@openclaw/slack 2026.10.10-beta.5 → 2026.11.5-beta.1

package/dist/.setup/{channel-6YzXl_63.mjs → channel-CAvo_WNZ.mjs}

@@ -1,21 +1,23 @@
-import { r as isSlackPluginAccountConfigured } from "./account-configured-zcR9TJJN.mjs";
-import { c as resolveSlackAccountAllowFrom, d as resolveSlackOperationToken, f as resolveSlackReplyToMode, i as listSlackAccountIds, n as hasImplicitDefaultSlackAccount, o as resolveDefaultSlackAccountId, s as resolveSlackAccount } from "./accounts-msihSF3-.mjs";
-import { a as parseSlackTarget, i as normalizeSlackMessagingTarget, n as formatSlackTarget, o as resolveSlackChannelId, r as looksLikeSlackTargetId, t as canonicalizeSlackApiTargetId } from "./target-parsing-FFE26kOV.mjs";
-import { t as slackContextTargetsMatch } from "./targets-C6LZQL1Q.mjs";
-import { At as resolveSlackApprovalTeamId, Bt as resolvePluginApprovalSlackApprovers, Ct as resolveSlackFallbackOriginTarget, Dt as slackTargetsMatch, Et as shouldHandleSlackPluginViaForwardingSession, Ft as isSlackExecApprovalAuthorizedSender, Ht as resolveSlackAutoThreadId, It as isSlackExecApprovalClientEnabled, M as SLACK_TEXT_LIMIT, Mt as isSlackWorkspaceInstallation, N as countSlackTextUtf8Bytes, Ot as getSlackApprovalApproversForTeam, Pt as getSlackExecApprovalApprovers, Q as normalizeSlackOutboundText, Rt as resolveSlackExecApprovalTarget, St as resolveSlackApproverDmTargets, Tt as shouldHandleSlackNativeApprovalRequest, _t as isSlackAnyNativeApprovalClientEnabled, a as resolveSlackGroupRequireMention, bt as normalizeSlackOriginTarget, c as qualifySlackConversationId, d as normalizeSlackRouteBindingConfig, f as resolveSlackConversationBindingRoute, ft as SLACK_PRESENTATION_CAPABILITIES, jt as getSlackInstallationKind, k as SLACK_EDIT_TEXT_MAX_BYTES, kt as isSlackPluginApprovalAuthorizedSender, l as qualifySlackRoutePeerId, m as assertSlackDetachedTargetAllowed, n as setSlackSessionStatus, o as resolveSlackGroupToolPolicy, ot as renderSlackMessagePresentationFallbackText, vt as isSlackPluginApprovalRequest, wt as resolveTurnSourceSlackOriginTarget, xt as resolveSessionSlackOriginTarget, yt as normalizeSlackForwardTarget, zt as shouldSuppressLocalSlackExecApprovalPrompt } from "./session-status-Dv8wNBEt.mjs";
-import { _ as getSlackWriteClient, c as collectSlackCursorPages, o as formatSlackError, u as createSlackLookupClient } from "./probe-IiHogLQN.mjs";
-import { c as resolveSlackReplyDeliveryMessages, o as resolveSlackReplyBlockResolution, p as buildSlackPresentationBlocksIfComplete, r as normalizeSlackReplyPayload, s as resolveSlackReplyBlocks } from "./reply-blocks-Ca-raz2z.mjs";
-import { n as resolveSlackReplyThreadTs, r as resolveSlackThreadTsValue, t as normalizeSlackThreadTsCandidate } from "./thread-ts-Cvt7WD6B.mjs";
-import { n as extractSlackToolSend, t as describeSlackMessageTool } from "./message-tool-api-BS5ekEA_.mjs";
-import { n as resolveSlackChannelType, r as resolveSlackConversationInfo } from "./channel-type-BEFP2ORi.mjs";
-import { t as getOptionalSlackRuntime } from "./runtime-JSVZSWAj.mjs";
-import { n as slackPluginBase, r as slackSecurityAdapter, t as slackConfigAdapter } from "./shared-DpHCoKy2.mjs";
-import { i as SLACK_CHANNEL } from "./channel.setup-u6QQdbTa.mjs";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/account-resolution";
+import { r as isSlackPluginAccountConfigured } from "./account-configured-35y0-Hso.mjs";
+import { a as mergeSlackAccountConfig, c as resolveSlackAccountAllowFrom, d as resolveSlackMarkdownOptions, f as resolveSlackOperationToken, i as listSlackAccountIds, l as resolveSlackAccountDmPolicy, n as hasImplicitDefaultSlackAccount, o as resolveDefaultSlackAccountId, p as resolveSlackReplyToMode, s as resolveSlackAccount } from "./accounts-EaPP0fFY.mjs";
+import { t as inspectSlackAccount } from "./account-inspect-DgQgj0wk.mjs";
+import { a as parseSlackTarget, i as normalizeSlackMessagingTarget, n as formatSlackTarget, o as resolveSlackChannelId, r as looksLikeSlackTargetId, t as canonicalizeSlackApiTargetId } from "./target-parsing-DwYAP3ts.mjs";
+import { t as slackContextTargetsMatch } from "./targets-eeOxA_b_.mjs";
