@desplega.ai/agent-swarm 1.172.0 → 1.173.0

package/dist/{cli-9xsmdpdt.js → cli-tcc4wd5d.js}

@@ -8,6 +8,9 @@ import {
   require_jws,
   require_p_retry
 } from "./cli-yatxqynm.js";
+import {
+  getChannelBlockReason
+} from "./cli-v3zhnxsb.js";
 import {
   exports_supports_color,
   init_supports_color
@@ -70,7 +73,7 @@ import {
   setSlackMessageTracking,
   slackContextKey,
   updateSlackMessageRecord
-} from "./cli-tgpfnm6r.js";
+} from "./cli-fmhj1ehj.js";
 import {
   init_types,
   isTerminalTaskStatus
@@ -78,7 +81,7 @@ import {
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl
-} from "./cli-nyhb1r6x.js";
+} from "./cli-r4fqfpwf.js";
 import {
   getSlackConfiguration,
   init_config
@@ -93,6 +96,10 @@ import {
   object,
   string
 } from "./cli-w5e1d1vv.js";
+import {
+  getNodeEnv,
+  init_node_env
+} from "./cli-p0sg24zp.js";
 import {
   getAppUrl,
   init_constants
@@ -52921,7 +52928,7 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     return;
   initialized = true;
   try {
-    const impl = await import("./otel-impl-6pf5cv86.js");
+    const impl = await import("./otel-impl-e6mnvc4v.js");
     await impl.boot(serviceRole, {
       exportConsoleLogs: serviceRole === "api" && isApiLogExportEnabled()
     });
@@ -52997,8 +53004,9 @@ init_secret_scrubber();
 
 // src/slack/app.ts
 init_db();
+init_node_env();
 init_config();
-var import_bolt2 = __toESM(require_dist7(), 1);
+var import_bolt3 = __toESM(require_dist7(), 1);
 
 // src/slack/connection-state.ts
 var state = "disconnected";
@@ -53066,6 +53074,77 @@ function installSlackEgressScrub() {
   proto[INSTALLED] = true;
 }
 
