CRITICAL: Never use Read, Edit, or Write tools on ~/.cyrus/.env or any file inside ~/.cyrus/. Use only Bash commands (grep, printf >>, etc.) to interact with env files — secrets must never be read into the conversation context. Never scrape, extract, or read secret values from web pages — guide the user to copy them manually.
Setup Slack
Creates a Slack application from a pre-built manifest so Cyrus can respond to messages in Slack channels.
Step 1: Check Existing Configuration
grep -E '^SLACK_BOT_TOKEN=' ~/.cyrus/.env 2>/dev/nullIf SLACK_BOT_TOKEN is already set, inform the user:
Slack is already configured. Skipping this step. To reconfigure, removeSLACK_BOT_TOKENandSLACK_SIGNING_SECRETfrom~/.cyrus/.envand re-run.
Skip to completion.
Step 2: Read Variables
Read the base URL (set by setup-endpoint):
grep '^CYRUS_BASE_URL=' ~/.cyrus/.env | cut -d= -f2-You also need AGENT_NAME and AGENT_DESCRIPTION — these were collected in Step 0 of the orchestrator and should be available from the conversation context.
Step 3: Build Manifest JSON
Construct the manifest, substituting <AGENT_NAME>, <AGENT_DESCRIPTION>, and <CYRUS_BASE_URL> with actual values.
IMPORTANT: Use the manifest template EXACTLY as shown below. The event subscription path MUST be /slack-webhook (not /slack/events or any other path). This matches the route registered by SlackEventTransport in the Cyrus codebase.
{
"display_information": {
"name": "<AGENT_NAME>",
"description": "<AGENT_DESCRIPTION>",
"background_color": "#00240e"
},
"features": {
"bot_user": {
"display_name": "<AGENT_NAME>",
"always_online": false
}
},
"oauth_config": {
"redirect_urls": [
"<CYRUS_BASE_URL>/slack/oauth/callback"
],
"scopes": {
"user": [
"canvases:read",
"canvases:write",
"channels:history",
"chat:write",
"groups:history",
"im:history",
"mpim:history",
"users:read",
"users:read.email",
"reactions:write",
"search:read.public",
"search:read.private",
"search:read.mpim",
"search:read.im",
"search:read.files",
"search:read.users"
],
"bot": [
"groups:read",
"app_mentions:read",
"assistant:write",
"canvases:write",
"channels:history",
"channels:read",
"chat:write",
"chat:write.customize",
"groups:history",
"im:history",
"mpim:history",
"reactions:write",
"search:read.files",
"search:read.public",
"search:read.users",
"users:read",
"users:read.email",
"mpim:read"
]
},
"pkce_enabled": false
},
"settings": {
"event_subscriptions": {
"request_url": "<CYRUS_BASE_URL>/slack-webhook",
"bot_events": [
"app_mention",
"member_joined_channel"
]
},
"org_deploy_enabled": false,
"socket_mode_enabled": false,
"token_rotation_enabled": false
}
}Step 4: Create Slack App
All paths use the "From a manifest" flow. Never create the app "From scratch".
Determine which browser automation mode to use (see orchestrator rules):
- If
claude-in-chromeMCP tools are available → use Path A-1 (claude-in-chrome) - If
agent-browseris installed and a Chrome debug session is connected → use Path A-2 (agent-browser) - Otherwise → use Path B (manual)
Path A-1: claude-in-chrome Automation
Use the mcp__claude-in-chrome__* tools to navigate and interact with the user's existing Chrome browser.
- Navigate to https://api.slack.com/apps
- Click Create New App
- Select From a manifest in the modal
- Pick the workspace
- Click Next
- Select JSON tab and paste the manifest from Step 3 (fully substituted with real values)
- Click Next, review, click Create
After creation, the app lands on the Basic Information page. Do NOT take screenshots of credential pages. Proceed to Step 5 (credential collection).
Path A-2: agent-browser Automation
If agent-browser is connected to a Chrome debug session:
4a. Navigate to Slack app creation
agent-browser navigate "https://api.slack.com/apps"Take a screenshot to verify the page loaded and the user is logged in.
