feat(create): fetch remote manifest after linking app during create by srtaalej · Pull Request #585 · slackapi/slack-cli

srtaalej · 2026-06-09T00:27:10Z

Changelog

slack create --app now fetches the app's manifest from remote settings and writes it to the project's manifest.json, replacing the template's generic manifest with the actual app configuration.

Summary

Follow-up to #565. After linking an existing app during slack create --app --template, the CLI now fetches the remote manifest from App Settings and overwrites the template's manifest.json with it.

This also updates LinkExistingApp to return (*types.SlackAuth, error) so callers can use the auth token for subsequent API calls (like manifest fetching).

Design decisions:

Manifest source remains local in .slack/config.json — the remote content is written locally
Only manifest.json is overwritten (not manifest.ts/.js which are code files in Deno projects)
On fetch failure, a warning is printed and the command continues — the project and link still succeed

Testing

make test testdir=cmd/project testname=TestCreateCommand_AppFlag_FetchesRemoteManifest
make test testdir=cmd/project testname=TestCreateCommand_AppFlag
make test testdir=cmd/project testname=Test_Project_InitCommand
make test testdir=cmd/app testname=TestLinkCommand

Manual:

make build
./bin/slack create my-test -t slack-samples/bolt-js-starter-template --app <real-app-id> --environment local
Verify my-test/manifest.json contains the remote app's manifest
Test with an invalid app ID to confirm the warning is shown and the project is still created

Notes 🔴

Open question: should we set manifest.source to remote in .slack/config.json after writing the fetched manifest? Currently left as local so the user "owns" the file going forward.

A future PR could add merging logic between template and remote manifests.

manifest.ts/.js (Deno SDK) projects are not supported

⌛ not merging until #598 is merged because of conflicts

Requirements

I've read and understood the Contributing Guidelines and have done my best effort to follow them.
I've read and agree to the Code of Conduct.

codecov · 2026-06-09T00:32:30Z

Codecov Report

❌ Patch coverage is 36.66667% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.67%. Comparing base (9b4abf2) to head (19cfb59).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/manifest/export.go	0.00%	17 Missing ⚠️
cmd/project/create.go	84.61%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #585      +/-   ##
==========================================
- Coverage   71.71%   71.67%   -0.04%     
==========================================
  Files         226      227       +1     
  Lines       19182    19212      +30     
==========================================
+ Hits        13757    13771      +14     
- Misses       4213     4230      +17     
+ Partials     1212     1211       -1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Resolve conflicts by integrating main's stricter --app/--environment validation with the remote manifest fetch feature. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg

@srtaalej Thanks for sharing these changes 👾 ✨

I'm leaving a few comments on a first run experience around prompts and earlier errors. Other comments are on code organization with thoughts around the difference between create and link logic that might be interesting to clear up ✂️ 📠

Testing is solid for me too but I leave a note around escaped values that are unsettling to me. I'm unsure what caused that 👻

zimeg · 2026-06-22T19:49:46Z

+// fetchAndWriteRemoteManifest fetches the app manifest from remote settings and writes it to the project.
+func fetchAndWriteRemoteManifest(ctx context.Context, clients *shared.ClientFactory, token, appID, projectPath string) error {
+	slackYaml, err := clients.AppClient().Manifest.GetManifestRemote(ctx, token, appID)
+	if err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(slackYaml.AppManifest, "", "  ")
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	manifestPath := filepath.Join(projectPath, "manifest.json")
+	return afero.WriteFile(clients.Fs, manifestPath, data, 0644)
+}
+


📠 suggestion: We might find a new file better for this? It might be shared in other commands or PRs #591!

internal/manifest/export.go

addressed in 040a3c8 💟

zimeg · 2026-06-22T19:52:51Z

+				clients.IO.PrintWarning(ctx, "%s", style.Sectionf(style.TextSection{
+					Text: "Could not fetch the remote app manifest",
+					Secondary: []string{
+						fetchErr.Error(),
+						"The template manifest was kept unchanged",
+					},
+				}))


