@moxxy/plugin-channel-slack 0.27.0

package/src/channel.ts

@@ -0,0 +1,378 @@
+import { newTurnId } from '@moxxy/core';
+import { TofuPairingWindow, TurnCoordinator } from '@moxxy/channel-kit';
+import { proxyTunnel } from '@moxxy/plugin-tunnel-proxy';
+import type { ClientSession as Session } from '@moxxy/sdk';
+import type {
+  Channel,
+  ChannelHandle,
+  ChannelStartOptsBase,
+  MoxxyEvent,
+  PermissionResolver,
+  TunnelHandle,
+  TunnelProviderDef,
+} from '@moxxy/sdk';
+import type { VaultStore } from '@moxxy/plugin-vault';
+import {
+  SLACK_AUTHORIZED_KEY,
+  authorizationMatches,
+  parseAuthorization,
+  resolveBotToken,
+  resolveSigningSecret,
+  type SlackAuthorization,
+} from './keys.js';
+import { buildSlackPermissionResolver } from './permission.js';
+import { SlackClient } from './channel/slack-client.js';
+import { runSlackTurn } from './channel/turn-runner.js';
+import {
+  IngestServer,
+  SLACK_EVENTS_PATH,
+  type DispatchContext,
+} from './server/ingest-server.js';
+import type { SlackEventCallback } from './server/schema.js';
+
+/** Routing label the proxy relay exposes this channel under. */
+const TUNNEL_LABEL = 'slack';
+
+export interface SlackChannelLogger {
+  debug?(msg: string, meta?: Record<string, unknown>): void;
+  info?(msg: string, meta?: Record<string, unknown>): void;
+  warn?(msg: string, meta?: Record<string, unknown>): void;
+  error?(msg: string, meta?: Record<string, unknown>): void;
+}
+
+export interface SlackChannelOptions {
+  readonly vault: VaultStore;
+  /**
+   * Tunnel provider used to expose the local ingest server publicly. Defaults to
+   * the self-hosted `proxyTunnel` (imported directly, like the webhooks tunnel);
+   * tests pass a fake provider so they never hit the network.
+   */
+  readonly tunnelProvider?: TunnelProviderDef;
+  /** Tools the model may call autonomously. `['*']` allows every registered tool. */
+  readonly allowedTools?: ReadonlyArray<string>;
+  /** Debounce window for streaming `chat.update` edits (ms). Default 1000. */
+  readonly editFrameMs?: number;
+  /** Bind host for the local ingest server. Default 127.0.0.1. */
+  readonly host?: string;
+  readonly logger?: SlackChannelLogger;
+  /** Injectable Slack client factory (tests). */
+  readonly makeClient?: (token: string) => SlackClient;
+}
+
+export interface SlackStartOpts extends ChannelStartOptsBase {
+  readonly session: Session;
+  /**
+   * If true, arm a TOFU pairing window: the first verified inbound event from a
+   * team/channel is captured and (via `onPairConfirm`) persisted to the vault.
+   */
+  readonly pair?: boolean;
+  /** Override allowedTools at start (the CLI forwards channel config / flags). */
+  readonly allowedTools?: ReadonlyArray<string>;
+}
+
+/** Fires when a verified event lands during a pairing window. */
+export interface PairCandidate {
+  readonly teamId: string;
+  readonly channelId: string;
+}
+
+export class SlackChannel implements Channel<SlackStartOpts> {
+  readonly name = 'slack';
+  /**
+   * Installed on the session by the CLI dispatcher. Replaced in `start()` once
+   * we can expand a `['*']` allow-list against the live tool registry; until
+   * then it denies everything (safe default before start).
+   */
+  permissionResolver: PermissionResolver;
+
+  private readonly opts: SlackChannelOptions;
+  private session: Session | null = null;
+  private client: SlackClient | null = null;
+  private ingest: IngestServer | null = null;
+  private tunnel: TunnelHandle | null = null;
+  private handle: ChannelHandle | null = null;
+  private resolveRunning: (() => void) | null = null;
+
+  private botUserId = '';
+  private authorization: SlackAuthorization | null = null;
+  private model: string | undefined;
+
+  // Single-flight turn state (v1: one turn at a time across all threads): the
+  // `busy` guard, the per-turn AbortController, and the bounded own-turn-id set
+  // mirrorForeignTurn filters on (#8).
+  private readonly turns = new TurnCoordinator();
+  // Per-turn target so foreign-turn mirroring + permission prompts know the thread.
