Applications

Application Knowledge copies selected external content into Ciele as searchable Sources. Each Source follows the normal ingestion path, appears in citations, and answers only for the linked Assistants. The integration is direct. It does not use Merge or another integration broker.

Connection, Import, and Source

An Application Connection stores one authorized external account. An Application Import selects content within that account, a schedule, and the Assistants allowed to search it. A sync creates or updates one Ciele Source for each remote item.

Use one Connection for several Imports when their scope or Assistant links differ. For example, one Slack Connection can feed separate channel sets to separate Assistants.

Salesforce, ServiceNow, and Slack Connections belong to the Organization. Each Organization can have one Connection for each of these providers. OneDrive and Google Drive Connections belong to the Member who authorizes them. Each Member can connect one account for each personal provider.

An Organization Admin can see personal Connection metadata and remove a personal Connection. Only the owning Member can reconnect it. Provider credentials never cross the Member boundary. Imported Sources are Organization knowledge and follow their configured Assistant links.

Connect an account

An Organization Admin or Owner can connect Salesforce, ServiceNow, or Slack. A Member with Knowledge edit permission can connect their OneDrive or Google Drive and manage Imports.

1. Open Library and select Applications, or open an Assistant's Knowledge and select Applications.
2. Select Connect on the provider.
3. For Salesforce or ServiceNow, enter a Connection name, instance URL, client ID, and client secret.
4. For Slack, OneDrive, or Google Drive, select Continue connecting on the Ciele connection page.
5. Sign in on the provider's website and approve access. Ciele then refreshes the Applications list.
6. Create an Import, select its scope, and link at least one Assistant.
7. Choose Daily or Manual synchronization.
8. Save the Import and wait for its Sources to become Ready.
9. Test an answer and open its named Source citation.

Slack, OneDrive, and Google Drive ask you to sign in and authorize access. Members do not enter an OAuth client ID or secret. The Ciele deployment supplies those credentials. Not now closes the connection window without connecting an account.

The Assistant editor shows Organization Imports that you can link. The Library is the full Organization view and includes every imported Source.

Provider scopes

Ciele reports unsupported files, empty items, and provider-specific exclusions as skipped items. A bad item does not stop valid content in the same run.

Synchronization and status

Select Sync now for an immediate run. Pause stops scheduled runs without deleting Sources. Resume queues a new run. Editing a scope resets its checkpoint and schedules a complete refresh of the new selection.

The Import row shows its last and next sync, Source and Assistant-link counts, and the latest run's discovered, updated, removed, skipped, and failed totals. Provider authorization failures mark the Connection for reconnection and create an Alert. A successful later run clears the Alert.

While a sync runs, the console shows an activity card in the bottom-right corner. The card shows the number of complete items and the total, for example 261/291. Select the arrow to show a maximum of four items with their status. Items that failed are shown first.

Remote identity remains stable. An edited remote item updates the existing Source, so links and citations do not change. A removed remote item deletes its active Source but retains an internal tombstone, which lets a later reappearance create the correct replacement without duplicating it.

Provider rate limits use the returned retry delay. Daily Imports also run through the normal Ciele worker schedule, so the web process does not need to stay open.

Answer mentions in Slack

Slack Imports and conversational replies are separate features. Imports copy knowledge into Ciele. Conversational replies run a published Assistant when someone mentions @Ciele in an enabled channel.

1. Ask your deployment administrator to configure the Slack Events API described below.
2. Open the Slack Connection in Applications and select Slack assistant.
3. Select Authorize conversational permissions and approve access in Slack. Import Connections cannot post until you complete this step.
4. Select a published Assistant from your Organization.
5. Invite Ciele to each channel, then select the allowed Channels from the list. Channels that Ciele has not joined and Slack Connect channels cannot be selected.
6. Select Save Slack assistant.
7. Mention @Ciele with a question. Ciele responds in that message's thread.

The Assistant uses its linked knowledge, published configuration, and recent Slack context. It reads up to 15 channel messages and 15 thread messages before the mention. Slack rate limits can reduce that context. Ciele does not read the complete workspace for each reply. Ciele treats the channel transcript as untrusted reference material, not as instructions. Each person in a thread has their own Ciele conversation. That conversation continues across their later mentions in the thread. Direct messages do not trigger this feature.

Each Slack workspace and channel must resolve to one enabled Ciele Organization connection. When two Organizations enable the same channel, Ciele does not respond there. Ciele raises an Alert in both Organizations until one of them removes the channel. Reconnecting to a different workspace or Slack application clears the conversational configuration. The Slack Connection must belong to the same Slack application as the deployment's SLACK_APPLICATION_APP_ID. Ciele refuses to save the settings otherwise.