+import { $t as resolveSlackExecApprovalTarget, At as resolveSessionSlackOriginTarget, Dt as isSlackPluginApprovalRequest, Et as isSlackAnyNativeApprovalClientEnabled, Ft as shouldHandleSlackPluginViaForwardingSession, It as slackTargetsMatch, Kt as getSlackInstallationKind, Lt as getSlackApprovalApproversForTeam, Mt as resolveSlackFallbackOriginTarget, Nt as resolveTurnSourceSlackOriginTarget, Ot as normalizeSlackForwardTarget, P as countSlackTextUtf8Bytes, Pt as shouldHandleSlackNativeApprovalRequest, Rt as isSlackPluginApprovalAuthorizedSender, S as assertSlackDetachedTargetAllowed, Xt as isSlackExecApprovalAuthorizedSender, Yt as getSlackExecApprovalApprovers, Zt as isSlackExecApprovalClientEnabled, _ as qualifySlackRoutePeerId, _t as renderSlackMessagePresentationFallbackText, b as resolveSlackConversationBindingRoute, d as resolveSlackGroupRequireMention, en as shouldSuppressLocalSlackExecApprovalPrompt, f as resolveSlackGroupToolPolicy, g as qualifySlackConversationId, i as setSlackSessionStatus, jt as resolveSlackApproverDmTargets, kt as normalizeSlackOriginTarget, m as formatSlackError, mt as SLACK_PRESENTATION_CAPABILITIES, qt as isSlackWorkspaceInstallation, rn as resolveSlackAutoThreadId, s as slackIngressIdentity, t as probeSlack, tn as resolvePluginApprovalSlackApprovers, vt as SLACK_EDIT_TEXT_MAX_BYTES, wt as normalizeSlackOutboundText, xt as SLACK_TEXT_LIMIT, y as normalizeSlackRouteBindingConfig, zt as resolveSlackApprovalTeamId } from "./probe-B_Ax1vS1.mjs";
+import { n as resolveSlackReplyThreadTs, r as resolveSlackThreadTsValue, t as normalizeSlackThreadTsCandidate } from "./thread-ts-47Au2-Yn.mjs";
+import { n as extractSlackToolSend, t as describeSlackMessageTool } from "./message-tool-api-B38BpEaE.mjs";
+import { a as resolveSlackReplyBlockResolution, o as resolveSlackReplyBlocks, r as normalizeSlackReplyPayload, s as resolveSlackReplyDeliveryMessages } from "./reply-blocks-DyYYRrP_.mjs";
+import { r as createSlackLookupClient, t as collectSlackCursorPages, u as getSlackWriteClient } from "./cursor-pages-jVn3Vkfi.mjs";
+import { n as resolveSlackChannelType, r as resolveSlackConversationInfo } from "./channel-type-9Lw6yLf2.mjs";
+import { n as SLACK_CHANNEL_META } from "./channel-meta-C5vsCo3a.mjs";
+import { i as SLACK_CHANNEL, r as slackBaseConfigAdapter, t as slackSetupPlugin } from "./channel.setup-BlgXNuCJ.mjs";
+import { n as normalizeCompatibilityConfig, r as runtime_doctor_migrations_exports, t as legacyConfigRules } from "./doctor-contract-BB2KJ9Ni.mjs";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-CqVqR7MP.mjs";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { adaptScopedAccountAccessor } from "openclaw/plugin-sdk/channel-config-helpers";
+import { adaptScopedAccountAccessor, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildOutboundBaseSessionKey, normalizeMessageChannel, resolveAccountEntry, resolveAgentRoute } from "openclaw/plugin-sdk/routing";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$2 } from "openclaw/plugin-sdk/account-id";
 import { buildLegacyDmAccountAllowlistAdapter, createAccountScopedAllowlistNameResolver, createFlatAllowlistOverrideResolver } from "openclaw/plugin-sdk/allowlist-config-edit";
 import { buildThreadAwareOutboundSessionRoute, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createChannelMessageAdapterFromOutbound, createRuntimeOutboundDelegates } from "openclaw/plugin-sdk/channel-outbound";
@@ -33,9 +35,11 @@ import { createChannelNativeOriginTargetResolverAsync, createNativeApprovalForwa
 import { readBooleanParam } from "openclaw/plugin-sdk/boolean-param";
 import { resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { normalizeLegacyInteractiveReply, normalizeMessagePresentation } from "openclaw/plugin-sdk/interactive-runtime";
-import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { readPositiveIntegerParam as readPositiveIntegerParam$1, readStringParam as readStringParam$1 } from "openclaw/plugin-sdk/param-readers";
-//#region extensions/slack/src/approval-native.ts
+import { buildMutableAllowEntryDetector, collectStandardAllowlistLists, createConditionalWarningCollector, createDangerousNameMatchingMutableAllowlistWarningCollector, createOpenProviderConfiguredRouteWarningCollector } from "openclaw/plugin-sdk/channel-policy";
+import { identityEntryAuthenticationClassifier } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
+// extensions/slack/src/approval-native.ts
 function resolveSlackNativeSuppressionAccountId({ target, request }) {
 	return normalizeOptionalString(target.accountId) ?? normalizeOptionalString(request.request.turnSourceAccountId);
 }
@@ -99,7 +103,7 @@ const baseSlackApprovalCapability = createApproverRestrictedNativeApprovalCapabi