⚠️ question: Could returning the error here bring more confidence for scripts? I'm unsure when this might fail but would hope that invalid app IDs error overall to start

hmm I'm hesitant because the create+--app command doesn't necessarily fail if fetching remote manifest fails. the app is still created and linked successfully. only one part of the command fails in this case so maybe it would be better to provide a way to try again in follow up PRs?
or simply telling users to run slack manifest info --source remote and copy that into manifest.json 🤔

👁️‍🗨️ thought: I'm worried I'd miss warnings in CI and overwrite an existing app manifest for "A001" with these commands if the manifest step of "create" fails:

$ slack create my-app -t slack-samples/bolt-js-blank-template -a A001 -E deployed $ slack deploy

Recommending to save the outputs of manifest info to a file is a good remediation!

zimeg · 2026-06-22T20:02:28Z

 	LinkAppFooterSection(ctx, clients, app)

-	return nil
+	return auth, nil


🔗 question: Instead of returning an auth to calling functions that's often ignored, would setting up the manifest as part of the link command if no apps are saved make sense?

👾 ramble: I'm wanting to avoid mixing concepts with the create command which should be from a project template I think while link is seeming more app specific.

zimeg · 2026-06-22T20:26:29Z

+	if err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(slackYaml.AppManifest, "", "  ")


🔬 note: I'm finding some values are escaped but this hasn't caused an error when testing the custom step template:

- "type": "slack#/types/user_id", + "type": "slack#\/types\/user_id",

addressed in 1092da0 🚀

zimeg · 2026-06-22T20:29:37Z

+	}
+	data = append(data, '\n')
+	manifestPath := filepath.Join(projectPath, "manifest.json")
+	return afero.WriteFile(clients.Fs, manifestPath, data, 0644)


🏁 suggestion: We should save the hash alongside this to avoid a confusing prompt of a changed manifest on the first "run" command:

slack-cli/internal/pkg/apps/install.go

Lines 167 to 176 in f984c33

hash, err := clients.Config.ProjectConfig.Cache().NewManifestHash(ctx, upstream.Manifest.AppManifest)

if err != nil {

return types.App{}, "", err

}

if !hash.Equals(saved) {

err := clients.Config.ProjectConfig.Cache().SetManifestHash(ctx, app.AppID, hash)

if err != nil {

return types.App{}, "", err

}

}

$ cd my-test $ slack run 📚 App Manifest Manifest values for this app are overwritten on reinstall ┃ Overwrite manifest on app settings with the project's manifest file? ┃ Yes ┃ ❱ No

addressed in aecb626 🌟

mwbrooks

Answers to Open Questions:

Open question: should we set manifest.source to remote in .slack/config.json after writing the fetched manifest? Currently left as local so the user "owns" the file going forward.

It's a good question - I think we should not change the manifest source. The main reason is that this keeps the existing functionality and it's unclear whether the developer would prefer App Settings or manifest.json when creating an app locally from App Settings.

So, since there's no clear answer, I'd rather keep the functionality unchanged. Instead, we can continue to move forward on the 2-way sync solution to remove this issue entirely.

manifest.ts/.js (Deno SDK) projects are not supported

Totally fine to not support manifest.ts/.js. This is a Deno SDK only feature and App Settings isn't offering Deno SDK creation journeys afaik.

mwbrooks

💬 @srtaalej This is shaping up really nice! I've left a suggestion on how we can tighten up the LinkExistingApp function to return the auth while also improving how it currently sets app. While it feels like a larger change, it turns out to be a similar line count and should help align this PR around @zimeg's feedback.

mwbrooks · 2026-06-26T00:24:29Z

 // link an existing app and additional information is included in the header.
 // The shouldConfirm option is encouraged for third-party callers.
-func LinkExistingApp(ctx context.Context, clients *shared.ClientFactory, app *types.App, shouldConfirm bool) (err error) {
+func LinkExistingApp(ctx context.Context, clients *shared.ClientFactory, app *types.App, shouldConfirm bool) (_ *types.SlackAuth, err error) {


suggestion: We should consider returning a single prompts.SelectedApp (contains an app and auth) instead of mixing a pointer out-parameter (app *types.App) with the new returned types.SlackAuth.

