codex-notify 1.0.0

data/bin/codex-notify

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'codex_notify'
+
+exit(CodexNotify.main(ARGV))

data/bin/codex-notify-hook

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'codex_notify/hook_cli'
+
+exit(CodexNotify::HookCLI.main(ARGV))

data/lib/codex_notify/cli.rb

@@ -0,0 +1,112 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pathname'
+require 'time'
+require_relative 'config'
+require_relative 'log_event_parser'
+require_relative 'message_formatter'
+require_relative 'session_log'
+require_relative 'slack_client'
+require_relative 'stream_processor'
+require_relative 'hook_store'
+require_relative 'slack_outbox'
+require_relative 'durable_slack_publisher'
+require_relative 'outbox_commands'
+
+module CodexNotify
+  module CLI
+    PostClient = Data.define(:token, :channel, :post_callable) do
+      def post(text, thread_ts: nil)
+        post_callable.call(token, channel, text, thread_ts)
+      end
+    end
+
+    module_function
+
+    def slack_post(token, channel, text, thread_ts = nil)
+      SlackClient.new(token:, channel:).post(text, thread_ts:)
+    end
+
+    def main(argv = nil, stdin: nil, stderr: $stderr, stdout: $stdout, legacy_checkout_root: nil)
+      args = CodexNotify::Config.parse_args(argv, stderr:, legacy_checkout_root:)
+      if args.migrate_config
+        env_path = args.env_file if args.env_file_explicit
+        return ConfigMigrator.new(legacy_checkout_root:, stdout:, stderr:).run(
+          env_path:,
+          config_path: args.config_file
+        )
+      end
+      if args.outbox_action
+        return OutboxCommands.run(
+          action: args.outbox_action,
+          id: args.outbox_id,
+          outbox_dir: args.outbox_dir,
+          token: args.token,
+          channel: args.channel,
+          state_file: Pathname(args.outbox_dir).join('thread-state.json'),
+          stdout:,
+          stderr:
+        )
+      end
+      unless args.token && args.channel
+        stderr.puts('ERROR: need --token/--channel or a Slack destination from environment or config file')
+        return 2
+      end
+
+      cwd = Dir.pwd
+      title = args.title || "Codex run: #{File.basename(cwd)}"
+      session_file = args.session_file ? Pathname(args.session_file) : CodexNotify::SessionLog.find_latest_session_file(Pathname(args.sessions_dir))
+      unless session_file&.exist?
+        stderr.puts('ERROR: no Codex session log file found')
+        return 2
+      end
+      root_message = CodexNotify::MessageFormatter.build_root_message(
+        title,
+        cwd,
+        user_name: args.user_name,
+        session_id: CodexNotify::SessionLog.session_id_from_log(session_file) ||
+          CodexNotify::SessionLog.session_id_from_path(session_file)
+      )
+      outbox = SlackOutbox.new(args.outbox_dir)
+      store = HookStore.new(Pathname(args.outbox_dir).join('thread-state.json'))
+      publisher = DurableSlackPublisher.new(
+        client: PostClient.new(args.token, args.channel, method(:slack_post)),
+        store:,
+        outbox:,
+        channel: args.channel,
+        throttle_sec: args.throttle_sec
+      )
+
+      code = CodexNotify::StreamProcessor.process_codex_log_stream(
+        CodexNotify::SessionLog.iter_follow_lines(
+          session_file,
+          poll_sec: args.poll_sec,
+          once: args.once,
+          start_at_end: !args.once,
+          sleep_func: method(:sleep)
+        ),
+        token: args.token,
+        channel: args.channel,
+        root_message:,
+        initial_prompt: args.prompt,
+        user_name: args.user_name,
+        include_tools: args.include_tools,
+        throttle_sec: args.throttle_sec,
+        post_func: method(:slack_post),
+        publisher:
+      )
+      stderr.puts('ERROR: Slack delivery requires outbox review; run --outbox-status') if code == 1
+      code
+    rescue Interrupt
+      stderr.puts('Stopped.')
+      0
+    rescue SlackOutbox::Error => e
+      stderr.puts("ERROR: #{e.message}")
+      1
+    rescue Config::Error, ConfigMigrator::Error, OptionParser::ParseError => e
+      stderr.puts("ERROR: #{e.message}")
+      2
+    end
+  end
+end