+// src/slack/external-channel-egress.ts
+var import_bolt2 = __toESM(require_dist7(), 1);
+var GUARDED_METHODS = {
+  "chat.postMessage": ["channel"],
+  "chat.postEphemeral": ["channel"],
+  "chat.update": ["channel"],
+  "chat.scheduleMessage": ["channel"],
+  "chat.meMessage": ["channel"],
+  "chat.startStream": ["channel"],
+  "chat.appendStream": ["channel"],
+  "chat.stopStream": ["channel"],
+  "assistant.threads.setStatus": ["channel_id"],
+  "assistant.threads.setSuggestedPrompts": ["channel_id"],
+  "assistant.threads.setTitle": ["channel_id"],
+  "files.completeUploadExternal": ["channel_id", "channels"]
+};
+var EXTERNAL_CHANNEL_BLOCKED_CODE = "external_channel_blocked";
+var EXTERNAL_CHANNEL_UNVERIFIED_CODE = "external_channel_unverified";
+function targetChannels(fields, args) {
+  if (!args)
+    return [];
+  const out = [];
+  for (const field of fields) {
+    const value = args[field];
+    if (typeof value !== "string")
+      continue;
+    for (const id of value.split(",")) {
+      const trimmed = id.trim();
+      if (trimmed)
+        out.push(trimmed);
+    }
+  }
+  return out;
+}
+function blockedError(method, channelId, reason) {
+  const code = reason === "external" ? EXTERNAL_CHANNEL_BLOCKED_CODE : EXTERNAL_CHANNEL_UNVERIFIED_CODE;
+  const error = new Error(`An API error occurred: ${code} (${method} to ${channelId} refused by SLACK_BLOCK_EXTERNAL_CHANNELS)`);
+  return Object.assign(error, {
+    code: import_bolt2.webApi.ErrorCode.PlatformError,
+    data: { ok: false, error: code }
+  });
+}
+async function assertChannelsAllowed(client, method, channels) {
+  for (const channelId of channels) {
+    const reason = await getChannelBlockReason(client, channelId);
+    if (reason) {
+      console.warn(`[Slack] Refused ${method} to ${channelId} (${reason})`);
+      throw blockedError(method, channelId, reason);
+    }
+  }
+}
+var INSTALLED2 = Symbol.for("agent-swarm.slack-external-channel-guard");
+function installSlackExternalChannelGuard() {
+  const proto = import_bolt2.webApi.WebClient.prototype;
+  if (proto[INSTALLED2])
+    return;
+  const originalApiCall = proto.apiCall;
+  const originalUpload = proto.filesUploadV2;
+  proto.apiCall = async function(method, options) {
+    const fields = GUARDED_METHODS[method];
+    if (fields)
+      await assertChannelsAllowed(this, method, targetChannels(fields, options));
+    return originalApiCall.call(this, method, options);
+  };
+  proto.filesUploadV2 = async function(options) {
+    await assertChannelsAllowed(this, "files.uploadV2", targetChannels(["channel_id", "channels"], options));
+    return originalUpload.call(this, options);
+  };
+  proto[INSTALLED2] = true;
+}
+
 // src/slack/inbound-dispatch.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 init_crypto();
@@ -54575,16 +54654,17 @@ async function initSlackApp() {
     return null;
   }
   installSlackEgressScrub();
+  installSlackExternalChannelGuard();
   const slackApiUrl = process.env.SLACK_API_URL;
   const clientOptions = slackApiUrl ? { slackApiUrl } : undefined;
-  const logLevel = import_bolt2.LogLevel.DEBUG;
-  receiver = new import_bolt2.SocketModeReceiver({
+  const logLevel = getNodeEnv() === "development" ? import_bolt3.LogLevel.DEBUG : import_bolt3.LogLevel.INFO;
+  receiver = new import_bolt3.SocketModeReceiver({
     appToken,
     logLevel,
     installerOptions: clientOptions ? { clientOptions } : {}
   });
   trackConnectionState(receiver);
-  app = new import_bolt2.App({
+  app = new import_bolt3.App({
     token: botToken,
     receiver,
     socketMode: true,
@@ -54593,16 +54673,22 @@ async function initSlackApp() {
   });
   initialized2 = true;
   app.use(slackInboundOutcomeMiddleware());
-  const { registerMessageHandler } = await import("./handlers-s20xr10r.js");
-  const { registerCommandHandler } = await import("./commands-n0hshcvs.js");
-  const { registerActionHandlers } = await import("./actions-pw87a1a8.js");
-  const { registerWorkObjectHandlers } = await import("./work-objects-tb7ycye8.js");
+  const { registerMessageHandler } = await import("./handlers-znb9n7d4.js");