 		],
 		isConfigured: isSlackAnyNativeApprovalClientEnabled,
 		shouldHandle: shouldHandleSlackNativeApprovalRequest,
-		load: async () => (await import("./approval-handler.runtime-D8ArtDQt.mjs")).slackApprovalNativeRuntime
+		load: async () => (await import("./approval-handler.runtime-Ch7BecYK.mjs")).slackApprovalNativeRuntime
 	})
 });
 const baseSlackNativeAdapter = baseSlackApprovalCapability.nativeAsync;
@@ -167,8 +171,7 @@ const slackApprovalCapability = {
 		}
 	} : void 0
 };
-//#endregion
-//#region extensions/slack/src/message-action-dispatch.ts
+// extensions/slack/src/channel-actions.ts
 const SLACK_MESSAGE_ACTIONS = /* @__PURE__ */ new Map([
 	["reactions", "reactions"],
 	["delete", "deleteMessage"],
@@ -179,196 +182,28 @@ const SLACK_MESSAGE_ACTIONS = /* @__PURE__ */ new Map([
 function readSlackForceDocument(params) {
 	return readBooleanParam(params, "forceDocument") ?? readBooleanParam(params, "asDocument") ?? false;
 }
-function renderSlackActionPresentation(content, presentation) {
+function renderSlackActionPresentation(content, presentation, markdownOptions) {
+	const renderedContent = normalizeSlackOutboundText(content ?? "", markdownOptions);
 	if (!presentation) return {
-		text: content ?? "",
+		text: renderedContent,
 		usesPresentationTextFallback: false
 	};
-	const renderedBlocks = presentation.blocks.some((block) => (block.type === "text" || block.type === "context") && block.text.trim().length > 3e3) ? void 0 : buildSlackPresentationBlocksIfComplete(presentation);
-	const usesPresentationTextFallback = !renderedBlocks || renderedBlocks.length > 50;
-	const blocks = usesPresentationTextFallback ? void 0 : renderedBlocks;
+	const resolution = resolveSlackReplyBlockResolution({
+		text: content,
+		presentation
+	}, markdownOptions);
+	const segment = resolution.segments.length === 1 ? resolution.segments[0] : void 0;
+	const usesPresentationTextFallback = segment?.kind !== "blocks" || presentation.blocks.some((block) => (block.type === "text" || block.type === "context") && block.text.trim().length > 3e3);
+	const blocks = !usesPresentationTextFallback && segment?.kind === "blocks" ? segment.blocks : void 0;
 	return {
 		...blocks?.length ? { blocks } : {},
 		text: usesPresentationTextFallback || presentation.blocks.some((block) => block.type === "chart" || block.type === "table") ? renderSlackMessagePresentationFallbackText({
-			text: content,
+			text: resolution.authoredTextPlacement === "blocks" ? void 0 : renderedContent,
 			presentation
-		}) : content ?? "",
+		}) : renderedContent,
 		usesPresentationTextFallback
 	};
 }
-async function handleSlackMessageAction(params) {
-	const { providerId, ctx, invoke } = params;
-	const { action, cfg, params: actionParams } = ctx;
-	const accountId = ctx.accountId ?? void 0;
-	const invokeSlackAction = (request, toolContext = ctx.toolContext) => invoke({
-		...request,
-		accountId
-	}, cfg, toolContext);
-	const resolveChannelId = () => {
-		const raw = readStringParam$1(actionParams, "channelId") ?? readStringParam$1(actionParams, "to", { required: true });
-		const target = parseSlackTarget(raw, { defaultKind: "channel" });
-		const channelId = resolveSlackChannelId(raw);
-		return formatSlackTarget({
-			teamId: target?.teamId,
-			kind: "channel",
-			id: channelId
-		});
-	};
-	if (action === "conversation-open") return await invokeSlackAction({
-		action: "openConversation",
-		userIds: actionParams.userIds,
-		teamId: readStringParam$1(actionParams, "teamId")
-	});
-	if (action === "send") {
-		const to = readStringParam$1(actionParams, "to", { required: true });
-		const content = readStringParam$1(actionParams, "message", {
-			required: false,
-			allowEmpty: true
-		});
-		const mediaUrl = readStringParam$1(actionParams, "media", { trim: false });
-		const presentation = normalizeMessagePresentation(actionParams.presentation);
-		const interactive = normalizeLegacyInteractiveReply(actionParams.interactive);
-		const hasStructuredContent = Boolean(presentation || interactive?.blocks.length);
-		const resolution = resolveSlackReplyBlockResolution({
-			text: content,
-			presentation,
-			interactive
-		}, { materializeAuthoredText: hasStructuredContent });
-		const preparedMessages = resolution.segments.length > 0 ? resolveSlackReplyDeliveryMessages({
-			authoredTextPlacement: resolution.authoredTextPlacement,