data/lib/codex_notify/config.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'optparse'
+require 'pathname'
+require_relative 'config_support'
+require_relative 'config_migrator'
+require_relative 'destination_resolver'
+require_relative 'env_source_loader'
+
+module CodexNotify
+  module Config
+    extend ConfigSupport
+
+    DEFAULT_ENV_PATH = ConfigSupport::DEFAULT_ENV_PATH
+    DEFAULT_SESSIONS_DIR = Pathname(File.expand_path('~/.codex/sessions'))
+    DEFAULT_OUTBOX_DIR = Pathname(File.expand_path('~/.codex-notify/outbox'))
+
+    class Error < StandardError; end
+
+    Args = Struct.new(
+      :env_file,
+      :env_file_explicit,
+      :config_file,
+      :migrate_config,
+      :token,
+      :channel,
+      :destination,
+      :user_name,
+      :prompt,
+      :title,
+      :include_tools,
+      :throttle_sec,
+      :sessions_dir,
+      :session_file,
+      :poll_sec,
+      :once,
+      :outbox_dir,
+      :outbox_action,
+      :outbox_id,
+      :token_from_cli,
+      keyword_init: true
+    )
+
+    module_function
+
+    def build_parser
+      options = Args.new(
+        env_file: DEFAULT_ENV_PATH,
+        env_file_explicit: false,
+        config_file: nil,
+        migrate_config: false,
+        token: nil,
+        channel: nil,
+        destination: nil,
+        user_name: nil,
+        prompt: nil,
+        title: nil,
+        include_tools: false,
+        throttle_sec: 1.05,
+        sessions_dir: DEFAULT_SESSIONS_DIR.to_s,
+        session_file: nil,
+        poll_sec: 1.0,
+        once: false,
+        outbox_dir: nil,
+        outbox_action: nil,
+        outbox_id: nil,
+        token_from_cli: false
+      )
+
+      parser = OptionParser.new do |opts|
+        opts.banner = 'Usage: codex-notify [options]'
+        add_common_options(opts, options)
+        opts.on('--prompt PROMPT') { |v| options.prompt = v }
+        opts.on('--include-tools') { options.include_tools = true }
+        opts.on('--throttle-sec FLOAT', Float) { |v| options.throttle_sec = v }
+        opts.on('--sessions-dir PATH') { |v| options.sessions_dir = v }
+        opts.on('--session-file PATH') { |v| options.session_file = v }
+        opts.on('--poll-sec FLOAT', Float) { |v| options.poll_sec = v }
+        opts.on('--once') { options.once = true }
+        opts.on('--outbox-dir PATH') { |v| options.outbox_dir = v }
+      end
+
+      [parser, options]
+    end
+
+    def parse_args(argv = nil, stderr: $stderr, legacy_checkout_root: nil)
+      parser, options = build_parser
+      parser.parse!(argv || [])
+      return options if options.migrate_config
+
+      ConfigDiagnostics.warn_deprecated_cli_token(stderr:) if options.token_from_cli
+
+      sources = EnvSourceLoader.new(legacy_checkout_root:, stderr:).load(
+        path: options.env_file,
+        explicit: options.env_file_explicit,
+        config_path: options.config_file
+      )
+      policy = resolve_policy(sources, stderr:)
+      warn_ignored_repository_values(sources, policy:, stderr:)
+      apply_destination(options, sources, policy:, stderr:)
+
+      eligible = eligible_sources(sources, policy:)
+      trusted = trusted_sources(sources)
+      options.user_name ||= eligible.lookup('CODEX_NOTIFY_USER_NAME')&.value || system_user_name
+      options.title ||= eligible.lookup('CODEX_NOTIFY_TITLE')&.value
+      options.prompt ||= eligible.lookup('CODEX_PROMPT')&.value
+      options.outbox_dir ||= trusted.lookup('CODEX_NOTIFY_OUTBOX_DIR')&.value || DEFAULT_OUTBOX_DIR.to_s
+      options
+    rescue ConfigSupport::Error, EnvSourceLoader::Error, TrustedConfigLoader::Error, DestinationResolver::Error => e
+      raise Error, e.message
+    end
+  end
+end