+  const { registerCommandHandler } = await import("./commands-z8fq9qna.js");
+  const { registerActionHandlers } = await import("./actions-sgeyv08k.js");
+  const { registerWorkObjectHandlers } = await import("./work-objects-wpj8ck95.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
   registerWorkObjectHandlers(app);
-  const { createAssistant } = await import("./assistant-emp1e108.js");
+  const { createAssistant } = await import("./assistant-5r8tcvvd.js");
   app.assistant(createAssistant());
+  const { isBlockExternalEnabled, scanExternalChannelsOnBoot } = await import("./external-channel-h1fjecwe.js");
+  if (isBlockExternalEnabled()) {
+    scanExternalChannelsOnBoot(app.client).catch((error) => {
+      console.error("[Slack] External channel boot scan failed:", error);
+    });
+  }
   return app;
 }
 async function startSlackApp() {
@@ -54610,7 +54696,7 @@ async function startSlackApp() {
     await initSlackApp();
   }
   if (app) {
-    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-pd1rg54q.js");
+    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-907cy6sa.js");
     if (isSlackRenderV2Enabled2())
       await ensureSlackRenderV2Activation();
     await app.start();
@@ -54797,7 +54883,7 @@ init_reaction_shortcode();
 init_db();
 init_types();
 init_secret_scrubber();
-var import_bolt3 = __toESM(require_dist7(), 1);
+var import_bolt4 = __toESM(require_dist7(), 1);
 var REFRESH_MS = 30 * 60000;
 var DEFAULT_CALL_TIMEOUT_MS = 8000;
 var TRANSPORT_MARGIN_MS = 500;
@@ -54871,12 +54957,12 @@ function withTimeout(promise, ms) {
 }
 var transports = new WeakMap;
 function statusTransport(client) {
-  if (!(client instanceof import_bolt3.webApi.WebClient))
+  if (!(client instanceof import_bolt4.webApi.WebClient))
     return client;
   let transport = transports.get(client);
   if (!transport) {
     const timeout = Math.max(callTimeoutMs - TRANSPORT_MARGIN_MS, 1);
-    transport = new import_bolt3.webApi.WebClient(client.token ?? process.env.SLACK_BOT_TOKEN, {
+    transport = new import_bolt4.webApi.WebClient(client.token ?? process.env.SLACK_BOT_TOKEN, {
       slackApiUrl: client.slackApiUrl,
       retryConfig: { retries: 0 },
       rejectRateLimitedCalls: true,
@@ -55738,14 +55824,14 @@ async function childOutcomeContent(task, slackReplySent) {
   }
   return withStatusLead(`↳ ✅ ${agentName} — result:`, outcomeText(slackTaskOutput(task), "Task completed."));
 }
-function isSlackContinuation(task) {
-  return task.source === "schedule" && task.taskType === "deferred" && !!task.slackChannelId && !!task.slackThreadTs;
+async function isSlackContinuation(task) {
+  return task.source === "schedule" && task.taskType === "deferred" && !!task.slackChannelId && !!task.slackThreadTs && !!task.agentId && !!(await getAgentById(task.agentId))?.isLead;
 }
 function isChildCardCandidate(task, delegationActivatedAt) {
-  return task.source !== "slack" && !isSlackContinuation(task) && !!task.slackChannelId && !!task.slackThreadTs && (task.status === "completed" || task.status === "failed") && task.taskType !== "follow-up" && task.taskType !== "reroute-decision" && task.createdAt >= delegationActivatedAt;
+  return task.source !== "slack" && !(task.source === "schedule" && task.taskType === "deferred") && !!task.slackChannelId && !!task.slackThreadTs && (task.status === "completed" || task.status === "failed") && task.taskType !== "follow-up" && task.taskType !== "reroute-decision" && task.createdAt >= delegationActivatedAt;
 }
-function taskNeedsDirectOutcome(task, activatedAt) {
-  return (task.source === "slack" && isAskOutcomeStatus(task.status) || isSlackContinuation(task) && isOutcomeStatus(task.status)) && task.createdAt >= activatedAt;
+async function taskNeedsDirectOutcome(task, activatedAt) {
+  return (task.source === "slack" && isAskOutcomeStatus(task.status) || await isSlackContinuation(task) && isOutcomeStatus(task.status)) && task.createdAt >= activatedAt;
 }
 async function conclusionResultsLines(closure) {
   const lines = [];
@@ -56044,24 +56130,26 @@ async function streamOutcomeCard(task, tree, options) {