-			segments: resolution.segments,
-			text: content
-		}) : [];
-		if (!content && preparedMessages.length === 0 && !mediaUrl) throw new Error("Slack send requires message, blocks, or media.");
-		const replyBroadcast = readBooleanParam(actionParams, "replyBroadcast");
-		if (replyBroadcast && mediaUrl) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
-		const threadId = readStringParam$1(actionParams, "threadId");
-		const replyTo = readStringParam$1(actionParams, "replyTo");
-		const topLevel = readBooleanParam(actionParams, "topLevel") === true || actionParams.threadId === null;
-		const toolContext = preparedMessages.length > 0 ? {
-			...ctx.toolContext,
-			preparedMessages
-		} : ctx.toolContext;
-		return await invokeSlackAction({
-			action: "sendMessage",
-			to,
-			content: content ?? "",
-			mediaUrl: mediaUrl ?? void 0,
-			...readSlackForceDocument(actionParams) ? { forceDocument: true } : {},
-			threadTs: resolveSlackThreadTsValue({
-				replyToId: replyTo,
-				threadId
-			}),
-			...topLevel ? { topLevel: true } : {},
-			...replyBroadcast ? { replyBroadcast } : {}
-		}, toolContext);
-	}
-	if (action === "react") {
-		const messageIdRaw = resolveReactionMessageId({
-			args: actionParams,
-			toolContext: ctx.toolContext
-		});
-		if (messageIdRaw == null) throw new Error("messageId required. Provide messageId explicitly or react to the current inbound message.");
-		const messageId = String(messageIdRaw);
-		const emoji = readStringParam$1(actionParams, "emoji", { allowEmpty: true });
-		const remove = typeof actionParams.remove === "boolean" ? actionParams.remove : void 0;
-		return await invokeSlackAction({
-			action: "react",
-			channelId: resolveChannelId(),
-			messageId,
-			emoji,
-			remove
-		});
-	}
-	const messageAction = SLACK_MESSAGE_ACTIONS.get(action);
-	if (messageAction) {
-		const messageId = action === "list-pins" ? void 0 : readStringParam$1(actionParams, "messageId", { required: true });
-		return await invokeSlackAction({
-			action: messageAction,
-			channelId: resolveChannelId(),
-			messageId,
-			...action === "reactions" ? { limit: actionParams.limit } : {}
-		});
-	}
-	if (action === "read") return await invokeSlackAction({
-		action: "readMessages",
-		channelId: resolveChannelId(),
-		limit: actionParams.limit,
-		before: readStringParam$1(actionParams, "before"),
-		after: readStringParam$1(actionParams, "after"),
-		messageId: readStringParam$1(actionParams, "messageId"),
-		threadId: readStringParam$1(actionParams, "threadId")
-	});
-	if (action === "edit") {
-		const messageId = readStringParam$1(actionParams, "messageId", { required: true });
-		const { blocks, text: accessibleContent, usesPresentationTextFallback } = renderSlackActionPresentation(readStringParam$1(actionParams, "message", { allowEmpty: true }), normalizeMessagePresentation(actionParams.presentation));
-		const tableMode = resolveMarkdownTableMode({
-			cfg,
-			channel: "slack",
-			accountId: accountId ?? resolveDefaultSlackAccountId(cfg)
-		});
-		if (!blocks && countSlackTextUtf8Bytes(normalizeSlackOutboundText(accessibleContent, { tableMode })) > 4e3) throw new Error(`${usesPresentationTextFallback ? "Slack presentation fallback" : "Slack edit"} exceeds the ${String(SLACK_EDIT_TEXT_MAX_BYTES)}-byte edit limit. Send a new message instead.`);
-		if (!accessibleContent && !blocks) throw new Error("Slack edit requires message or blocks.");
-		return await invokeSlackAction({
-			action: "editMessage",
-			channelId: resolveChannelId(),
-			messageId,
-			content: accessibleContent,
-			blocks
-		});
-	}
-	if (action === "member-info") {
-		const requesterAccountId = ctx.requesterAccountId ? normalizeAccountId$1(ctx.requesterAccountId) : void 0;
-		const targetAccountId = normalizeAccountId$1(accountId ?? resolveDefaultSlackAccountId(cfg));
-		const requesterUserId = normalizeOptionalLowercaseString(ctx.toolContext?.currentChannelProvider) === "slack" && requesterAccountId !== void 0 && requesterAccountId === targetAccountId ? normalizeOptionalString(ctx.requesterSenderId) : void 0;
-		const userId = readStringParam$1(actionParams, "userId") ?? requesterUserId;
-		if (!userId) throw new Error("member-info requires a userId outside a current Slack conversation.");
-		return await invokeSlackAction({
-			action: "memberInfo",
-			userId
-		});
-	}
-	if (action === "emoji-list") return await invokeSlackAction({
