refactor: Restructure bot into modular agent with multi-provider LLM support

.coderabbit.yaml

@@ -12,12 +12,5 @@ reviews:
     enabled: true
     drafts: false
   path_filters: ['!cassettes/**']
-  path_instructions:
-    - path: 'src/usecases/**/*.ts'
-      instructions: 'Clean Architecture 원칙과 ServiceResult 패턴을 따르는지 확인'
-    - path: '**/*.test.ts'
-      instructions: 'AAA 패턴(Arrange-Act-Assert)과 한국어 테스트 설명을 확인'
-    - path: 'src/domains/**/*.ts'
-      instructions: '도메인 모델이 순수하고 외부 의존성이 없는지 확인'
 chat:
   auto_reply: true

.env.example

@@ -1,12 +1,54 @@
-BOT_CURSOR=":loading:"
+# --- Slack (required at runtime) ---
+SLACK_BOT_TOKEN="xoxb-your-slack-bot-token"
+SLACK_SIGNING_SECRET="your-slack-signing-secret"
 
-SLACK_BOT_TOKEN="xoxb-xxxx"
-SLACK_SIGNING_SECRET="xxxx"
+# --- LLM / text (default: openai / gpt-4o-mini) ---
+LLM_PROVIDER="openai"            # openai | bedrock | xai
+LLM_MODEL="gpt-4o-mini"          # OpenAI: gpt-4o-mini / gpt-5 / o3  |  Bedrock: us.anthropic.claude-opus-4-6-v1 / amazon.nova-pro-v1:0  |  xAI: grok-4-1-fast-reasoning / grok-4.20-0309-reasoning
 
-ALLOWED_CHANNEL_IDS="C000000,C000001"
-ALLOWED_CHANNEL_MESSAGE="구루미에게 질문은 {} 채널을 이용해 주세요~"
+# --- Image generation (default: openai / gpt-image-1) ---
+IMAGE_PROVIDER="openai"          # openai | bedrock | xai
+IMAGE_MODEL="gpt-image-1"        # OpenAI: gpt-image-1 / dall-e-3  |  Bedrock: amazon.nova-canvas-v1:0 / amazon.titan-image-generator-v2:0  |  xAI: grok-imagine-image / grok-imagine-image-pro
 
-PERSONAL_MESSAGE="너는 AWSKRUG(AWS Korea User Group)의 친절하고 전문적인 AI 비서 구루미(Gurumi)야."
-SYSTEM_MESSAGE="참고한 링크가 있다면 링크도 알려주세요. 한국어로 응답해주세요."
+# --- Providers (required by provider in use) ---
+OPENAI_API_KEY="sk-your-openai-api-key"
+XAI_API_KEY=""                   # required when LLM_PROVIDER=xai or IMAGE_PROVIDER=xai. Get at https://console.x.ai
+TAVILY_API_KEY=""                # optional, enables richer web search
 
-REACTION_EMOJIS="refund-done"
+# --- Agent behavior ---
+AGENT_MAX_STEPS=3
+MAX_OUTPUT_TOKENS=4096           # per-LLM-hop output token cap (>=256)
+RESPONSE_LANGUAGE="ko"           # ko | en
+
+# --- Slack UX ---
+BOT_CURSOR=":robot_face:"
+MAX_LEN_SLACK=3000               # per-message character cap, >=500
+SYSTEM_MESSAGE=""                # optional extra operator policy appended to task rules
+PERSONA_MESSAGE=""               # optional answer style / tone (e.g. "자연스러운 한국어로 핵심부터 답한다")
+
+# --- Access control / throttle ---
+ALLOWED_CHANNEL_IDS=""           # comma-separated channel IDs, empty = allow all
+ALLOWED_CHANNEL_MESSAGE=""       # reply sent when channel not allowed; "{}" → first allowed channel
+ALLOWED_USER_IDS=""              # comma-separated user IDs, empty = allow all (applies to DMs too)
+ALLOWED_USER_MESSAGE=""          # reply sent when user not allowed; "{}" → first allowed user
+MAX_THROTTLE_COUNT=100           # per-user active request cap
+
+# --- Storage (DynamoDB — created by serverless deploy) ---
+DYNAMODB_TABLE_NAME="lambda-gurumi-bot-dev"
+MAX_HISTORY_CHARS=4000
+AWS_REGION="us-east-1"
+
+# --- Observability ---
+LOG_LEVEL="INFO"
+
+# --- Document / time ---
+DEFAULT_TIMEZONE="Asia/Seoul"    # IANA TZ for get_current_time default
+MAX_DOC_CHARS=20000              # per-document extracted-text cap (>=1000)
+MAX_DOC_PAGES=50                 # per-document PDF page cap (>=1)
+MAX_DOC_BYTES=26214400           # per-document download cap, 25MB (>=65536)
+
+# --- Web fetch (fetch_webpage tool) ---
+MAX_WEB_CHARS=8000               # per-fetch returned content char cap (>=500)
+MAX_WEB_BYTES=2097152            # per-fetch download cap, 2MB (>=65536)
+MAX_WEB_LINKS=20                 # per-fetch outbound-link cap (>=0)
+JINA_READER_BASE="https://r.jina.ai"  # override for self-hosted Jina Reader