4b. Click "Create New App"
agent-browser click "button:text('Create New App')"4c. Select "From a manifest" in the modal
agent-browser click "button:text('From a manifest')"4d. Select workspace
Take a screenshot to see the workspace picker. Click the appropriate workspace. If multiple are listed, ask the user which one.
agent-browser click "button:text('Next')"4e. Select JSON format and paste manifest
Click the JSON tab if not already selected:
agent-browser click "button:text('JSON')"Paste the manifest using JavaScript:
agent-browser eval "var editor = document.querySelector('textarea, [role=\"textbox\"], .ace_editor textarea, .CodeMirror textarea'); if (editor) { var nativeInputValueSetter = Object.getOwnPropertyDescriptor(window.HTMLTextAreaElement.prototype, 'value').set; nativeInputValueSetter.call(editor, JSON.stringify(<MANIFEST_JSON>, null, 2)); editor.dispatchEvent(new Event('input', { bubbles: true })); 'pasted'; } else { 'editor not found'; }"If that doesn't work, try:
agent-browser click "textarea"
agent-browser keyboard "Control+a"
agent-browser type '<MANIFEST_JSON_STRING>'Take a screenshot to verify, then click Next:
agent-browser click "button:text('Next')"4f. Review and create
Take a screenshot to verify the summary, then click Create:
agent-browser click "button:text('Create')"After creation, do NOT screenshot credential pages or attempt to scrape secrets. Proceed to Step 5.
Path B: Manual Guided Setup
Guide the user through the manifest flow:
### Create a Slack App 1. Go to https://api.slack.com/apps 2. Click Create New App 3. In the modal, select From a manifest 4. Pick the workspace you want to associate the app with 5. Click Next 6. Select JSON format and paste the following manifest:
Print the fully-substituted manifest JSON for the user to copy.
1. Click Next, review the summary, then click Create
Proceed to Step 5.
Step 5: Install App & Collect Credentials
After the app is created (via any path), guide the user through installation and credential collection. The agent must NOT scrape, read, or extract secrets from the page. The user copies them manually.
5a. Install to Workspace
Tell the user:
1. In your Slack app settings, go to Install App in the left sidebar 2. Click Install to Workspace 3. Click Allow
If using browser automation (A-1 or A-2), the agent can navigate to the Install App page and click the buttons — but must stop after installation completes and not screenshot the resulting page.
5b. Add Credential Placeholders
Add placeholder lines to the env file so the user can fill them in:
grep -q '^SLACK_BOT_TOKEN=' ~/.cyrus/.env || echo 'SLACK_BOT_TOKEN=' >> ~/.cyrus/.env
grep -q '^SLACK_SIGNING_SECRET=' ~/.cyrus/.env || echo 'SLACK_SIGNING_SECRET=' >> ~/.cyrus/.env5c. Open env file for editing
# macOS
code --new-window ~/.cyrus/.env 2>/dev/null || open -a TextEdit ~/.cyrus/.env
# Linux
code --new-window ~/.cyrus/.env 2>/dev/null || xdg-open ~/.cyrus/.env5d. Guide the user to copy credentials
Tell the user:
I've opened~/.cyrus/.env. You need to paste two values: 1. Bot User OAuth Token — go to your app's OAuth & Permissions page, copy the Bot User OAuth Token (starts withxoxb-), and paste it afterSLACK_BOT_TOKEN=2. Signing Secret — go to your app's Basic Information page, scroll to App Credentials, click Show next to Signing Secret, copy it, and paste it afterSLACK_SIGNING_SECRET=Save and close the file when done.
5e. Wait and verify
After the user confirms they've saved, verify:
grep -c '^SLACK_BOT_TOKEN=.' ~/.cyrus/.env
grep -c '^SLACK_SIGNING_SECRET=.' ~/.cyrus/.envBoth must return 1 (the . after = ensures the value is not empty). If either is 0, ask the user to check the file.
Completion
✓ Slack app created from manifest and installed ✓ Bot token and signing secret saved to ~/.cyrus/.envNote: The event subscription request_url will fail Slack's verification challenge until Cyrus is actually running. Once Cyrus is started, go to the app's Event Subscriptions page and re-enter the URL to trigger verification, or Slack will retry automatically.