-		action: "emojiList",
-		limit: readPositiveIntegerParam$1(actionParams, "limit", { message: "limit must be a positive integer." })
-	});
-	if (action === "download-file") {
-		const fileIdParam = readStringParam$1(actionParams, "fileId");
-		const messageIdParam = readStringParam$1(actionParams, "messageId") ?? readStringParam$1(actionParams, "message_id");
-		if (!fileIdParam && messageIdParam) throw new Error("download-file requires fileId (the Slack file id, for example F0B0LTT8M36 from event.files[].id), not messageId. Did you mean to pass fileId? messageId is the Slack message timestamp and is used by react / reactions / edit / delete / pin / unpin actions, not download-file.");
-		const fileId = readStringParam$1(actionParams, "fileId", { required: true });
-		const channelId = readStringParam$1(actionParams, "channelId") ?? readStringParam$1(actionParams, "to");
-		const threadId = readStringParam$1(actionParams, "threadId") ?? readStringParam$1(actionParams, "replyTo");
-		return await invokeSlackAction({
-			action: "downloadFile",
-			fileId,
-			channelId: channelId ?? void 0,
-			threadId: threadId ?? void 0
-		});
-	}
-	if (action === "upload-file") {
-		if (readBooleanParam(actionParams, "replyBroadcast")) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
-		const to = readStringParam$1(actionParams, "to") ?? resolveChannelId();
-		const filePath = readStringParam$1(actionParams, "filePath", { trim: false }) ?? readStringParam$1(actionParams, "path", { trim: false }) ?? readStringParam$1(actionParams, "media", { trim: false });
-		if (!filePath) throw new Error("upload-file requires filePath, path, or media");
-		const threadId = readStringParam$1(actionParams, "threadId") ?? readStringParam$1(actionParams, "replyTo");
-		const topLevel = readBooleanParam(actionParams, "topLevel") === true || actionParams.threadId === null;
-		return await invokeSlackAction({
-			action: "uploadFile",
-			to,
-			filePath,
-			initialComment: readStringParam$1(actionParams, "initialComment", { allowEmpty: true }) ?? readStringParam$1(actionParams, "message", { allowEmpty: true }) ?? readStringParam$1(actionParams, "caption", { allowEmpty: true }) ?? "",
-			filename: readStringParam$1(actionParams, "filename"),
-			title: readStringParam$1(actionParams, "title"),
-			threadTs: threadId ?? void 0,
-			...readSlackForceDocument(actionParams) ? { forceDocument: true } : {},
-			...topLevel ? { topLevel: true } : {}
-		});
-	}
-	throw new Error(`Action ${action} is not supported for provider ${providerId}.`);
-}
-//#endregion
-//#region extensions/slack/src/channel-actions.ts
 const SLACK_TOOL_DELIVERY_ACTIONS = /* @__PURE__ */ new Set([
 	"deleteMessage",
 	"editMessage",
@@ -378,7 +213,7 @@ const SLACK_TOOL_DELIVERY_ACTIONS = /* @__PURE__ */ new Set([
 	"unpinMessage",
 	"uploadFile"
 ]);
-const loadSlackActionRuntime$1 = createLazyRuntimeModule(() => import("./action-runtime.runtime-Ck_j1YTn.mjs"));
+const loadSlackActionRuntime = createLazyRuntimeModule(() => import("./action-runtime.runtime-CpZktret.mjs"));
 function resolveSlackActionContext(ctx, toolContext) {
 	if (!toolContext && !ctx.mediaAccess && !ctx.mediaLocalRoots && !ctx.mediaReadFile && !ctx.conversationReadOrigin && !ctx.requesterAccountId && !ctx.requesterSenderId && !ctx.assertDirectAdapterHandoff) return;
 	return {
@@ -408,14 +243,187 @@ function createSlackActions(providerId, options) {
 		isToolDeliveryAction: ({ args }) => typeof args.action === "string" && SLACK_TOOL_DELIVERY_ACTIONS.has(args.action),
 		prepareSendPayload: ({ ctx, to, payload }) => ctx.action === "send" && !shouldUseWorkspaceAwareSlackActionSend(to, ctx.toolContext) ? payload : null,
 		handleAction: async (ctx) => {
-			return await handleSlackMessageAction({
-				providerId,
-				ctx,
-				invoke: async (action, cfg, toolContext) => {
-					const actionContext = resolveSlackActionContext(ctx, toolContext);
-					return await (options?.invoke ? options.invoke(action, cfg, actionContext) : (await loadSlackActionRuntime$1()).handleSlackAction(action, cfg, actionContext));
-				}
+			const { action, cfg, params: actionParams } = ctx;
+			const accountId = ctx.accountId ?? void 0;
+			const invokeSlackAction = async (request, toolContext = ctx.toolContext) => {
+				const requestAction = {
+					...request,
+					accountId
+				};
+				const actionContext = resolveSlackActionContext(ctx, toolContext);
