# when the bot's ephemeral search token expires. Mint it with search:read.public
+# only.
+# gorkie refuses to use it if it also grants search:read.im, search:read.mpim,
+# or search:read.private, since those can read DMs and private channels.
+SLACK_SEARCH_USER_TOKEN=""
 # Optional opt-in allowlist: gate access to members of this channel id. Unset means everyone is allowed.
 OPT_IN_CHANNEL=""
 

README.md

@@ -109,6 +109,7 @@ local database named `gorkie`. Mastra auto-creates its tables on first run.
 |---|---|---|
 | `SLACK_BOT_TOKEN` | yes | Bot User OAuth token (`xoxb-…`) |
 | `SLACK_APP_TOKEN` | yes | App-level token with `connections:write` (`xapp-…`) |
+| `SLACK_SEARCH_USER_TOKEN` | no | Slack user token, not the bot token, used for public-channel search after the bot's ephemeral search token expires. Mint it with `search:read.public` only; gorkie verifies the granted scopes on first use and refuses the token if it also carries `search:read.im`, `search:read.mpim`, or `search:read.private` |
 | `OPT_IN_CHANNEL` | no | Slack channel id gating access to members only (opt-in allowlist); unset means everyone is allowed |
 | `HACKCLUB_API_KEY` | yes | Hack Club AI proxy key, a gateway rung for every model |
 | `OPENCODE_API_KEY` | yes | opencode.ai/zen gateway key, tried alongside Hack Club |

src/env.ts

@@ -10,6 +10,7 @@ export const env = createEnv({
 
     SLACK_BOT_TOKEN: z.string().min(1),
     SLACK_APP_TOKEN: z.string().min(1),
+    SLACK_SEARCH_USER_TOKEN: z.string().min(1).optional(),
     OPT_IN_CHANNEL: z.string().optional(),
 
     HACKCLUB_API_KEY: z.string().min(1),

src/mastra/chat/adapter.ts

@@ -1,4 +1,8 @@
 import { SlackAdapter } from '@chat-adapter/slack';
+import {
+  moveAsterisksAfterMarkdownLinksInStream,
+  normalizeMarkdownMessage,
+} from './markdown';
 
 const mentionPattern = /<@([A-Z0-9_]+)(?:\|([^<>]+))?>/g;
 
@@ -61,18 +65,28 @@ export class SlackAgentAdapter extends SlackAdapter {
     return super.handleMessageEvent(...args);
   }
 
+  override postMessage(
+    ...args: Parameters<SlackAdapter['postMessage']>
+  ): ReturnType<SlackAdapter['postMessage']> {
+    const [threadId, message] = args;
+    return super.postMessage(threadId, normalizeMarkdownMessage(message));
+  }
+
   override async stream(
     ...args: Parameters<SlackAdapter['stream']>
   ): ReturnType<SlackAdapter['stream']> {
     const [threadId, textStream, options] = args;
+    const normalizedTextStream = moveAsterisksAfterMarkdownLinksInStream({
+      stream: textStream,
+    });
     const { channel } = this.decodeThreadId(threadId);
     const { chat } = this;
     if (
       channel.startsWith('D') ||
       (options?.recipientUserId && options?.recipientTeamId) ||
       !chat
     ) {
-      return super.stream(threadId, textStream, options);
+      return super.stream(threadId, normalizedTextStream, options);
     }
     let recipient = this.recipients.get(threadId);
     if (!recipient) {
@@ -85,9 +99,9 @@ export class SlackAgentAdapter extends SlackAdapter {
       }
     }
     if (!recipient) {
-      return super.stream(threadId, textStream, options);
+      return super.stream(threadId, normalizedTextStream, options);
     }
-    return super.stream(threadId, textStream, {
+    return super.stream(threadId, normalizedTextStream, {
       ...options,
       recipientUserId: recipient.userId,
       recipientTeamId: recipient.teamId,