   });
 }
 async function resolvedDeferralContent(wake) {
-  if (!isDeferredTask(wake)) {
-    const content = await outcomeContent(wake, wake.slackReplySent);
-    const presentation = await outcomePresentation(wake, content);
-    const captions = await outcomeCaptionBlocks(wake, content);
-    return { text: presentation, blocks: [{ type: "markdown", text: presentation }, ...captions] };
-  }
-  const card = await getSlackOutcomeMessage(wake.id);
-  const pointer = card?.permalink ? ` — <${card.permalink}|next update>` : ".";
-  return { text: `↪️ Resumed by ${await agentDisplayNameFor(wake)} and deferred again${pointer}` };
+  const content = await outcomeContent(wake, wake.slackReplySent);
+  const presentation = await outcomePresentation(wake, content);
+  const captions = await outcomeCaptionBlocks(wake, content);
+  return { text: presentation, blocks: [{ type: "markdown", text: presentation }, ...captions] };
 }
 async function isAnsweredByDeferralCard(task, threadTasks) {
-  if (!isSlackContinuation(task) || !task.parentTaskId || isDeferredTask(task))
-    return false;
-  const deferred = threadTasks.find((candidate) => candidate.id === task.parentTaskId);
-  if (!deferred?.deferredAt)
-    return false;
-  const card = await getSlackOutcomeMessage(deferred.id);
-  return !!card?.finalizedAt && !isPendingSlackMessage(card) && !card.deferralAbandonedAt;
+  const seen = new Set;
+  let current = task;
+  while (await isSlackContinuation(current) && current.parentTaskId && !seen.has(current.id)) {
+    seen.add(current.id);
+    const deferred = threadTasks.find((candidate) => candidate.id === current.parentTaskId);
+    if (!deferred?.deferredAt)
+      return false;
+    const card = await getSlackOutcomeMessage(deferred.id);
+    if (card) {
+      return !!card.finalizedAt && !isPendingSlackMessage(card) && !card.deferralAbandonedAt;
+    }
+    current = deferred;
+  }
+  return false;
 }
 var TRANSIENT_SLACK_ERROR_CODES = new Set([
   "ratelimited",
@@ -56069,7 +56157,8 @@ var TRANSIENT_SLACK_ERROR_CODES = new Set([
   "internal_error",
   "service_unavailable",
   "fatal_error",
-  "request_timeout"
+  "request_timeout",
+  "external_channel_unverified"
 ]);
 function slackErrorCode2(error) {
   const code = error?.data?.error;
@@ -56111,9 +56200,14 @@ async function refreshResolvedDeferralCards() {
         ts: card.ts,
         ...content
       });
-      await markSlackDeferralResolved(card.id);
+      if (isDeferredTask(wake)) {
+        await updateSlackMessageRecord(card.id, {});
+      } else {
+        await markSlackDeferralResolved(card.id);
+      }
       deferralRefreshAttempts.delete(card.id);
-      await finalizeTerminalSlackReactions([wake]);
+      if (!isDeferredTask(wake))
+        await finalizeTerminalSlackReactions([wake]);
     } catch (error) {
       const attempts = (deferralRefreshAttempts.get(card.id) ?? 0) + 1;
       deferralRefreshAttempts.set(card.id, attempts);
@@ -56185,7 +56279,7 @@ async function processSlackRenderV2() {
       const card = await getSlackOutcomeMessage(task.id);
       if (card && isSettledSlackMessage(card))
         continue;
-      const isDirectCandidate = taskNeedsDirectOutcome(task, activatedAt) && isOutcomeStatus(task.status) && !await isAnsweredByDeferralCard(task, tasks);
+      const isDirectCandidate = await taskNeedsDirectOutcome(task, activatedAt) && isOutcomeStatus(task.status) && !await isAnsweredByDeferralCard(task, tasks);
       const isChildCandidate = delegationEnabled && delegationActivatedAt !== null && isChildCardCandidate(task, delegationActivatedAt) && !task.slackReplySent;
       if (isDirectCandidate || isChildCandidate) {
         needsOutcome = true;
@@ -56284,7 +56378,7 @@ async function processSlackRenderV2() {
     for (const task of tasks) {
       if (!isSlackRenderV2Enabled())
         return;
-      if (!taskNeedsDirectOutcome(task, activatedAt))
+      if (!await taskNeedsDirectOutcome(task, activatedAt))
         continue;
       const card = await getSlackOutcomeMessage(task.id);
       if (card && isSettledSlackMessage(card))