+  private currentChannelId: string | null = null;
+  private currentThreadTs: string | null = null;
+  private lastChannelId: string | null = null;
+  private lastThreadTs: string | null = null;
+  private logUnsub: (() => void) | null = null;
+
+  // Pairing (TOFU) window: armed by `start({ pair: true })`, captures the first
+  // verified team/channel for the pair flow to confirm.
+  private readonly tofu: TofuPairingWindow<PairCandidate>;
+  private publicUrl: string | null = null;
+
+  constructor(opts: SlackChannelOptions) {
+    this.opts = opts;
+    this.tofu = new TofuPairingWindow<PairCandidate>({
+      onListenerError: (err) =>
+        this.opts.logger?.warn?.('slack: pair listener threw', { err: String(err) }),
+    });
+    // Pre-start: deny-all. Replaced with the real allow-list resolver in start()
+    // once the tool registry is available (for `['*']` expansion).
+    this.permissionResolver = buildSlackPermissionResolver({
+      allowedTools: [],
+      allToolNames: [],
+      ...(opts.logger ? { logger: opts.logger } : {}),
+    });
+  }
+
+  /** The public Request URL to paste into Slack's Event Subscriptions. */
+  get requestUrl(): string | null {
+    return this.publicUrl;
+  }
+
+  /** Subscribe to pairing candidates (the setup/pair flows use this). */
+  onPairCandidate(listener: (c: PairCandidate) => void): () => void {
+    return this.tofu.onCandidate(listener);
+  }
+
+  /** Persist a team/channel as authorized (called by the pair flow on confirm). */
+  async confirmPairing(candidate: PairCandidate): Promise<void> {
+    const auth: SlackAuthorization = {
+      teamId: candidate.teamId,
+      channelId: candidate.channelId,
+    };
+    await this.opts.vault.set(SLACK_AUTHORIZED_KEY, JSON.stringify(auth), ['slack']);
+    this.authorization = auth;
+    this.tofu.disarm();
+  }
+
+  async start(startOpts: SlackStartOpts): Promise<ChannelHandle> {
+    if (this.handle) return this.handle;
+    this.session = startOpts.session;
+    this.model = startOpts.model;
+    if (startOpts.pair === true) this.tofu.arm();
+
+    const token = await resolveBotToken(this.opts.vault);
+    if (!token) {
+      throw new Error(
+        'Slack bot token not found. Run `moxxy channels slack setup`, set MOXXY_SLACK_BOT_TOKEN, ' +
+          'or store one in the vault under slack_bot_token.',
+      );
+    }
+    const signingSecret = await resolveSigningSecret(this.opts.vault);
+    if (!signingSecret) {
+      throw new Error(
+        'Slack signing secret not found. Run `moxxy channels slack setup`, set ' +
+          'MOXXY_SLACK_SIGNING_SECRET, or store one in the vault under slack_signing_secret.',
+      );
+    }
+
+    // Load any persisted pairing.
+    this.authorization = parseAuthorization(await this.opts.vault.get(SLACK_AUTHORIZED_KEY));
+    if (!this.tofu.isArmed && !this.authorization) {
+      throw new Error(
+        'No Slack team/channel is paired yet. Run `moxxy channels slack pair` first.',
+      );
+    }
+
+    // Validate the token + capture the bot's own user id (for self-message drops).
+    this.client = this.opts.makeClient
+      ? this.opts.makeClient(token)
+      : new SlackClient({ token });
+    const auth = await this.client.authTest();
+    this.botUserId = auth.botUserId;
+    this.opts.logger?.info?.('slack: authenticated', {
+      botUserId: this.botUserId,
+      team: auth.team,
+    });
+
+    // Build the real allow-list resolver now that the tool registry is live, so
+    // `['*']` can expand to every registered tool name (mirror prompt.ts).
+    const allowedTools = startOpts.allowedTools ?? this.opts.allowedTools ?? [];
+    const allToolNames = this.session.tools.list().map((t) => t.name);
+    this.permissionResolver = buildSlackPermissionResolver({
+      allowedTools,
+      allToolNames,
+      ...(this.opts.logger ? { logger: this.opts.logger } : {}),
+    });
+    // Swap the (now-final) resolver in — start() was called AFTER the CLI
+    // installed the pre-start one, so re-install via the documented seam.