src/mastra/chat/markdown.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from 'bun:test';
+import {
+  moveAsterisksAfterMarkdownLinks,
+  moveAsterisksAfterMarkdownLinksInStream,
+} from './markdown';
+
+describe('moveAsterisksAfterMarkdownLinks', () => {
+  test('moves every asterisk after the closing link delimiter', () => {
+    expect(
+      moveAsterisksAfterMarkdownLinks(
+        'See [one](https://example.com/*path*) and [two](https://two.test*).'
+      )
+    ).toBe(
+      'See [one](https://example.com/path)** and [two](https://two.test)*.'
+    );
+  });
+
+  test('supports parentheses and escaped parentheses in link destinations', () => {
+    expect(
+      moveAsterisksAfterMarkdownLinks(
+        String.raw`[nested](https://example.com/a(*b)) [escaped](https://example.com/a\)*b)`
+      )
+    ).toBe(
+      String.raw`[nested](https://example.com/a(b))* [escaped](https://example.com/a\)b)*`
+    );
+  });
+
+  test('preserves incomplete links', () => {
+    expect(
+      moveAsterisksAfterMarkdownLinks('[label](https://example.com/*')
+    ).toBe('[label](https://example.com/*');
+  });
+});
+
+describe('moveAsterisksAfterMarkdownLinksInStream', () => {
+  test('normalizes links split across stream chunks', async () => {
+    async function* chunks() {
+      yield 'See [la';
+      await Promise.resolve();
+      yield 'bel](https://example';
+      yield { type: 'markdown_text' as const, text: '.com*) next' };
+    }
+
+    const normalized: Array<string | { type: 'markdown_text'; text: string }> =
+      [];
+    for await (const chunk of moveAsterisksAfterMarkdownLinksInStream({
+      stream: chunks(),
+    })) {
+      if (typeof chunk === 'string' || chunk.type === 'markdown_text') {
+        normalized.push(chunk);
+      }
+    }
+
+    expect(normalized).toEqual([
+      'See [la',
+      'bel',
+      { type: 'markdown_text', text: '](https://example.com)* next' },
+    ]);
+  });
+});

src/mastra/chat/markdown.ts

@@ -0,0 +1,122 @@
+import type { AdapterPostableMessage, StreamChunk } from 'chat';
+
+class MarkdownLinkNormalizer {
+  private bufferedLink = '';
+  private parenthesisDepth = 0;
+  private readonly state = new Set<'pendingCloseBracket'>();
+
+  push(markdown: string): string {
+    let normalized = '';
+
+    for (const character of markdown) {
+      if (this.parenthesisDepth === 0) {
+        if (this.state.has('pendingCloseBracket')) {
+          if (character === '(') {
+            this.bufferedLink = '](';
+            this.parenthesisDepth = 1;
+            this.state.delete('pendingCloseBracket');
+            continue;
+          }
+          normalized += ']';
+          this.state.delete('pendingCloseBracket');
+        }
+        if (character === ']') {
+          this.state.add('pendingCloseBracket');
+          continue;
+        }
+        normalized += character;
+        continue;
+      }
+
+      this.bufferedLink += character;
+      let precedingBackslashes = 0;
+      for (
+        let index = this.bufferedLink.length - 2;
+        this.bufferedLink[index] === '\\';
+        index -= 1
+      ) {
+        precedingBackslashes += 1;
+      }
+      if (precedingBackslashes % 2 === 1) {
+        continue;
+      }
+      if (character === '(') {
+        this.parenthesisDepth += 1;
+        continue;
+      }
+      if (character !== ')') {
+        continue;
+      }
+
+      this.parenthesisDepth -= 1;
+      if (this.parenthesisDepth > 0) {
+        continue;
+      }
+
+      const asterisks = this.bufferedLink.match(/\*/g)?.join('') ?? '';
+      normalized += this.bufferedLink.replaceAll('*', '') + asterisks;
+      this.bufferedLink = '';
+    }
+
+    return normalized;
+  }
+
+  finish(): string {
+    const remainder = `${this.state.has('pendingCloseBracket') ? ']' : ''}${this.bufferedLink}`;
+    this.bufferedLink = '';
+    this.parenthesisDepth = 0;
+    this.state.clear();
+    return remainder;
+  }
+}
+
+export function moveAsterisksAfterMarkdownLinks(markdown: string): string {
+  const normalizer = new MarkdownLinkNormalizer();
+  return normalizer.push(markdown) + normalizer.finish();
+}
+
+export function normalizeMarkdownMessage(
+  message: AdapterPostableMessage
+): AdapterPostableMessage {
+  if (typeof message === 'string') {
+    return moveAsterisksAfterMarkdownLinks(message);
+  }
+  if ('markdown' in message) {
+    return {
+      ...message,
+      markdown: moveAsterisksAfterMarkdownLinks(message.markdown),
+    };
+  }
+  return message;
+}
+
+export async function* moveAsterisksAfterMarkdownLinksInStream({
+  stream,
+}: {
+  stream: AsyncIterable<string | StreamChunk>;
+}): AsyncGenerator<string | StreamChunk> {
+  const normalizer = new MarkdownLinkNormalizer();
+
+  for await (const chunk of stream) {
+    if (typeof chunk === 'string') {
+      const normalized = normalizer.push(chunk);
+      if (normalized) {
+        yield normalized;
+      }
+      continue;
+    }
+    if (chunk.type === 'markdown_text') {
+      const text = normalizer.push(chunk.text);
+      if (text) {
+        yield { ...chunk, text };
+      }
+      continue;
+    }
+    yield chunk;
+  }
+
+  const remainder = normalizer.finish();
+  if (remainder) {
+    yield remainder;
+  }
+}