package/dist/cli-v3zhnxsb.js

@@ -0,0 +1,263 @@
+import {
+  claimKv,
+  deleteKv,
+  init_db1 as init_db,
+  sweepExpiredKv,
+  upsertKv
+} from "./cli-fmhj1ehj.js";
+import {
+  init_env_flag,
+  isEnvFlagEnabled
+} from "./cli-ej6gbxfb.js";
+import {
+  init_secret_scrubber,
+  scrubSecrets
+} from "./cli-d161g69q.js";
+
+// src/slack/external-channel.ts
+init_db();
+init_env_flag();
+init_secret_scrubber();
+
+// src/slack/channel-join.ts
+function slackErrorData(error) {
+  if (!(error instanceof Error))
+    return;
+  return error.data;
+}
+function slackCode(error) {
+  const d = slackErrorData(error);
+  return typeof d?.error === "string" ? d.error : undefined;
+}
+function slackMissingScopeMessage(error) {
+  const data = slackErrorData(error);
+  if (data?.error !== "missing_scope" || typeof data.needed !== "string")
+    return;
+  const needed = data.needed.trim();
+  if (!needed)
+    return;
+  return `Slack requires the \`${needed}\` scope. Add it to slack-manifest.json, apply the updated manifest to the Slack app, then reinstall the app to the workspace for the change to take effect.`;
+}
+async function isKnownExternalChannel(client, channelId) {
+  return await getChannelExternality(client, channelId) === "external";
+}
+async function withAutoJoin(client, channelId, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (slackCode(error) !== "not_in_channel")
+      throw error;
+    if (await isKnownExternalChannel(client, channelId)) {
+      throw new Error(`Cannot auto-join external channel ${channelId} — invite the bot with /invite @<bot-name> first.`);
+    }
+    try {
+      await client.conversations.join({ channel: channelId });
+    } catch (joinError) {
+      if (slackCode(joinError) === "method_not_supported_for_channel_type") {
+        throw new Error(`Cannot access private channel ${channelId} — invite the bot with /invite @<bot-name> first.`);
+      }
+      throw joinError;
+    }
+    return await fn();
+  }
+}
+
+// src/slack/external-channel.ts
+var EXTERNALITY_TTL_MS = 10 * 60 * 1000;
+var EXTERNALITY_CACHE_MAX = 500;
+var ALERT_DEDUPE_MS = 60 * 60 * 1000;
+var ALERT_SENDING_TTL_MS = 2 * 60 * 1000;
+var EXTERNAL_ALERT_KV_NAMESPACE = "slack-external-alert";
+var externalityCache = new Map;
+var channelGeneration = new Map;
+var generationCounter = 0;
+var EXTERNAL_CHANNEL_BLOCKED_REPLY = "This channel is shared with another organization. The swarm does not work here.";
+function externalChannelToolError(channelId, reason = "external") {
+  if (reason === "unverified") {
+    return `Could not verify that channel ${channelId} is internal to this organization. SLACK_BLOCK_EXTERNAL_CHANNELS blocks swarm messages there until Slack confirms it. Try again later.`;
+  }
+  return `Channel ${channelId} is shared with another organization. SLACK_BLOCK_EXTERNAL_CHANNELS blocks swarm messages there.`;
+}
+function isBlockExternalEnabled() {
+  return isEnvFlagEnabled("SLACK_BLOCK_EXTERNAL_CHANNELS", false);
+}
+function resetExternalChannelStateForTesting() {
+  externalityCache.clear();
+  channelGeneration.clear();
+}
+function setBounded(map, key, value) {
+  map.delete(key);
+  if (map.size >= EXTERNALITY_CACHE_MAX) {
+    const oldest = map.keys().next().value;
+    if (oldest !== undefined)
+      map.delete(oldest);
+  }
+  map.set(key, value);
+}
+function bumpGeneration(channelId) {
+  generationCounter += 1;
+  setBounded(channelGeneration, channelId, generationCounter);
+}
+function invalidateChannelExternality(channelId) {
+  externalityCache.delete(channelId);
+  bumpGeneration(channelId);
+}
+function recordExternalChannel(channelId) {
+  bumpGeneration(channelId);
+  setBounded(externalityCache, channelId, {
+    value: "external",
+    expiresAt: Date.now() + EXTERNALITY_TTL_MS
+  });
+}
+async function getChannelExternality(client, channelId) {
+  const cached = externalityCache.get(channelId);
+  if (cached && cached.expiresAt > Date.now())
+    return cached.value;
+  if (cached)
+    externalityCache.delete(channelId);
+  const generation = channelGeneration.get(channelId);
+  let value;
+  try {
+    const resp = await client.conversations.info({ channel: channelId });
+    const ch = resp.channel ?? {};
+    value = ch.is_ext_shared === true || ch.is_pending_ext_shared === true ? "external" : "internal";
+  } catch (error) {
+    console.warn(`[Slack] conversations.info failed for ${channelId}:`, scrubSecrets(error instanceof Error ? error.message : String(error)));
+    return "unknown";
+  }
+  if (channelGeneration.get(channelId) !== generation) {
+    const fresher = externalityCache.get(channelId);
+    if (fresher && fresher.expiresAt > Date.now())
+      return fresher.value;
+    return value === "external" ? "external" : "unknown";