+    this.session.setPermissionResolver(this.permissionResolver);
+
+    // Mirror-to-thread: post the assistant's prose for a turn this channel did
+    // NOT initiate (e.g. a co-attached surface ran one) into the last thread we
+    // served. Our OWN turns stream via the frame pump (filtered by turnId).
+    this.logUnsub = this.session.log.subscribe((event) => this.mirrorForeignTurn(event));
+
+    // Stand up the local ingest server, then expose it via the proxy tunnel.
+    this.ingest = new IngestServer({
+      ...(this.opts.host ? { host: this.opts.host } : {}),
+      signingSecret,
+      ...(this.opts.logger ? { logger: this.opts.logger } : {}),
+      hooks: {
+        botUserId: this.botUserId,
+        isAuthorized: (teamId, channel) =>
+          authorizationMatches(this.authorization, teamId, channel),
+        onVerifiedEvent: (ev) => this.handlePairingCandidate(ev),
+        dispatch: (ctx) => this.dispatchTurn(ctx),
+      },
+    });
+    const bound = await this.ingest.start();
+
+    await this.openTunnel(bound.host, bound.port);
+
+    const running = new Promise<void>((resolve) => {
+      this.resolveRunning = resolve;
+    });
+
+    this.handle = {
+      running,
+      stop: async (reason = 'shutdown') => {
+        // Abort the in-flight turn FIRST so the model loop stops the moment the
+        // operator asks to shut down (shared/remote Session: spend continues
+        // otherwise and only its output is discarded).
+        this.turns.abort(reason);
+        this.logUnsub?.();
+        this.logUnsub = null;
+        if (this.tunnel) {
+          try { await this.tunnel.close(); } catch { /* ignore */ }
+          this.tunnel = null;
+        }
+        if (this.ingest) {
+          await this.ingest.stop();
+          this.ingest = null;
+        }
+        this.publicUrl = null;
+        this.resolveRunning?.();
+        this.resolveRunning = null;
+      },
+    };
+    this.opts.logger?.info?.('slack: channel started', {
+      requestUrl: this.publicUrl,
+      paired: this.authorization != null,
+      pairing: this.tofu.isArmed,
+    });
+    return this.handle;
+  }
+
+  private async openTunnel(host: string, port: number): Promise<void> {
+    // Default to the self-hosted proxy relay (imported directly, like the
+    // webhooks tunnel); tests inject a fake provider.
+    const provider = this.opts.tunnelProvider ?? proxyTunnel;
+    if (provider.name === 'localhost') {
+      // A no-op provider can't reach a loopback port from Slack. Surface the
+      // local URL so a manual reverse proxy can still be wired.
+      this.publicUrl = `http://${host}:${port}${SLACK_EVENTS_PATH}`;
+      this.opts.logger?.warn?.(
+        'slack: localhost tunnel provider — Slack cannot reach a loopback port',
+        { localUrl: this.publicUrl },
+      );
+      return;
+    }
+    try {
+      this.tunnel = await provider.open({ port, host, label: TUNNEL_LABEL });
+      this.publicUrl = `${this.tunnel.url.replace(/\/+$/, '')}${SLACK_EVENTS_PATH}`;
+      this.opts.logger?.info?.('slack: tunnel open', {
+        provider: provider.name,
+        requestUrl: this.publicUrl,
+      });
+    } catch (err) {
+      this.publicUrl = `http://${host}:${port}${SLACK_EVENTS_PATH}`;
+      this.opts.logger?.warn?.('slack: tunnel failed; using local URL', {
+        provider: provider.name,
+        err: String(err),
+      });
+    }
+  }
+
+  /**
+   * TOFU pairing hook: while a pairing window is armed, the first verified event
+   * captures the team/channel and notifies listeners. It's "consumed" (no turn)
+   * so the very first message just establishes trust. Returns true when consumed.
+   */
+  private handlePairingCandidate(ev: SlackEventCallback): boolean {
+    if (!this.tofu.isArmed) return false;
+    const teamId = ev.team_id;
+    const channelId = ev.event.channel;
+    if (!teamId || !channelId) return false;
+    return this.tofu.offer({ teamId, channelId });
+  }
+
+  /**
+   * Fire-and-forget a turn for an authorized event. Single-flight (v1): if a
+   * turn is already running we drop the new event with a thread reply rather
+   * than corrupting the per-turn state. The ingest handler has already ACKed.