The app parameter is currently an "out-param" dressed up as an "in-param" - it's always overwritten at L171 (*app, auth, err = promptExistingApp(...)). Every caller passes a throwaway &types.App{}.

After this PR, app comes out via the pointer while auth comes out via the return value - two different output mechanisms for two values produced at the same call site. This makes the function confusing and brittle.

prompts.SelectedApp already pairs App + Auth and is the exact shape this function produces. Also, cmd/app already imports internal/prompts, so no new dependency.

Suggested signature:

func LinkExistingApp(ctx context.Context, clients *shared.ClientFactory, shouldConfirm bool) (prompts.SelectedApp, error)

A zero SelectedApp{} (i.e. selected.App.AppID == "") signals "user declined at the confirm prompt" - which is what create.go already checks on L243.

Caller changes:

LinkCommandRunE (this file): drop the app *types.App param; call _, err := LinkExistingApp(ctx, clients, false). Also remove the throwaway app := &types.App{} in NewLinkCommand.

cmd/project/init.go:113: _, err = app.LinkExistingApp(ctx, clients, true)

cmd/project/create.go:232: selected, linkErr := app.LinkExistingApp(ctx, clients, false) then if selected.App.AppID != "" { fetchAndWriteRemoteManifest(ctx, clients, selected.Auth.Token, selected.App.AppID, absProjectPath) } — the existing auth != nil && linkedApp.AppID != "" guard collapses to one condition.

Diff size is comparable to the current PR, no callers need to manufacture an empty App{}, and the API answers the obvious question: yes, this function returns a selected app.

thank you for this clarification @mwbrooks! I agree the LinkExistingApp is a bit messy 🤔 since i have another pr that also makes changes to LinkExistingApp, i feel like i should leave that refactor to a follow-up PR to avoid more conflicts. for now i have taken out the auth param i introduced and instead get it from:

@create.go if linkedApp.AppID != "" { auth, err := clients.Auth().AuthWithTeamID(ctx, linkedApp.TeamID) if err != nil { return err } fetchErr := manifest.FetchAndWriteRemoteManifest(ctx, clients, auth.Token, ...) ...

so that link.go remains unchanged. what do you think of this approach?

@srtaalej I think your approach to manually get the auth param works and keeps the impact low. So feel free to run with that!

…t.go

… instead

srtaalej · 2026-06-30T17:00:10Z

Update

The diff is much smaller now:

FetchAndWriteRemoteManifest was moved to its own file (internal/manifest/export.go) so it can be reused by other commands (e.g. feat: add slack manifest diff command #591)
The LinkExistingApp signature is unchanged from main — no auth return was added. Instead, create.go resolves the token via clients.Auth().AuthWithTeamID() after linking
Fixed forward slash escaping in the exported manifest JSON
Saved the manifest hash after writing so the first slack run doesn't prompt about a "changed manifest"

Follow-ups

Easier recovery for failed manifest sync: Currently there's no CLI command to retry fetching the remote manifest after create finishes (no slack manifest pull). For now users can run slack manifest info --source remote > manifest.json as a workaround. A dedicated command would be better.
Refactor LinkExistingApp: The app *types.App out-param pattern is awkward (per Michael's feedback). PR feat(create): cleanup app creation outputs when slack create -app passed #598 is already reworking this — will align after that lands.

srtaalej · 2026-06-30T17:05:09Z

+			}
+			fetchErr := manifest.FetchAndWriteRemoteManifest(ctx, clients, auth.Token, linkedApp.AppID, absProjectPath)
+			if fetchErr != nil {
+				clients.IO.PrintWarning(ctx, "%s", style.Sectionf(style.TextSection{


left a comment about this silent fail 🪂 #585 (comment) @zimeg

zimeg

@srtaalej Super nice to find earlier PRs building up to this feature! 💡 ✨

I'm leaving a few comments after reviewing this that I'm curious to discuss perhaps with the last point:

🌩️ Missing outputs: It's not clear that the template manifest is overwritten based on the output. I think a line or so toward this might be helpful.
🍵 Hidden errors: Erroring when writing the remote manifest can lead to unexpected cases in CI and I share when this might happen and that earlier returns are favorable to debug IMO.
🌈 Saving to file: The suggestion you share to remediate these errors is great and I'm curious now if we extend the manifest info command to support such, that we might call here?