+				return await (options?.invoke ? options.invoke(requestAction, cfg, actionContext) : (await loadSlackActionRuntime()).handleSlackAction(requestAction, cfg, actionContext));
+			};
+			const resolveChannelId = () => {
+				const raw = readStringParam$1(actionParams, "channelId") ?? readStringParam$1(actionParams, "to", { required: true });
+				const target = parseSlackTarget(raw, { defaultKind: "channel" });
+				const channelId = resolveSlackChannelId(raw);
+				return formatSlackTarget({
+					teamId: target?.teamId,
+					kind: "channel",
+					id: channelId
+				});
+			};
+			if (action === "channel-create") return await invokeSlackAction({
+				action: "createChannel",
+				name: readStringParam$1(actionParams, "name", { required: true }),
+				teamId: readStringParam$1(actionParams, "teamId")
+			});
+			if (action === "conversation-open") return await invokeSlackAction({
+				action: "openConversation",
+				userIds: actionParams.userIds,
+				teamId: readStringParam$1(actionParams, "teamId")
 			});
+			if (action === "send") {
+				const to = readStringParam$1(actionParams, "to", { required: true });
+				const content = readStringParam$1(actionParams, "message", {
+					required: false,
+					allowEmpty: true
+				});
+				const mediaUrl = readStringParam$1(actionParams, "media", { trim: false });
+				const presentation = normalizeMessagePresentation(actionParams.presentation);
+				const interactive = normalizeLegacyInteractiveReply(actionParams.interactive);
+				const hasStructuredContent = Boolean(presentation || interactive?.blocks.length);
+				const resolution = resolveSlackReplyBlockResolution({
+					text: content,
+					presentation,
+					interactive
+				}, {
+					...resolveSlackMarkdownOptions({
+						cfg,
+						accountId
+					}),
+					materializeAuthoredText: hasStructuredContent
+				});
+				const preparedMessages = resolution.segments.length > 0 ? resolveSlackReplyDeliveryMessages({
+					authoredTextPlacement: resolution.authoredTextPlacement,
+					segments: resolution.segments,
+					text: content
+				}) : [];
+				if (!content && preparedMessages.length === 0 && !mediaUrl) throw new Error("Slack send requires message, blocks, or media.");
+				const replyBroadcast = readBooleanParam(actionParams, "replyBroadcast");
+				if (replyBroadcast && mediaUrl) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
+				const threadId = readStringParam$1(actionParams, "threadId");
+				const replyTo = readStringParam$1(actionParams, "replyTo");
+				const topLevel = readBooleanParam(actionParams, "topLevel") === true || actionParams.threadId === null;
+				const toolContext = preparedMessages.length > 0 ? {
+					...ctx.toolContext,
+					preparedMessages
+				} : ctx.toolContext;
+				return await invokeSlackAction({
+					action: "sendMessage",
+					to,
+					content: content ?? "",
+					mediaUrl,
+					...readSlackForceDocument(actionParams) ? { forceDocument: true } : {},
+					threadTs: resolveSlackThreadTsValue({
+						replyToId: replyTo,
+						threadId
+					}),
+					...topLevel ? { topLevel: true } : {},
+					...replyBroadcast ? { replyBroadcast } : {}
+				}, toolContext);
+			}
+			if (action === "react") {
+				const messageIdRaw = resolveReactionMessageId({
+					args: actionParams,
+					toolContext: ctx.toolContext
+				});
+				if (messageIdRaw == null) throw new Error("messageId required. Provide messageId explicitly or react to the current inbound message.");
+				const messageId = String(messageIdRaw);
+				const emoji = readStringParam$1(actionParams, "emoji", { allowEmpty: true });
+				const remove = typeof actionParams.remove === "boolean" ? actionParams.remove : void 0;
+				return await invokeSlackAction({
+					action: "react",
+					channelId: resolveChannelId(),
+					messageId,
+					emoji,
+					remove
+				});
+			}
+			const messageAction = SLACK_MESSAGE_ACTIONS.get(action);
+			if (messageAction) {
+				const messageId = action === "list-pins" ? void 0 : readStringParam$1(actionParams, "messageId", { required: true });
+				return await invokeSlackAction({
+					action: messageAction,
+					channelId: resolveChannelId(),
+					messageId,
+					...action === "reactions" ? { limit: actionParams.limit } : {}
+				});
+			}
+			if (action === "read") return await invokeSlackAction({
+				action: "readMessages",
+				channelId: resolveChannelId(),