data/lib/codex_notify/config_diagnostics.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module CodexNotify
+  module ConfigDiagnostics
+    module_function
+
+    def warn_if_file_insecure(path, label:, stderr:)
+      stat = File.stat(path)
+      return unless stat.file?
+      return if (stat.mode & 0o077).zero?
+
+      permissions = format('%04o', stat.mode & 0o777)
+      stderr.puts(
+        "WARNING: #{label} #{path} has permissions #{permissions}; " \
+        "use `chmod 600 #{path}` to restrict access to secrets."
+      )
+    rescue NotImplementedError, SystemCallError
+      nil
+    end
+
+    def warn_if_env_file_insecure(path, stderr:)
+      warn_if_file_insecure(path, label: 'env file', stderr:)
+    end
+
+    def warn_deprecated_cli_token(stderr:)
+      stderr.puts(
+        'WARNING: --token is deprecated because command-line arguments may be visible in process lists ' \
+        'and shell history; use SLACK_BOT_TOKEN or a permission-restricted env file.'
+      )
+    end
+
+    def warn_deprecated_repository_credentials(path, keys, stderr:)
+      stderr.puts(
+        "WARNING: insecure legacy mode loaded repository Slack settings #{keys.join(' and ')} from automatically " \
+        "discovered env file #{path}; this temporary compatibility mode will be removed in a future major release. " \
+        'Configure a trusted destination profile and use CODEX_NOTIFY_DESTINATION.'
+      )
+    end
+
+    def warn_ignored_repository_policy(path, stderr:)
+      stderr.puts(
+        "WARNING: ignored CODEX_NOTIFY_ENV_POLICY from automatically discovered repository env file #{path}; " \
+        'the policy must come from trusted configuration.'
+      )
+    end
+
+    def warn_ignored_repository_credentials(path, keys, policy: nil, stderr:)
+      reason = policy ? " under the #{policy} policy" : ''
+      stderr.puts(
+        "WARNING: ignored #{keys.join(', ')} from automatically discovered repository env file #{path}#{reason}."
+      )
+    end
+
+    def warn_deprecated_tool_config(path, keys, stderr:)
+      stderr.puts(
+        "WARNING: #{keys.join(', ')} loaded from legacy codex-notify env file #{path}; " \
+        'move trusted settings to the XDG config file.'
+      )
+    end
+  end
+end

