diff --git a/.github/contributing.md b/.github/contributing.md index 667ed63..cd54def 100644 --- a/.github/contributing.md +++ b/.github/contributing.md @@ -15,7 +15,7 @@ For security issues, do not open a public issue. See [SECURITY.md](../SECURITY.m ## Development setup -This is a TypeScript project targeting Node.js 20+. +This is a TypeScript project targeting Node.js 22+. ```bash npm install diff --git a/README.md b/README.md index 86efc0b..78eebf6 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ OpenShell gateway <--gRPC--> Bridge <--Socket Mode--> Slack Create the app from [`manifest.json`](./manifest.json): [api.slack.com/apps](https://api.slack.com/apps) -> **Create New App** -> **From a manifest**. It is a Socket Mode app (no request URLs) and requests a single bot scope, `chat:write`, to keep the install easy for admins to approve. It also sets the App -Home + `app_home_opened` subscription, interactivity, and the Messages tab. +Home + `app_home_opened` subscription and interactivity. After creating it, install to the workspace for the bot token (`xoxb-...`) and generate an app-level token with `connections:write` (`xapp-...`) for Socket Mode. The bot does not self-join diff --git a/docs/03-deployment.md b/docs/03-deployment.md index b7844c2..cd9f895 100644 --- a/docs/03-deployment.md +++ b/docs/03-deployment.md @@ -6,7 +6,7 @@ mock, see the README's "Local testing" section. ## Prerequisites -- Node.js 20+ and npm. +- Node.js 22+ and npm. - Network reach from wherever the bridge runs to the OpenShell gateway (gRPC). - A Slack workspace where you can install an app. - OpenShell gateway credentials: an mTLS bundle (single-host installs) or a bearer token @@ -27,9 +27,9 @@ with minimal review. Two consequences to know: keep the scope surface small. You must create the approval channel and invite the bot yourself (next step). If the bot is later removed from the channel, posts fail with `not_in_channel` and the bridge retries on each poll until it is re-invited (no restart needed). -- **Messages tab enabled** (`features.app_home.messages_tab_enabled`). Approvals route to a channel, - not DMs, so the whole admin group has visibility; the Messages tab is enabled only for a complete - App Home experience and adds no OAuth scope. +- **Messages tab off, Home tab on** (`features.app_home`). Approvals route to a channel, not DMs, so + the app needs no Messages tab (`messages_tab_enabled: false`). The App Home dashboard uses the Home + tab (`home_tab_enabled: true`) instead. Neither tab adds an OAuth scope. ### Tokens diff --git a/docs/04-testing-runbook.md b/docs/04-testing-runbook.md index 4a70562..779f9d9 100644 --- a/docs/04-testing-runbook.md +++ b/docs/04-testing-runbook.md @@ -32,7 +32,7 @@ It covers both capabilities: the approval flow (Steps 1-8) and the audit-event c * macOS Apple Silicon (Homebrew present) or Linux x86_64/arm64 with glibc >= 2.28. Intel macOS and Alpine/musl are rejected by the installer. * A container runtime the gateway can drive (Docker Desktop / Docker Engine 28.0+, or Podman 5.x) is installed and running. -* Node.js 20+ and npm, git, curl, jq available (Step 9 also uses `openssl`). On Linux the install step may require sudo (apt/dnf). +* Node.js 22+ and npm, git, curl, jq available (Step 9 also uses `openssl`). On Linux the install step may require sudo (apt/dnf). * The bridge repo is `github.com/slack-samples/openshell-slack-admin-bridge`; the runtime it drives is `NVIDIA/OpenShell` (installed via curl below), a separate, unrelated project that happens to share the OpenShell name. # Step 1 - Preflight @@ -45,7 +45,7 @@ It covers both capabilities: the approval flow (Steps 1-8) and the audit-event c export WORK="${WORK:-/tmp/openshell-bridge}" set -o pipefail mkdir -p "$WORK" -node -p "+process.versions.node.split('.')[0] >= 20 ? 'NODE_OK' : 'NODE_BAD'" +node -p "+process.versions.node.split('.')[0] >= 22 ? 'NODE_OK' : 'NODE_BAD'" npm -v git --version jq --version diff --git a/proto/NOTICE b/proto/NOTICE index bb98d4b..4bcac7c 100644 --- a/proto/NOTICE +++ b/proto/NOTICE @@ -9,8 +9,8 @@ from NVIDIA's OpenShell project: They are included in this repository to define the gRPC wire contract that this sample communicates with. Each file retains its original SPDX header: + SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. SPDX-License-Identifier: Apache-2.0 - Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. These files are licensed under the Apache License, Version 2.0. You may obtain a copy of that license at: diff --git a/proto/test.proto b/proto/test.proto deleted file mode 100644 index 17d695a..0000000 --- a/proto/test.proto +++ /dev/null @@ -1,13 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.test.v1; - -// Simple object for persistence tests. -message ObjectForTest { - string id = 1; - string name = 2; - uint32 count = 3; -} diff --git a/scripts/send-samples.ts b/scripts/send-samples.ts index 66c027b..f676edb 100644 --- a/scripts/send-samples.ts +++ b/scripts/send-samples.ts @@ -59,7 +59,7 @@ const proposedChunks = [ rule_name: "allow-telemetry", proposed_rule: { name: "allow-telemetry", - endpoints: [endpoint("telemetry.vendor.io", [443])], + endpoints: [endpoint("telemetry.example.io", [443])], binaries: [{ path: "/opt/agent/runner" }], }, rationale: "Agent attempted to POST anonymous usage telemetry to an unlisted host.", diff --git a/src/capture/sample-events.ts b/src/capture/sample-events.ts index 33d8d49..ff80b25 100644 --- a/src/capture/sample-events.ts +++ b/src/capture/sample-events.ts @@ -68,7 +68,7 @@ const HOSTS = [ "github.com", "api.openai.com", "weights.internal.example.net", - "telemetry.vendor.io", + "telemetry.example.io", "cdn.jsdelivr.net", "unknown-host.example.com", ];