+  }
+  setBounded(externalityCache, channelId, { value, expiresAt: Date.now() + EXTERNALITY_TTL_MS });
+  return value;
+}
+async function getChannelBlockReason(client, channelId, envelopeFlag) {
+  if (!isBlockExternalEnabled())
+    return null;
+  if (envelopeFlag === true) {
+    recordExternalChannel(channelId);
+    return "external";
+  }
+  const externality = await getChannelExternality(client, channelId);
+  if (externality === "external")
+    return "external";
+  if (externality === "unknown") {
+    console.warn(`[Slack] Could not tell if channel ${channelId} is external; blocking (fail closed)`);
+    return "unverified";
+  }
+  return null;
+}
+async function shouldBlockChannel(client, channelId, envelopeFlag) {
+  return await getChannelBlockReason(client, channelId, envelopeFlag) !== null;
+}
+async function postExternalChannelAlert(client, channelId, trigger, leave, scopeHint) {
+  const alertsChannel = process.env.SLACK_ALERTS_CHANNEL?.trim();
+  if (!alertsChannel) {
+    console.warn("[Slack] SLACK_ALERTS_CHANNEL not set; skipping external channel alert");
+    return;
+  }
+  const key = `${channelId}:${trigger}`;
+  if (!await reserveAlert(key))
+    return;
+  const lines = [
+    `:no_entry: Swarm bot in external Slack channel <#${channelId}> (${channelId})`,
+    `Trigger: ${trigger}`,
+    `Leave: ${leave}`,
+    ...scopeHint ? [scopeHint] : [],
+    "Inbound guard: active. The swarm creates no task from this channel."
+  ];
+  try {
+    await client.chat.postMessage({
+      channel: alertsChannel,
+      text: scrubSecrets(lines.join(`
+`)),
+      unfurl_links: false,
+      unfurl_media: false
+    });
+  } catch (error) {
+    console.error("[Slack] Failed to send external channel alert:", scrubSecrets(error instanceof Error ? error.message : String(error)));
+    await settleAlert(key, false);
+    return;
+  }
+  await settleAlert(key, true);
+}
+async function reserveAlert(key) {
+  try {
+    return await claimKv({
+      namespace: EXTERNAL_ALERT_KV_NAMESPACE,
+      key,
+      value: "sending",
+      valueType: "string",
+      expiresAt: Date.now() + ALERT_SENDING_TTL_MS
+    });
+  } catch (error) {
+    console.warn("[Slack] External channel alert dedupe unavailable:", error);
+    return true;
+  }
+}
+async function settleAlert(key, sent) {
+  try {
+    if (sent) {
+      await upsertKv({
+        namespace: EXTERNAL_ALERT_KV_NAMESPACE,
+        key,
+        value: "sent",
+        valueType: "string",
+        expiresAt: Date.now() + ALERT_DEDUPE_MS
+      });
+    } else {
+      await deleteKv(EXTERNAL_ALERT_KV_NAMESPACE, key);
+    }
+  } catch (error) {
+    console.warn("[Slack] Failed to record external channel alert state:", error);
+  }
+}
+async function leaveExternalChannel(client, channelId, reason) {
+  let leave;
+  let scopeHint;
+  try {
+    await client.conversations.leave({ channel: channelId });
+    leave = "left";
+  } catch (error) {
+    const code = slackCode(error);
+    const notInChannel = code === "not_in_channel" || error?.data?.not_in_channel === true;
+    if (notInChannel) {
+      leave = "left";
+    } else {
+      leave = `failed (${code ?? "unknown_error"})`;
+      if (code === "missing_scope")
+        scopeHint = slackMissingScopeMessage(error);
+      console.error(`[Slack] Failed to leave external channel ${channelId}: ${leave}`);
+    }
+  }
+  if (leave === "left")
+    console.log(`[Slack] Left external channel ${channelId} (${reason})`);
+  await postExternalChannelAlert(client, channelId, reason, leave, scopeHint);
+}
+async function scanExternalChannelsOnBoot(client) {
+  if (!isBlockExternalEnabled())
+    return;
+  await sweepExpiredKv(EXTERNAL_ALERT_KV_NAMESPACE).catch((error) => {
+    console.warn("[Slack] Failed to sweep expired external channel alert keys:", error);
+  });
+  let cursor;
+  do {
+    const resp = await client.users.conversations({
+      types: "public_channel,private_channel",
+      exclude_archived: true,
+      limit: 200,
+      cursor
+    });
+    for (const ch of resp.channels ?? []) {
+      if (!ch.id || !(ch.is_ext_shared === true || ch.is_pending_ext_shared === true))
+        continue;
+      await postExternalChannelAlert(client, ch.id, "boot-scan", "not attempted (report only)");
+    }
+    cursor = resp.response_metadata?.next_cursor || undefined;
+  } while (cursor);
+}
+
+export { slackCode, slackMissingScopeMessage, withAutoJoin, EXTERNAL_ALERT_KV_NAMESPACE, EXTERNAL_CHANNEL_BLOCKED_REPLY, externalChannelToolError, isBlockExternalEnabled, resetExternalChannelStateForTesting, invalidateChannelExternality, recordExternalChannel, getChannelExternality, getChannelBlockReason, shouldBlockChannel, leaveExternalChannel, scanExternalChannelsOnBoot };