data/lib/codex_notify/config_migrator.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require 'dotenv'
+require 'fileutils'
+require 'pathname'
+require 'tempfile'
+require 'yaml'
+require_relative 'config_diagnostics'
+require_relative 'destination_name'
+require_relative 'trusted_config_loader'
+
+module CodexNotify
+  class ConfigMigrator
+    PROFILE_KEYS = {
+      'SLACK_BOT_TOKEN__' => 'token',
+      'SLACK_CHANNEL__' => 'channel'
+    }.freeze
+    ENV_POLICIES = %w[legacy restricted].freeze
+
+    class Error < StandardError; end
+
+    def initialize(legacy_checkout_root: nil, environment: ENV, stdout: $stdout, stderr: $stderr)
+      @legacy_checkout_root = Pathname(legacy_checkout_root).expand_path if legacy_checkout_root
+      @environment = environment
+      @stdout = stdout
+      @stderr = stderr
+    end
+
+    def run(env_path: nil, config_path: nil)
+      source = source_path(env_path)
+      target = target_path(config_path)
+      validate_paths(source, target)
+
+      ConfigDiagnostics.warn_if_env_file_insecure(source, stderr: @stderr)
+      values = Dotenv.parse(source.to_s)
+      document = build_document(values)
+      write_config(target, YAML.dump(document))
+      @stdout.puts("Created trusted config file #{target}.")
+      @stdout.puts('Verify the destination settings, then remove migrated secrets from the legacy env file manually.')
+      0
+    rescue TrustedConfigLoader::Error => e
+      raise Error, e.message
+    rescue SystemCallError => e
+      raise Error, "could not migrate configuration: #{e.class}"
+    end
+
+    private
+
+    def source_path(path)
+      return Pathname(path).expand_path if path
+
+      unless @legacy_checkout_root
+        raise Error, '--migrate-config requires --env-file PATH outside a source checkout'
+      end
+
+      @legacy_checkout_root.join('.env')
+    end
+
+    def target_path(path)
+      return Pathname(path).expand_path if path
+
+      TrustedConfigLoader.new(environment: @environment, stderr: @stderr).default_path
+    end
+
+    def validate_paths(source, target)
+      raise Error, "legacy env file does not exist: #{source}" unless source.exist?
+      raise Error, "legacy env path is not a file: #{source}" unless source.file?
+      raise Error, 'legacy env file and config output path must be different' if source == target
+      raise Error, "config file already exists: #{target}" if target.exist?
+    end
+
+    def build_document(values)
+      document = {}
+      add_policy(document, values['CODEX_NOTIFY_ENV_POLICY'])
+      add_default_destination(document, values)
+      add_destinations(document, values)
+      raise Error, 'legacy env file contains no trusted settings to migrate' if document.empty?
+
+      document
+    end
+
+    def add_policy(document, raw_policy)
+      return if empty?(raw_policy)
+
+      policy = raw_policy.strip.downcase
+      unless ENV_POLICIES.include?(policy)
+        raise Error, "environment policy must be one of: #{ENV_POLICIES.join(', ')}"
+      end
+
+      document['env_policy'] = policy
+    end
+
+    def add_default_destination(document, values)
+      destination = {}
+      destination['token'] = values['SLACK_BOT_TOKEN'] unless empty?(values['SLACK_BOT_TOKEN'])
+      destination['channel'] = values['SLACK_CHANNEL'] unless empty?(values['SLACK_CHANNEL'])
+      document['default_destination'] = destination unless destination.empty?
+    end
+
+    def add_destinations(document, values)
+      destinations = {}
+      original_names = {}
+      values.each do |key, value|
+        next if empty?(value)
+
+        prefix, field = PROFILE_KEYS.find { |candidate, _| key.start_with?(candidate) }
+        next unless prefix
+
+        raw_name = key.delete_prefix(prefix)
+        name = DestinationName.normalize(raw_name)
+        previous = original_names[name]
+        if previous && previous != raw_name
+          raise Error, "destination name is duplicated after normalization: #{name}"
+        end
+
+        original_names[name] = raw_name
+        destinations[name] ||= {}
+        destinations[name][field] = value
+      end
+
+      destinations.sort.each do |name, destination|
+        raise Error, "destination #{name} must define channel" unless destination.key?('channel')
+      end
+      document['destinations'] = destinations.sort.to_h unless destinations.empty?
+    rescue DestinationName::Error => e
+      raise Error, e.message
+    end
+
+    def write_config(path, contents)
+      FileUtils.mkdir_p(path.dirname, mode: 0o700)
+      raise Error, "config file already exists: #{path}" if path.exist?
+
+      Tempfile.create(['codex-notify-config', '.tmp'], path.dirname.to_s) do |file|
+        file.chmod(0o600)
+        file.write(contents)
+        file.flush
+        file.fsync
+        File.link(file.path, path.to_s)
+      rescue Errno::EEXIST
+        raise Error, "config file already exists: #{path}"
+      end
+    end
+
+    def empty?(value)
+      !value || value.strip.empty?
+    end
+  end
+end