Configure the Slack Events API

Deploy the Slack database migration before enabling events. Configure these server-only values from Slack's Basic Information page:

SLACK_APPLICATION_APP_ID=
SLACK_SIGNING_SECRET=

Keep the existing OAuth client ID, client secret, and HTTPS OAuth callback. The signing secret is different from the client secret. Never place either secret in a public environment variable.

1. Add app_mentions:read and chat:write under OAuth & Permissions, in addition to the existing import scopes.
2. Enable Event Subscriptions and set the request URL to {origin}/api/slack/events.
3. Subscribe to the app_mention bot event and save the configuration.
4. Configure an Organization model provider that can serve published Assistant traffic.

Ciele requests the two reply scopes only when a Member selects Authorize conversational permissions. A Connection that is used for Imports alone keeps a read-only token.

The endpoint verifies Slack signatures and stores each event before acknowledging it. The worker runs after acknowledgement and uses the same conversation runtime as published Assistants. Personal provider subscriptions do not serve Slack traffic.

The deployment also exposes /api/cron/run-slack, protected by CRON_SECRET, for queued retries and interrupted workers. The self-hosted scheduler runs it every 5 minutes. The supplied Vercel schedule runs daily, because the Hobby plan permits daily schedules only. Configure a frequent authenticated scheduler when a hosted deployment requires prompt retry recovery.

Ciele creates an Alert when it cannot answer a mention. Causes include a channel that Ciele has not joined, an archived or shared channel, an unpublished Assistant, and a failed delivery. If Slack delivery has an uncertain result, Ciele suppresses automatic reposts and creates an Alert. Check the Slack thread before you manually retry an affected event. When the Slack token is revoked or expires, Ciele marks the Connection for reconnection. The Applications list then shows Reconnect.

Reconnect or delete

Select Reconnect when consent expires or the account changes. The Connection keeps the same identity and its Imports remain configured.

Deleting an Import deletes its synchronized Sources for every linked Assistant. Deleting a Connection deletes all its Imports and Sources. The confirmation shows the affected Import, Source, and Assistant-link counts. Ciele attempts provider token revocation when the provider supports it, then always removes the local credentials.

Configure OAuth for a self-hosted deployment

Set APP_ENCRYPTION_KEY before you connect any provider. Ciele seals OAuth tokens and the per-Connection Salesforce and ServiceNow client secrets with that key.

The managed Ciele service supplies the shared OAuth registrations for Slack, Microsoft, and Google. Each self-hosted deployment supplies its own registrations through environment variables. These registrations identify the Ciele deployment. They do not identify an Organization or Member account.

Create provider OAuth applications and set the pairs you enable:

SLACK_APPLICATION_CLIENT_ID=
SLACK_APPLICATION_CLIENT_SECRET=
MICROSOFT_APPLICATION_CLIENT_ID=
MICROSOFT_APPLICATION_CLIENT_SECRET=
GOOGLE_APPLICATION_CLIENT_ID=
GOOGLE_APPLICATION_CLIENT_SECRET=
APPLICATION_IMPORT_MAX_REMOTE_ITEMS=100000
APPLICATION_IMPORT_MAX_ORG_BYTES=5368709120
APPLICATION_IMPORT_MAX_CONCURRENT=3

The three limits bound synchronized remote items per Connection, stored Application bytes per Organization, and active sync claims per Organization. Lower them for smaller deployments. Ciele checkpoints the provider cursor and continues large imports in later durable claims.

Salesforce and ServiceNow client credentials are specific to the connected Organization. The Admin enters them in the protected Connection form. Ciele seals them before storage and never returns them to the browser. ServiceNow uses Authorization Code and does not store a username or password.

Register one exact callback URL per provider. Replace {origin} with the public HTTPS origin of your Ciele console:

A missing Slack, Microsoft, or Google environment-variable pair prevents authorization for that provider. Connect still opens the Ciele connection page, which explains that the deployment needs setup. Admins and Owners can open the setup guide from that page. Salesforce and ServiceNow remain available because the Admin enters their OAuth registration in the Connection form. Both use Authorization Code. Salesforce, Microsoft, and Google also use PKCE. Every transaction is short-lived and bound to the Organization, initiating Member, provider, and exact callback URL.

Troubleshooting

Application Imports are read-only for source content, and an Import Connection's token cannot post. Only a Connection with completed conversational permissions can post Slack replies. Ciele does not enforce provider access-control lists at answer time or support SharePoint libraries.