.github/aws-role/README.md

@@ -1,7 +1,7 @@
 # aws role
 
 ```bash
-export NAME="lambda-gurumi-ai-bot"
+export NAME="lambda-gurumi-bot"
 ```
 
 ## create role
@@ -44,7 +44,7 @@ aws iam attach-role-policy --role-name "${NAME}" --policy-arn "${POLICY_ARN}"
       - name: configure aws credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: "arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/lambda-gurumi-ai-bot"
+          role-to-assume: "arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/lambda-gurumi-bot"
           role-session-name: github-actions-ci-bot
           aws-region: ${{ env.AWS_REGION }}
 

.github/aws-role/role-policy.json

@@ -26,7 +26,7 @@
         "cloudformation:DeleteChangeSet",
         "cloudformation:DescribeChangeSet"
       ],
-      "Resource": "arn:aws:cloudformation:*:*:stack/lambda-gurumi-ai-bot-*"
+      "Resource": "arn:aws:cloudformation:*:*:stack/lambda-gurumi-bot-*"
     },
     {
       "Sid": "Lambda",
@@ -47,7 +47,7 @@
         "lambda:ListTags"
       ],
       "Resource": [
-        "arn:aws:lambda:*:*:function:lambda-gurumi-ai-bot-*"
+        "arn:aws:lambda:*:*:function:lambda-gurumi-bot-*"
       ]
     },
     {
@@ -65,7 +65,7 @@
         "iam:UntagRole",
         "iam:ListRoleTags"
       ],
-      "Resource": "arn:aws:iam::*:role/lambda-gurumi-ai-bot-*"
+      "Resource": "arn:aws:iam::*:role/lambda-gurumi-bot-*"
     },
     {
       "Sid": "S3",
@@ -89,10 +89,8 @@
         "s3:DeleteObject"
       ],
       "Resource": [
-        "arn:aws:s3:::lambda-gurumi-ai-bot-*",
-        "arn:aws:s3:::lambda-gurumi-ai-bot-*/*",
-        "arn:aws:s3:::gurumi-ai-bot-*",
-        "arn:aws:s3:::gurumi-ai-bot-*/*"
+        "arn:aws:s3:::lambda-gurumi-bot-*",
+        "arn:aws:s3:::lambda-gurumi-bot-*/*"
       ]
     },
     {
@@ -110,7 +108,7 @@
         "dynamodb:ListTagsOfResource"
       ],
       "Resource": [
-        "arn:aws:dynamodb:*:*:table/gurumi-ai-bot-*"
+        "arn:aws:dynamodb:*:*:table/lambda-gurumi-bot-*"
       ]
     },
     {
@@ -121,11 +119,16 @@
         "apigateway:POST",
         "apigateway:PUT",
         "apigateway:PATCH",
-        "apigateway:DELETE"
+        "apigateway:DELETE",
+        "apigateway:UpdateRestApiPolicy",
+        "apigateway:GetRestApiPolicy",
+        "apigateway:DeleteRestApiPolicy"
       ],
       "Resource": [
         "arn:aws:apigateway:*::/restapis",
-        "arn:aws:apigateway:*::/restapis/*"
+        "arn:aws:apigateway:*::/restapis/*",
+        "arn:aws:apigateway:*::/tags",
+        "arn:aws:apigateway:*::/tags/*"
       ]
     },
     {
@@ -141,7 +144,7 @@
         "logs:UntagResource",
         "logs:ListTagsForResource"
       ],
-      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/lambda-gurumi-ai-bot-*"
+      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/lambda-gurumi-bot-*"
     },
     {
       "Sid": "S3Vectors",
@@ -160,8 +163,8 @@
         "s3vectors:ListTagsForResource"
       ],
       "Resource": [
-        "arn:aws:s3vectors:*:*:bucket/gurumi-ai-bot-*",
-        "arn:aws:s3vectors:*:*:bucket/gurumi-ai-bot-*/index/*"
+        "arn:aws:s3vectors:*:*:bucket/lambda-gurumi-bot-*",
+        "arn:aws:s3vectors:*:*:bucket/lambda-gurumi-bot-*/index/*"
       ]
     },
     {