package/dist/{cli-388egyf6.js → cli-w1apjecb.js}

@@ -9,7 +9,7 @@ import {
   markAuthorizationRefreshFailed,
   releaseOAuthRefreshLock,
   updateAuthorizationTokens
-} from "./cli-tgpfnm6r.js";
+} from "./cli-fmhj1ehj.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,

package/dist/{cli-g6t9texm.js → cli-wrh08zjd.js}

@@ -1,13 +1,13 @@
 import {
   materializeClaudeMd,
   stopClaudeMd
-} from "./cli-pj6x9qce.js";
+} from "./cli-0kxf81jj.js";
 import {
   guardGhPrBody
 } from "./cli-v6vv7dy8.js";
 import {
   summarizeSession
-} from "./cli-cf69s3ew.js";
+} from "./cli-nwrdx840.js";
 import {
   checkToolLoop,
   clearToolHistory
@@ -26,11 +26,11 @@ import {
   init_profile_sync,
   readIdentityBaselines,
   warnProfileFileTooLarge
-} from "./cli-nyhb1r6x.js";
+} from "./cli-r4fqfpwf.js";
 import {
   init_package,
   package_default
-} from "./cli-esnpehf5.js";
+} from "./cli-5er5gjbm.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getMcpBaseUrl,

package/dist/{cli-8vs9trd4.js → cli-x119kdba.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-esnpehf5.js";
+} from "./cli-5er5gjbm.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-nv4zd0b9.js → cli-xc7p7s3g.js}

@@ -2,7 +2,7 @@ import {
   ACPAdapter,
   grokTargetProfile,
   isGrokOpenRouterModel
-} from "./cli-c2pq2rjb.js";
+} from "./cli-bv2etw2y.js";
 import {
   getOpenRouterAttributionHeaders,
   getOpenRouterBaseUrl,