data/lib/codex_notify/config_support.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require 'dotenv'
+require 'etc'
+require 'pathname'
+require_relative 'config_diagnostics'
+
+module CodexNotify
+  module ConfigSupport
+    class Error < StandardError; end
+
+    DEFAULT_ENV_PATH = '.env'
+    DEFAULT_ENV_POLICY = 'restricted'
+    ENV_POLICIES = %w[legacy restricted].freeze
+    REPOSITORY_ALLOWED_KEYS = %w[
+      CODEX_NOTIFY_DESTINATION
+      CODEX_NOTIFY_TITLE
+      CODEX_NOTIFY_USER_NAME
+      CODEX_NOTIFY_MODE
+    ].freeze
+    REPOSITORY_CREDENTIAL_PATTERN = /\ASLACK_(?:BOT_TOKEN|CHANNEL)(?:__.*)?\z/
+    def resolve_env_paths(path = DEFAULT_ENV_PATH, legacy_checkout_root: nil)
+      env_path = Pathname(path)
+      return [env_path] if env_path.absolute?
+
+      candidates = [Pathname(Dir.pwd).join(env_path)]
+      candidates << Pathname(legacy_checkout_root).join(env_path) if legacy_checkout_root
+      candidates.map(&:expand_path).select(&:exist?).each_with_object([]) do |candidate, paths|
+        paths << candidate unless paths.any? { |path| File.identical?(path, candidate) }
+      end
+    end
+
+    def load_env_file(path = DEFAULT_ENV_PATH, override: false, stderr: $stderr, legacy_checkout_root: nil)
+      env_paths = resolve_env_paths(path, legacy_checkout_root:)
+      return if env_paths.empty?
+
+      env_paths.each { |env_path| ConfigDiagnostics.warn_if_env_file_insecure(env_path, stderr:) }
+      loader = override ? Dotenv.method(:overload) : Dotenv.method(:load)
+      loader.call(*env_paths.map(&:to_s))
+    end
+
+    def system_user_name
+      ENV['USER'] || ENV['USERNAME'] || Etc.getlogin || 'user'
+    rescue StandardError
+      ENV['USER'] || ENV['USERNAME'] || 'user'
+    end
+
+    def getenv_any(keys)
+      keys.each do |key|
+        value = ENV[key]
+        return value if value && !value.empty?
+      end
+      nil
+    end
+
+    def add_common_options(parser, options)
+      parser.on('--config PATH') do |value|
+        options.config_file = value
+      end
+      parser.on('--migrate-config', 'Create trusted YAML from a legacy env file') do
+        options.migrate_config = true
+      end
+      parser.on('--env-file PATH') do |value|
+        options.env_file = value
+        options.env_file_explicit = true if options.respond_to?(:env_file_explicit=)
+      end
+      parser.on('--token TOKEN', 'Deprecated: use the XDG config file or SLACK_BOT_TOKEN') do |value|
+        options.token = value
+        options.token_from_cli = true
+      end
+      parser.on('--channel CHANNEL') { |value| options.channel = value }
+      parser.on('--destination NAME') { |value| options.destination = value } if options.respond_to?(:destination=)
+      parser.on('--user-name NAME') { |value| options.user_name = value }
+      parser.on('--title TITLE') { |value| options.title = value }
+      if options.respond_to?(:outbox_action=)
+        parser.on('--outbox-status') { options.outbox_action = :status }
+        parser.on('--drain-outbox') { options.outbox_action = :drain }
+        parser.on('--retry-outbox ID') do |value|
+          options.outbox_action = :retry
+          options.outbox_id = value
+        end
+      end
+    end
+
+    def resolve_policy(sources, stderr: $stderr)
+      result = trusted_sources(sources).lookup('CODEX_NOTIFY_ENV_POLICY')
+      policy = result ? result.value.strip.downcase : DEFAULT_ENV_POLICY
+      raise Error, "environment policy must be one of: #{ENV_POLICIES.join(', ')}" unless ENV_POLICIES.include?(policy)
+
+      warn_if_legacy_tool_source(result&.source, ['CODEX_NOTIFY_ENV_POLICY'], stderr:)
+      policy
+    end
+
+    def apply_destination(options, sources, policy:, stderr: $stderr)
+      eligible = eligible_sources(sources, policy:)
+      resolution = DestinationResolver.new(
+        selection_sources: sources,
+        profile_sources: trusted_sources(sources),
+        default_sources: eligible
+      ).resolve(destination: options.destination, token: options.token, channel: options.channel)
+
+      options.destination = resolution.destination
+      options.token = resolution.token
+      options.channel = resolution.channel
+
+      used_sources = [resolution.token_source, resolution.channel_source].compact
+      source_keys = [
+        [resolution.token_source, 'SLACK_BOT_TOKEN'],
+        [resolution.channel_source, 'SLACK_CHANNEL']
+      ]
+      repository_keys = source_keys.filter_map { |source, key| key if source&.kind == :repository }
+      if repository_keys.any?
+        source = used_sources.find { |candidate| candidate.kind == :repository }
+        ConfigDiagnostics.warn_deprecated_repository_credentials(source.path, repository_keys, stderr:)
+      end
+
+      tool_keys = [
+        [resolution.token_source, resolution.destination ? "destination #{resolution.destination} token" : 'SLACK_BOT_TOKEN'],
+        [resolution.channel_source, resolution.destination ? "destination #{resolution.destination} channel" : 'SLACK_CHANNEL']
+      ].filter_map { |source, key| key if source&.kind == :tool }
+      warn_if_legacy_tool_source(used_sources.find { |source| source.kind == :tool }, tool_keys, stderr:)
+    end
+
+    def eligible_sources(sources, policy:)
+      return sources unless policy == 'restricted'
+
+      sources.restrict_kind(:repository, keys: REPOSITORY_ALLOWED_KEYS)
+    end
+
+    def trusted_sources(sources)
+      sources.excluding_kind(:repository)
+    end
+
+    def warn_ignored_repository_values(sources, policy:, stderr:)
+      sources.select { |source| source.kind == :repository }.each do |source|
+        policy_value = source.values['CODEX_NOTIFY_ENV_POLICY']
+        if policy_value && !policy_value.empty?
+          ConfigDiagnostics.warn_ignored_repository_policy(source.path, stderr:)
+        end
+
+        ignored = source.values.keys.grep(REPOSITORY_CREDENTIAL_PATTERN)
+        ignored.select! { |key| key.include?('__') } if policy == 'legacy'
+        next if ignored.empty?
+
+        reason = policy == 'restricted' ? policy : nil
+        ConfigDiagnostics.warn_ignored_repository_credentials(source.path, ignored.sort, policy: reason, stderr:)
+      end
+    end
+
+    def warn_if_legacy_tool_source(source, keys, stderr:)
+      return unless source&.kind == :tool && keys.any?
+
+      ConfigDiagnostics.warn_deprecated_tool_config(source.path, keys, stderr:)
+    end
+
+  end
+end