.github/aws-role/trust-policy.json

@@ -12,7 +12,10 @@
           "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
         },
         "StringLike": {
-          "token.actions.githubusercontent.com:sub": "repo:awskrug/lambda-gurumi-ai-bot:*"
+          "token.actions.githubusercontent.com:sub": [
+            "repo:awskrug/lambda-gurumi-bot:*",
+            "repo:nalbam/lambda-gurumi-bot:*"
+          ]
         }
       }
     }

.github/workflows/push.yml

@@ -2,107 +2,93 @@ name: Deploy to AWS Lambda
 
 on:
   push:
-    branches:
-      - main
-  repository_dispatch:
-    types:
-      - deploy
-  workflow_dispatch:
+    branches: [main]
+  workflow_dispatch: {}
+  repository_dispatch: {}
 
-env:
-  AWS_REGION: "us-east-1"
-  AWS_ROLE_NAME: "lambda-gurumi-ai-bot"
-
-  STAGE: "dev"
-
-  FOUNDATION_MODEL: ${{ vars.FOUNDATION_MODEL }}
-
-  ALLOWED_CHANNEL_IDS: ${{ vars.ALLOWED_CHANNEL_IDS }}
-  ALLOWED_CHANNEL_MESSAGE: ${{ vars.ALLOWED_CHANNEL_MESSAGE }}
-  BOT_CURSOR: ${{ vars.BOT_CURSOR }}
-  MAX_LEN_BEDROCK: ${{ vars.MAX_LEN_BEDROCK }}
-  MAX_LEN_SLACK: ${{ vars.MAX_LEN_SLACK }}
-  MAX_THROTTLE_COUNT: ${{ vars.MAX_THROTTLE_COUNT }}
-  PERSONAL_MESSAGE: ${{ vars.PERSONAL_MESSAGE }}
-  REACTION_EMOJIS: ${{ vars.REACTION_EMOJIS }}
-  SLACK_SAY_INTERVAL: ${{ vars.SLACK_SAY_INTERVAL }}
-  SYSTEM_MESSAGE: ${{ vars.SYSTEM_MESSAGE }}
-
-  AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
-  SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-  SLACK_SIGNING_SECRET: ${{ secrets.SLACK_SIGNING_SECRET }}
-
-# Permission can be added at job level or workflow level
 permissions:
-  id-token: write   # This is required for requesting the JWT
-  contents: read    # This is required for actions/checkout
+  id-token: write
+  contents: read
 
 jobs:
   deploy:
     runs-on: ubuntu-24.04
-
     steps:
       - name: Checkout 🛎️
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+        uses: actions/checkout@v5
 
-      - name: Setup Python 3.12 🐍
-        uses: actions/setup-python@v5
+      - name: Set up Python 🐍
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: "3.12"
 
-      - name: Install dependencies
-        run: npm install
-
-      - name: Install Python dependencies
-        run: npx serverless plugin install --name serverless-python-requirements
+      - name: Set up Node.js 🟢
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
 
-      - name: Install dotenv plugin
-        run: npx serverless plugin install --name serverless-dotenv-plugin
+      - name: Install Python deps 📦
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install -r requirements-dev.txt
 
-      - name: Install dependencies
-        run: pip install -r requirements.txt
+      - name: Run tests and check coverage ✅
+        run: pytest --cov=src --cov-report=term-missing
 
-      - name: Set up environment variables 📝
+      - name: Install Serverless + plugins 🛠️
         run: |
-          echo "FOUNDATION_MODEL=${FOUNDATION_MODEL}" >> .env
-          echo "ALLOWED_CHANNEL_IDS=${ALLOWED_CHANNEL_IDS}" >> .env
-          echo "ALLOWED_CHANNEL_MESSAGE=${ALLOWED_CHANNEL_MESSAGE}" >> .env
-          echo "BOT_CURSOR=${BOT_CURSOR}" >> .env
-          echo "MAX_LEN_BEDROCK=${MAX_LEN_BEDROCK}" >> .env
-          echo "MAX_LEN_SLACK=${MAX_LEN_SLACK}" >> .env
-          echo "MAX_THROTTLE_COUNT=${MAX_THROTTLE_COUNT}" >> .env
-          echo "PERSONAL_MESSAGE=${PERSONAL_MESSAGE}" >> .env
-          echo "REACTION_EMOJIS=${REACTION_EMOJIS}" >> .env
-          echo "SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN}" >> .env
-          echo "SLACK_SAY_INTERVAL=${SLACK_SAY_INTERVAL}" >> .env
-          echo "SLACK_SIGNING_SECRET=${SLACK_SIGNING_SECRET}" >> .env
-          echo "SYSTEM_MESSAGE=${SYSTEM_MESSAGE}" >> .env
+          npm install -g serverless@3
+          npm install serverless-python-requirements
 