src/mastra/prompts/agents/research.ts

@@ -36,7 +36,8 @@ For time-sensitive claims, verify the event date and publication date. State whe
 - Resolve people and channels with get_user and get_channel_info instead of guessing names or ids.
 - Preserve Slack ids exactly. Include a permalink when the tool surface provides one.
 - Use Slack code mode to list, read, or search canvases. If evidence depends on a Slack file whose contents remain unreadable, return its id or link and explain what the parent must inspect. Do not imply that you reviewed unread content.
-- If Slack search reports an expired token, do not retry it. Use conversation history when sufficient or report that a fresh mention is required.
+- Slack search covers public channels only. If it reports an expired token, do not retry it. Use conversation history when sufficient or report that a fresh mention is required.
+- When a Slack search result reports searchedAs "workspace", it came from a workspace-wide public search rather than the asker's own view. Note that in the evidence when it matters.
 
 ## Web research
 

src/mastra/prompts/slack.ts

@@ -15,4 +15,4 @@ gorkie's source code is at https://github.com/techwithanirudh/gorkie.
 </slack>`;
 
 export const slackToolPrompt = `\
-For the current Slack conversation, omit optional channelId and threadId inputs so tools use request context. Pass an explicit Slack id only when it was provided by the user or returned by a tool. Never invent an id, change an id prefix, or convert a U... user id into a C... channel id. If search_slack reports an expired token, do not retry it; use conversation history or report that a fresh mention is required.`;
+For the current Slack conversation, omit optional channelId and threadId inputs so tools use request context. Pass an explicit Slack id only when it was provided by the user or returned by a tool. Never invent an id, change an id prefix, or convert a U... user id into a C... channel id. search_slack covers public channels only, never DMs or private channels. If it reports an expired token, do not retry it; use conversation history or report that a fresh mention is required. When its searchedAs output is "workspace", the results came from a workspace-wide public search rather than the asker's own view, so say so if it changes what you can claim.`;

src/mastra/tools/slack/post-message.ts

@@ -3,6 +3,7 @@ import { createTool } from '@mastra/core/tools';
 import { z } from 'zod';
 import { slack } from '../../chat/client';
 import { chat } from '../../chat/instance';
+import { moveAsterisksAfterMarkdownLinks } from '../../chat/markdown';
 import { resolveTarget, targetSchema } from '../../chat/target';
 import { channelContext } from '../../lib/context';
 import { rawId } from '../../lib/ids';
@@ -77,7 +78,9 @@ Errors: channel_not_found usually means the bot isn't a member of that private c
       const sent = await slack.webClient.chat.postMessage({
         channel,
         ...(threadTs ? { thread_ts: threadTs } : {}),
-        ...markdownConverter.toSlackPayload({ markdown: message }),
+        ...markdownConverter.toSlackPayload({
+          markdown: moveAsterisksAfterMarkdownLinks(message),
+        }),
         ...(requesterUser?.avatarUrl
           ? { icon_url: requesterUser.avatarUrl }
           : {}),