+				limit: actionParams.limit,
+				before: readStringParam$1(actionParams, "before"),
+				after: readStringParam$1(actionParams, "after"),
+				messageId: readStringParam$1(actionParams, "messageId"),
+				threadId: readStringParam$1(actionParams, "threadId")
+			});
+			if (action === "edit") {
+				const messageId = readStringParam$1(actionParams, "messageId", { required: true });
+				const { blocks, text: accessibleContent, usesPresentationTextFallback } = renderSlackActionPresentation(readStringParam$1(actionParams, "message", { allowEmpty: true }), normalizeMessagePresentation(actionParams.presentation), resolveSlackMarkdownOptions({
+					cfg,
+					accountId
+				}));
+				if (!blocks && countSlackTextUtf8Bytes(accessibleContent) > 4e3) throw new Error(`${usesPresentationTextFallback ? "Slack presentation fallback" : "Slack edit"} exceeds the ${String(SLACK_EDIT_TEXT_MAX_BYTES)}-byte edit limit. Send a new message instead.`);
+				if (!accessibleContent && !blocks) throw new Error("Slack edit requires message or blocks.");
+				return await invokeSlackAction({
+					action: "editMessage",
+					channelId: resolveChannelId(),
+					messageId,
+					content: accessibleContent,
+					blocks
+				}, {
+					...ctx.toolContext,
+					preparedEditText: accessibleContent
+				});
+			}
+			if (action === "member-info") {
+				const requesterAccountId = ctx.requesterAccountId ? normalizeAccountId(ctx.requesterAccountId) : void 0;
+				const targetAccountId = normalizeAccountId(accountId ?? resolveDefaultSlackAccountId(cfg));
+				const requesterUserId = normalizeOptionalLowercaseString(ctx.toolContext?.currentChannelProvider) === "slack" && requesterAccountId !== void 0 && requesterAccountId === targetAccountId ? normalizeOptionalString(ctx.requesterSenderId) : void 0;
+				const userId = readStringParam$1(actionParams, "userId") ?? requesterUserId;
+				if (!userId) throw new Error("member-info requires a userId outside a current Slack conversation.");
+				return await invokeSlackAction({
+					action: "memberInfo",
+					userId
+				});
+			}
+			if (action === "emoji-list") return await invokeSlackAction({
+				action: "emojiList",
+				limit: readPositiveIntegerParam$1(actionParams, "limit", { message: "limit must be a positive integer." })
+			});
+			if (action === "download-file") {
+				const fileIdParam = readStringParam$1(actionParams, "fileId");
+				const messageIdParam = readStringParam$1(actionParams, "messageId") ?? readStringParam$1(actionParams, "message_id");
+				if (!fileIdParam && messageIdParam) throw new Error("download-file requires fileId (the Slack file id, for example F0B0LTT8M36 from event.files[].id), not messageId. Did you mean to pass fileId? messageId is the Slack message timestamp and is used by react / reactions / edit / delete / pin / unpin actions, not download-file.");
+				return await invokeSlackAction({
+					action: "downloadFile",
+					fileId: fileIdParam ?? readStringParam$1(actionParams, "fileId", { required: true }),
+					channelId: readStringParam$1(actionParams, "channelId") ?? readStringParam$1(actionParams, "to"),
+					threadId: readStringParam$1(actionParams, "threadId") ?? readStringParam$1(actionParams, "replyTo")
+				});
+			}
+			if (action === "upload-file") {
+				if (readBooleanParam(actionParams, "replyBroadcast")) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
+				const to = readStringParam$1(actionParams, "to") ?? resolveChannelId();
+				const filePath = readStringParam$1(actionParams, "filePath", { trim: false }) ?? readStringParam$1(actionParams, "path", { trim: false }) ?? readStringParam$1(actionParams, "media", { trim: false });
+				if (!filePath) throw new Error("upload-file requires filePath, path, or media");
+				const threadId = readStringParam$1(actionParams, "threadId") ?? readStringParam$1(actionParams, "replyTo");
+				const topLevel = readBooleanParam(actionParams, "topLevel") === true || actionParams.threadId === null;
+				return await invokeSlackAction({
+					action: "uploadFile",
+					to,
+					filePath,
+					initialComment: readStringParam$1(actionParams, "initialComment", { allowEmpty: true }) ?? readStringParam$1(actionParams, "message", { allowEmpty: true }) ?? readStringParam$1(actionParams, "caption", { allowEmpty: true }) ?? "",
+					filename: readStringParam$1(actionParams, "filename"),
+					title: readStringParam$1(actionParams, "title"),