+   */
+  private dispatchTurn(ctx: DispatchContext): void {
+    void this.runTurn(ctx).catch((err) => {
+      this.opts.logger?.warn?.('slack: turn dispatch failed', { err: String(err) });
+    });
+  }
+
+  private async runTurn(ctx: DispatchContext): Promise<void> {
+    if (!this.session || !this.client) return;
+    // The turnId is minted here so the coordinator records it as an own-turn id
+    // — that's what mirrorForeignTurn filters on (#8).
+    const lease = this.turns.begin(newTurnId());
+    if (!lease) {
+      // Politely decline; v1 has no per-thread concurrency (see TECH_DEBT).
+      try {
+        await this.client.postMessage({
+          channel: ctx.channel,
+          threadTs: ctx.threadTs,
+          text: 'I am still working on a previous request. One moment…',
+        });
+      } catch { /* ignore */ }
+      return;
+    }
+    this.currentChannelId = ctx.channel;
+    this.currentThreadTs = ctx.threadTs;
+    this.lastChannelId = ctx.channel;
+    this.lastThreadTs = ctx.threadTs;
+
+    try {
+      await runSlackTurn(
+        {
+          session: this.session,
+          client: this.client,
+          editFrameMs: this.opts.editFrameMs ?? 1000,
+          ...(this.opts.logger ? { logger: this.opts.logger } : {}),
+        },
+        {
+          channel: ctx.channel,
+          threadTs: ctx.threadTs,
+          text: ctx.text,
+          ...(this.model ? { model: this.model } : {}),
+          controller: lease.controller,
+          turnId: lease.turnId,
+        },
+      );
+    } finally {
+      lease.end();
+      this.currentChannelId = null;
+      this.currentThreadTs = null;
+    }
+  }
+
+  /**
+   * Post the assistant's prose for a turn this channel did not initiate. Gated by
+   * `!busy` (our own turns stream via the frame pump) and by having served a
+   * thread at least once. Skipped for our own turnIds (robust to async ordering /
+   * replay, invariant #8).
+   */
+  private mirrorForeignTurn(event: MoxxyEvent): void {
+    // Skipped for our own turnIds (robust to async ordering / replay, #8) and
+    // while a turn of ours is streaming via the frame pump.
+    const text = this.turns.mirrorText(event);
+    if (text == null) return;
+    if (!this.client || this.lastChannelId == null || this.lastThreadTs == null) return;
+    void this.client
+      .postMessage({ channel: this.lastChannelId, threadTs: this.lastThreadTs, text })
+      .catch((err) => {
+        this.opts.logger?.warn?.('slack: mirror failed', { err: String(err) });
+      });
+  }
+}

package/src/index.ts

@@ -0,0 +1,254 @@
+import {
+  defineChannel,
+  definePlugin,
+  type LifecycleHooks,
+  type Plugin,
+} from '@moxxy/sdk';
+import type { VaultStore } from '@moxxy/plugin-vault';
+import { SlackChannel, type SlackChannelOptions } from './channel.js';
+import {
+  SLACK_AUTHORIZED_KEY,
+  SLACK_BOT_TOKEN_ENV,
+  SLACK_BOT_TOKEN_KEY,
+  SLACK_SIGNING_SECRET_ENV,
+  SLACK_SIGNING_SECRET_KEY,
+  parseAuthorization,
+  resolveBotToken,
+  resolveSigningSecret,
+} from './keys.js';
+import { runSlackWizard } from './setup-wizard.js';
+import { runSlackPairFlow } from './pair-flow.js';
+
+export {
+  SlackChannel,
+  type SlackChannelOptions,
+  type SlackStartOpts,
+  type PairCandidate,
+} from './channel.js';
+export { buildSlackPermissionResolver } from './permission.js';
+export { SlackClient } from './channel/slack-client.js';
+export { verifySlackSignature, SLACK_REPLAY_WINDOW_SEC } from './server/verify.js';
+export { slackEnvelopeSchema, eventCallbackSchema, urlVerificationSchema } from './server/schema.js';
+export { DeliveryDedupeCache } from './server/dedupe.js';
+export { IngestServer, SLACK_EVENTS_PATH } from './server/ingest-server.js';
+export {
+  SLACK_BOT_TOKEN_KEY,
+  SLACK_SIGNING_SECRET_KEY,
+  SLACK_AUTHORIZED_KEY,
+  SLACK_BOT_TOKEN_ENV,
+  SLACK_SIGNING_SECRET_ENV,
+  resolveBotToken,
+  resolveSigningSecret,
+  parseAuthorization,
+  authorizationMatches,
+  type SlackAuthorization,
+} from './keys.js';
+
+export interface BuildSlackPluginOptions {
+  /** Host-injected encrypted secret store (available immediately). */
+  readonly vault: VaultStore;
+}
+
+/**
+ * Build the Slack channel plugin. The CLI passes the concrete vault (mirroring
+ * the Telegram plugin's vault injection). The channel exposes its own ingest
+ * server publicly via the self-hosted `proxyTunnel` (imported directly, like
+ * the webhooks tunnel).