$ slack manifest info --app A001 --to-file manifest.json

📸 Here's the output referenced!

$ slack create my-test -t slack-samples/bolt-js-starter-template --app A07V06USK0X --team T038J6TH5PF --environment local

🗣️ If the manifest info approach seems alright I think it'd be a good separate PR that'd make this one even more focused! These are all promising changes.

zimeg · 2026-07-06T20:55:37Z

+	var buf bytes.Buffer
+	encoder := json.NewEncoder(&buf)
+	encoder.SetEscapeHTML(false)
+	encoder.SetIndent("", "  ")
+	if err := encoder.Encode(slackYaml.AppManifest); err != nil {
+		return err
+	}


🔭 question: Can we reuse the stringifier in adjacent package?

slack-cli/internal/goutils/json.go

Lines 62 to 74 in 19cfb59

// JSONMarshalUnescapedIndent converts a struct into an easily readable JSON

// encoding without escaping characters

func JSONMarshalUnescapedIndent(v interface{}) (string, error) {

var buff bytes.Buffer

encoder := json.NewEncoder(&buff)

encoder.SetEscapeHTML(false)

encoder.SetIndent("", " ")

err := encoder.Encode(v)

if err != nil {

return "", err

}

return buff.String(), nil

}

zimeg · 2026-07-06T20:57:29Z

🧪 todo: Let's add unit tests alongside internal packages for more strict checks!

zimeg · 2026-07-06T21:20:24Z

+				clients.IO.PrintWarning(ctx, "%s", style.Sectionf(style.TextSection{
+					Text: "Could not fetch the remote app manifest",
+					Secondary: []string{
+						fetchErr.Error(),
+						"The template manifest was kept unchanged",
+					},
+				}))


👁️‍🗨️ thought: I'm worried I'd miss warnings in CI and overwrite an existing app manifest for "A001" with these commands if the manifest step of "create" fails:

$ slack create my-app -t slack-samples/bolt-js-blank-template -a A001 -E deployed $ slack deploy

Recommending to save the outputs of manifest info to a file is a good remediation!

zimeg · 2026-07-06T21:27:47Z

+)
+
+// FetchAndWriteRemoteManifest fetches the app manifest from remote settings and writes it to the project.
+func FetchAndWriteRemoteManifest(ctx context.Context, clients *shared.ClientFactory, token, appID, projectPath string) error {


Suggested change

func FetchAndWriteRemoteManifest(ctx context.Context, clients *shared.ClientFactory, token, appID, projectPath string) error {

func SetManifestLocal(ctx context.Context, clients *shared.ClientFactory, slackYaml types.SlackYaml) error {

🧮 thought: This might be nice to pair with other app manifest methods although a best file structure isn't clear to me right now:

GetManifestRemote

GetManifestLocal

SetManifestLocal: New!

📝 note: This suggestion might go well with the idea to extend manifest info too?

zimeg · 2026-07-06T21:46:02Z

+	hash, err := clients.Config.ProjectConfig.Cache().NewManifestHash(ctx, slackYaml.AppManifest)
+	if err != nil {
+		return err
+	}
+	return clients.Config.ProjectConfig.Cache().SetManifestHash(ctx, appID, hash)


🏆 praise: Thanks for including this!

🦔 thought: I'm now curious if this would be better as part of the app link command? We might pull the manifest to write a hash when linking a specific app which can improve the link experience outside of create command?

srtaalej and others added 8 commits May 27, 2026 21:31

feat: add --app flag support to slack create for linking existing apps

0d8bfd3

address pr feedback

da2eb75

Merge branch 'main' into ale-app-id-flag

e57f7d5

Merge branch 'main' into ale-app-id-flag

aceb7a4

simplify app creation with app link cmd

906346a

Merge branch 'main' into ale-app-id-flag

8128d5e

simplify redundant tests

315c9bb

feat: fetch remote manifest after create with app ID

3177aa1

srtaalej self-assigned this Jun 9, 2026

srtaalej requested a review from a team as a code owner June 9, 2026 00:27

srtaalej added enhancement M-T: A feature request for new functionality changelog Use on updates to be included in the release notes semver:minor Use on pull requests to describe the release version increment labels Jun 9, 2026