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@v4
+      - name: Configure AWS credentials (OIDC) 🔑
+        uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: "arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/${{ env.AWS_ROLE_NAME }}"
-          role-session-name: github-actions-ci-bot
-          aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/lambda-gurumi-bot
+          aws-region: us-east-1
 
       - name: Deploy to AWS Lambda 🚀
-        run: npx serverless deploy --stage ${{ env.STAGE }} --region ${{ env.AWS_REGION }}
-
-      - name: Update Bedrock Agent Alias 🔄
-        run: |
-          AGENT_ID=$(aws cloudformation describe-stacks \
-            --stack-name lambda-gurumi-ai-bot-${{ env.STAGE }} \
-            --query "Stacks[0].Outputs[?OutputKey=='AgentId'].OutputValue" \
-            --output text)
-          ALIAS_ID=$(aws cloudformation describe-stacks \
-            --stack-name lambda-gurumi-ai-bot-${{ env.STAGE }} \
-            --query "Stacks[0].Outputs[?OutputKey=='AgentAliasId'].OutputValue" \
-            --output text)
-
-          aws bedrock-agent update-agent-alias \
-            --agent-id "${AGENT_ID}" \
-            --agent-alias-id "${ALIAS_ID}" \
-            --agent-alias-name live \
-            --region ${{ env.AWS_REGION }}
+        env:
+          # --- secrets: Slack ---
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_SIGNING_SECRET: ${{ secrets.SLACK_SIGNING_SECRET }}
+          # --- secrets: LLM provider keys ---
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          # --- secrets: Web search ---
+          TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
+          # --- vars: LLM / Image ---
+          IMAGE_MODEL: ${{ vars.IMAGE_MODEL }}
+          IMAGE_PROVIDER: ${{ vars.IMAGE_PROVIDER }}
+          LLM_MODEL: ${{ vars.LLM_MODEL }}
+          LLM_PROVIDER: ${{ vars.LLM_PROVIDER }}
+          # --- vars: Agent behavior ---
+          AGENT_MAX_STEPS: ${{ vars.AGENT_MAX_STEPS }}
+          MAX_OUTPUT_TOKENS: ${{ vars.MAX_OUTPUT_TOKENS }}
+          RESPONSE_LANGUAGE: ${{ vars.RESPONSE_LANGUAGE }}
+          # --- vars: Slack UX ---
+          BOT_CURSOR: ${{ vars.BOT_CURSOR }}
+          MAX_LEN_SLACK: ${{ vars.MAX_LEN_SLACK }}
+          SYSTEM_MESSAGE: ${{ vars.SYSTEM_MESSAGE }}
+          PERSONA_MESSAGE: ${{ vars.PERSONA_MESSAGE }}
+          # --- vars: Access control / throttle ---
+          ALLOWED_CHANNEL_IDS: ${{ vars.ALLOWED_CHANNEL_IDS }}
+          ALLOWED_CHANNEL_MESSAGE: ${{ vars.ALLOWED_CHANNEL_MESSAGE }}
+          ALLOWED_USER_IDS: ${{ vars.ALLOWED_USER_IDS }}
+          ALLOWED_USER_MESSAGE: ${{ vars.ALLOWED_USER_MESSAGE }}
+          MAX_THROTTLE_COUNT: ${{ vars.MAX_THROTTLE_COUNT }}
+          # --- vars: Storage ---
+          MAX_HISTORY_CHARS: ${{ vars.MAX_HISTORY_CHARS }}
+          # --- vars: Observability ---
+          LOG_LEVEL: ${{ vars.LOG_LEVEL }}
+          # --- vars: Document / time ---
+          DEFAULT_TIMEZONE: ${{ vars.DEFAULT_TIMEZONE }}
+          MAX_DOC_BYTES: ${{ vars.MAX_DOC_BYTES }}
+          MAX_DOC_CHARS: ${{ vars.MAX_DOC_CHARS }}
+          MAX_DOC_PAGES: ${{ vars.MAX_DOC_PAGES }}
+          # --- vars: Web fetch ---
+          JINA_READER_BASE: ${{ vars.JINA_READER_BASE }}
+          MAX_WEB_BYTES: ${{ vars.MAX_WEB_BYTES }}
+          MAX_WEB_CHARS: ${{ vars.MAX_WEB_CHARS }}
+          MAX_WEB_LINKS: ${{ vars.MAX_WEB_LINKS }}
+        run: npx serverless deploy --stage dev --region us-east-1