+ */
+export function buildSlackPlugin(opts: BuildSlackPluginOptions): Plugin {
+  return makeSlackPlugin(() => opts.vault);
+}
+
+/**
+ * Discovery-loadable default export: resolves the vault from the inter-plugin
+ * service registry in `onInit` (the vault plugin publishes `'vault'`). Requires
+ * `@moxxy/plugin-vault` to load first (declared in `package.json`
+ * `moxxy.requirements`). The channel + subcommands read the vault via
+ * `getVault()`, so resolution is deferred to call time — after `onInit` wired it.
+ */
+export const slackPlugin: Plugin = (() => {
+  let resolved: VaultStore | null = null;
+  const getVault = (): VaultStore => {
+    if (!resolved) {
+      throw new Error(
+        '@moxxy/plugin-channel-slack: the "vault" service is unavailable — @moxxy/plugin-vault must load first',
+      );
+    }
+    return resolved;
+  };
+  const hooks: LifecycleHooks = {
+    onInit: (ctx) => {
+      resolved = ctx.services.require<VaultStore>('vault');
+    },
+  };
+  return makeSlackPlugin(getVault, hooks);
+})();
+
+export default slackPlugin;
+
+function readAllowedTools(options: Record<string, unknown> | undefined): string[] | undefined {
+  const raw = options?.['allowedTools'];
+  if (Array.isArray(raw)) return raw.map((x) => String(x));
+  return undefined;
+}
+
+function makeSlackPlugin(getVault: () => VaultStore, hooks?: LifecycleHooks): Plugin {
+  return definePlugin({
+    name: '@moxxy/plugin-channel-slack',
+    version: '0.0.0',
+    ...(hooks ? { hooks } : {}),
+    // NB: we do NOT register a tunnelProvider here. The channel opens its ingest
+    // tunnel by importing `proxyTunnel` directly (see ingest-server), exactly like
+    // the webhooks plugin. Registering it would throw "already registered" when the
+    // web channel (which does register `proxyTunnel`) is also loaded, silently
+    // dropping this whole plugin — the tunnel-providers registry rejects duplicates.
+    channels: [
+      defineChannel({
+        name: 'slack',
+        description:
+          'Slack bot channel: ingests the Events API over the proxy relay and streams threaded replies. Autonomous allow-list permissions (no human in the loop).',
+        // Runs on its own dedicated, isolated runner (separate socket + sticky
+        // session) so the bot operates independently of the user's desktop/TUI.
+        // The CLI reads these generically — no per-channel name list.
+        dedicatedRunner: true,
+        sessionSource: 'slack',
+        // Self-described config so a control surface (TUI `/channels`, `moxxy
+        // channels start`) can configure + run Slack without a hardcoded table.
+        // The vault keys named here are the ones the channel reads at boot.
+        config: {
+          fields: [
+            {
+              name: 'botToken',
+              label: 'Bot token',
+              vaultKey: SLACK_BOT_TOKEN_KEY,
+              required: true,
+              secret: true,
+              placeholder: 'xoxb-…',
+              help: 'Slack app → OAuth & Permissions → Bot User OAuth Token',
+            },
+            {
+              name: 'signingSecret',
+              label: 'Signing secret',
+              vaultKey: SLACK_SIGNING_SECRET_KEY,
+              required: true,
+              secret: true,
+              help: 'Slack app → Basic Information → App Credentials → Signing Secret',
+            },
+          ],
+          hasRequestUrl: true,
+          runHint:
+            'Paste the Request URL into your Slack app → Event Subscriptions, subscribe to the app_mention bot event, then mention the bot in a channel to pair.',
+          connect: {
+            kind: 'url',
+            title: 'Request URL',
+            hint: 'Paste this into your Slack app → Event Subscriptions, subscribe to the app_mention bot event, then mention the bot in a channel to pair.',
+          },
+        },
+        create: (deps) => {
+          const options = deps.options;
+          const allowedTools = readAllowedTools(options);
+          const editFrameMs = options?.['editFrameMs'];
+          const host = options?.['host'];
+          const channelOpts: SlackChannelOptions = {
+            vault: getVault(),
+            ...(allowedTools ? { allowedTools } : {}),
+            ...(typeof editFrameMs === 'number' ? { editFrameMs } : {}),
+            ...(typeof host === 'string' ? { host } : {}),
+            logger: deps.logger as never,
+          };
+          return new SlackChannel(channelOpts);
+        },
+        isAvailable: async () => {
+          // Env-first: a fully env-configured bot is available even in a probe
+          // context (e.g. the `moxxy channels` listing) where onInit has not yet
+          // wired the vault service, so `getVault()` would throw.