Merge branch 'main' into ale-fetch-remote-manifest

6d6749a

srtaalej and others added 3 commits June 12, 2026 13:57

Merge branch 'main' into ale-fetch-remote-manifest

42782a3

Resolve conflicts by integrating main's stricter --app/--environment validation with the remote manifest fetch feature. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Merge branch 'main' into ale-fetch-remote-manifest

3d642ca

Merge branch 'main' into ale-fetch-remote-manifest

f984c33

srtaalej requested review from mwbrooks and zimeg June 18, 2026 16:50

zimeg reviewed Jun 22, 2026

View reviewed changes

Merge branch 'main' into ale-fetch-remote-manifest

3396d78

mwbrooks reviewed Jun 25, 2026

View reviewed changes

mwbrooks reviewed Jun 26, 2026

View reviewed changes

srtaalej marked this pull request as draft June 30, 2026 00:35

srtaalej added 5 commits June 29, 2026 21:28

refactor: move confirmation prompt out of LinkExistingApp into callers

bdbf756

undo changes to link command

1538faf

refactor: move fetchAndWriteRemoteManifest to internal/manifest/expor…

040a3c8

…t.go

fix: avoid escaping forward slashes in exported manifest JSON

1092da0

fix: save manifest hash after fetching remote manifest on create

aecb626

refactor: remove auth return from LinkExistingApp, use AuthWithTeamID…

c289a09

… instead

srtaalej modified the milestones: v4.4.0, Next Release Jun 30, 2026

chore: remove unnecessary import alias in create_test.go

19c2fac

Merge branch 'main' into ale-fetch-remote-manifest

2283fbc

srtaalej marked this pull request as ready for review June 30, 2026 17:01

srtaalej requested review from mwbrooks and zimeg June 30, 2026 17:03

srtaalej commented Jun 30, 2026

View reviewed changes

srtaalej and others added 4 commits July 1, 2026 14:00

Merge branch 'main' into ale-fetch-remote-manifest

236702a

fix: correct indentation from merge resolution

8639a29

Merge branch 'main' into ale-fetch-remote-manifest

2939882

Merge branch 'main' into ale-fetch-remote-manifest

19cfb59

zimeg reviewed Jul 6, 2026

View reviewed changes

	hash, err := clients.Config.ProjectConfig.Cache().NewManifestHash(ctx, upstream.Manifest.AppManifest)
	if err != nil {
	return types.App{}, "", err
	}
	if !hash.Equals(saved) {
	err := clients.Config.ProjectConfig.Cache().SetManifestHash(ctx, app.AppID, hash)
	if err != nil {
	return types.App{}, "", err
	}
	}

	// JSONMarshalUnescapedIndent converts a struct into an easily readable JSON
	// encoding without escaping characters
	func JSONMarshalUnescapedIndent(v interface{}) (string, error) {
	var buff bytes.Buffer
	encoder := json.NewEncoder(&buff)
	encoder.SetEscapeHTML(false)
	encoder.SetIndent("", " ")
	err := encoder.Encode(v)
	if err != nil {
	return "", err
	}
	return buff.String(), nil
	}

	func FetchAndWriteRemoteManifest(ctx context.Context, clients *shared.ClientFactory, token, appID, projectPath string) error {
	func SetManifestLocal(ctx context.Context, clients *shared.ClientFactory, slackYaml types.SlackYaml) error {

Uh oh!

Conversation

srtaalej commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Summary

Testing

Notes 🔴

Requirements

Uh oh!

codecov Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mwbrooks left a comment

Choose a reason for hiding this comment

Uh oh!

mwbrooks left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

srtaalej commented Jun 30, 2026

Update

Follow-ups

Uh oh!

srtaalej Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

srtaalej commented Jun 9, 2026 •

edited

Loading

codecov Bot commented Jun 9, 2026 •

edited

Loading

srtaalej Jun 30, 2026 •

edited

Loading