data/lib/codex_notify/destination_name.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module CodexNotify
+  module DestinationName
+    PATTERN = /\A[A-Z0-9_]+\z/
+
+    class Error < StandardError; end
+
+    module_function
+
+    def normalize(value)
+      normalized = value.to_s.strip.upcase
+      return normalized if PATTERN.match?(normalized)
+
+      raise Error, 'destination must contain only A-Z, 0-9, and _'
+    end
+  end
+end

data/lib/codex_notify/destination_resolver.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative 'destination_name'
+
+module CodexNotify
+  class DestinationResolver
+    class Error < StandardError; end
+
+    Resolution = Struct.new(
+      :destination,
+      :token,
+      :channel,
+      :token_source,
+      :channel_source,
+      keyword_init: true
+    )
+
+    def initialize(selection_sources:, profile_sources:, default_sources:)
+      @selection_sources = selection_sources
+      @profile_sources = profile_sources
+      @default_sources = default_sources
+    end
+
+    def resolve(destination:, token:, channel:)
+      selected = destination || selection_sources.lookup('CODEX_NOTIFY_DESTINATION')&.value
+      return resolve_default(token:, channel:) unless selected
+
+      resolve_profile(DestinationName.normalize(selected), token:, channel:)
+    rescue DestinationName::Error => e
+      raise Error, e.message
+    end
+
+    private
+
+    attr_reader :selection_sources, :profile_sources, :default_sources
+
+    def resolve_profile(destination, token:, channel:)
+      channel_key = "SLACK_CHANNEL__#{destination}"
+      profile_channel = profile_sources.lookup(channel_key)
+      raise Error, "destination #{destination} is not configured: missing #{channel_key}" unless profile_channel
+
+      profile_token = profile_sources.lookup("SLACK_BOT_TOKEN__#{destination}") unless token
+      default_token = profile_sources.lookup('SLACK_BOT_TOKEN') unless token || profile_token
+      resolved_token = token || profile_token&.value || default_token&.value
+      raise Error, "destination #{destination} has no Slack bot token" unless resolved_token
+
+      Resolution.new(
+        destination:,
+        token: resolved_token,
+        channel: channel || profile_channel.value,
+        token_source: token ? nil : (profile_token || default_token)&.source,
+        channel_source: channel ? nil : profile_channel.source
+      )
+    end
+
+    def resolve_default(token:, channel:)
+      token_result = default_sources.lookup('SLACK_BOT_TOKEN') unless token
+      channel_result = default_sources.lookup('SLACK_CHANNEL') unless channel
+      Resolution.new(
+        destination: nil,
+        token: token || token_result&.value,
+        channel: channel || channel_result&.value,
+        token_source: token_result&.source,
+        channel_source: channel_result&.source
+      )
+    end
+  end
+end