+          let hasToken = (process.env[SLACK_BOT_TOKEN_ENV]?.trim() ?? '') !== '';
+          let hasSecret = (process.env[SLACK_SIGNING_SECRET_ENV]?.trim() ?? '') !== '';
+          if (hasToken && hasSecret) return { ok: true };
+          try {
+            const vault = getVault();
+            if (!hasToken) hasToken = (await resolveBotToken(vault)) != null;
+            if (!hasSecret) hasSecret = (await resolveSigningSecret(vault)) != null;
+          } catch {
+            // Vault unavailable in a probe/listing context — fall through to the
+            // "missing secrets" message below (env was already checked above).
+          }
+          if (hasToken && hasSecret) return { ok: true };
+          const missing: string[] = [];
+          if (!hasToken) missing.push('bot token (slack_bot_token / MOXXY_SLACK_BOT_TOKEN)');
+          if (!hasSecret) missing.push('signing secret (slack_signing_secret / MOXXY_SLACK_SIGNING_SECRET)');
+          return {
+            ok: false,
+            reason: `Missing ${missing.join(' and ')}. Run \`moxxy channels slack setup\`.`,
+          };
+        },
+        interactiveCommand: 'setup',
+        subcommands: {
+          setup: {
+            description:
+              'Interactive setup: store the bot token + signing secret, validate via auth.test, pick the allow-list, open the tunnel, and print the Slack Request URL. Shown by default for `moxxy slack` on a TTY.',
+            run: async (ctx) => {
+              if (process.stdin.isTTY !== true) {
+                // Headless: just start the channel (secrets must already be set).
+                return ctx.startChannel();
+              }
+              return runSlackWizard(ctx);
+            },
+          },
+          pair: {
+            description:
+              'TOFU pairing: arm a window, then authorize the first team/channel that @mentions the bot.',
+            run: async (ctx) => {
+              if (process.stdin.isTTY !== true) {
+                process.stderr.write(
+                  'Pairing needs a TTY (you confirm the team/channel). Run `moxxy slack pair` interactively.\n',
+                );
+                return 1;
+              }
+              return runSlackPairFlow(ctx);
+            },
+          },
+          status: {
+            description: 'Report token/secret/authorization state as JSON.',
+            run: async (ctx) => {
+              const vault = ctx.deps.vault as VaultStore | undefined;
+              if (!vault) {
+                process.stderr.write('vault unavailable\n');
+                return 1;
+              }
+              const botTokenConfigured = (await resolveBotToken(vault)) != null;
+              const signingSecretConfigured = (await resolveSigningSecret(vault)) != null;
+              const authorized = parseAuthorization(await vault.get(SLACK_AUTHORIZED_KEY));
+              process.stdout.write(
+                JSON.stringify(
+                  {
+                    botTokenConfigured,
+                    signingSecretConfigured,
+                    authorized,
+                    tunnelUrl: null,
+                  },
+                  null,
+                  2,
+                ) + '\n',
+              );
+              return 0;
+            },
+          },
+          unpair: {
+            description: 'Forget the authorized Slack team/channel.',
+            run: async (ctx) => {
+              const vault = ctx.deps.vault as VaultStore | undefined;
+              if (!vault) {
+                process.stderr.write('vault unavailable\n');
+                return 1;
+              }
+              const removed = await vault.delete(SLACK_AUTHORIZED_KEY);
+              process.stdout.write(removed ? 'unpaired\n' : 'no pairing was active\n');
+              return 0;
+            },
+          },
+        },
+      }),
+    ],
+  });
+}