+					threadTs: threadId,
+					...readSlackForceDocument(actionParams) ? { forceDocument: true } : {},
+					...topLevel ? { topLevel: true } : {}
+				});
+			}
+			throw new Error(`Action ${action} is not supported for provider ${providerId}.`);
 		}
 	};
 }
@@ -429,12 +437,11 @@ function shouldUseWorkspaceAwareSlackActionSend(rawTarget, context) {
 	}
 	return false;
 }
-//#endregion
-//#region extensions/slack/src/conversation-route-owner.ts
+// extensions/slack/src/conversation-route-owner.ts
 function prepareSlackConversationRouteOwner(params) {
-	const accountId = normalizeAccountId(params.accountId);
+	const accountId = normalizeAccountId$2(params.accountId);
 	const accountConfig = resolveAccountEntry(params.cfg.channels?.slack?.accounts, accountId);
-	if (params.cfg.channels?.slack?.enabled === false || accountConfig?.enabled === false || !accountConfig && (accountId !== DEFAULT_ACCOUNT_ID || !hasImplicitDefaultSlackAccount(params.cfg))) return {
+	if (params.cfg.channels?.slack?.enabled === false || accountConfig?.enabled === false || !accountConfig && (accountId !== DEFAULT_ACCOUNT_ID$1 || !hasImplicitDefaultSlackAccount(params.cfg))) return {
 		kind: "terminal",
 		owner: null
 	};
@@ -516,7 +523,7 @@ function prepareSlackConversationRouteOwner(params) {
 		}
 	};
 }
-async function prepareSlackConversationRouteOwnersAsync(inputs, inspectBindings) {
+const slackConversationRouteOwners = { prepareConversationRouteOwnersAsync: async (inputs, inspectBindings) => {
 	const prepared = inputs.map(prepareSlackConversationRouteOwner);
 	const inspect = await inspectBindings(prepared.flatMap((item) => item.kind === "prepared" && item.route.bindingsEnabled ? [{
 		channel: "slack",
@@ -549,10 +556,8 @@ async function prepareSlackConversationRouteOwnersAsync(inputs, inspectBindings)
 			thread: thread()
 		});
 	});
-}
-const slackConversationRouteOwners = { prepareConversationRouteOwnersAsync: prepareSlackConversationRouteOwnersAsync };
-//#endregion
-//#region extensions/slack/src/enterprise-user-route.ts
+} };
+// extensions/slack/src/enterprise-user-route.ts
 /** Resolve a workspace for a detached Enterprise DM without opening a conversation. */
 async function resolveSlackEnterpriseUserTeamId(params) {
 	const account = resolveSlackAccount(params);
@@ -577,8 +582,245 @@ async function resolveSlackEnterpriseUserTeamId(params) {
 	if (!teamId) throw new Error("unsupported_enterprise_slack_delivery: recipient shares no verified installed workspace");
 	return teamId;
 }
-//#endregion
-//#region extensions/slack/src/threading-tool-context.ts
+// extensions/slack/src/security.ts
+const resolveSlackDmPolicy = createScopedDmSecurityResolver({
+	channelKey: "slack",
+	resolvePolicy: (account) => account.config.dmPolicy,
+	resolveAllowFrom: (account) => account.config.allowFrom,
+	resolveAccess: ({ cfg, account }) => ({
+		dmPolicy: resolveSlackAccountDmPolicy({
+			cfg,
+			accountId: account.accountId
+		}),
+		allowFrom: resolveSlackAccountAllowFrom({
+			cfg,
+			accountId: account.accountId
+		})
+	}),
+	policyPathSuffix: "dmPolicy",
+	classifyEntryAuthentication: identityEntryAuthenticationClassifier(slackIngressIdentity),
+	normalizeEntry: (raw) => raw.trim().replace(/^(slack|user):/i, "").trim()
+});
+const collectSlackSecurityWarnings = createOpenProviderConfiguredRouteWarningCollector({
+	providerConfigPresent: (cfg) => cfg.channels?.slack !== void 0,
+	resolveGroupPolicy: (account) => account.config.groupPolicy,
+	resolveRouteAllowlistConfigured: (account) => Boolean(account.config.channels) && Object.keys(account.config.channels ?? {}).length > 0,
+	configureRouteAllowlist: {
+		surface: "Slack channels",
+		openScope: "any channel not explicitly denied",
+		groupPolicyPath: "channels.slack.groupPolicy",
+		routeAllowlistPath: "channels.slack.channels"
+	},
+	missingRouteAllowlist: {
+		surface: "Slack channels",
+		openBehavior: "with no channel allowlist; any channel can trigger (mention-gated)",
+		remediation: "Set channels.slack.groupPolicy=\"allowlist\" and configure channels.slack.channels"
+	}
+});
+const collectSlackSecurityFindings = createConditionalWarningCollector.findings({
+	collectWarnings: collectSlackSecurityWarnings,
+	checkId: "channels.slack.groups.open",
+	severity: "warn",
+	title: "Slack security warning"
+});
+const loadSlackSecurityAuditModule = createLazyRuntimeModule(() => import("./security-audit-C3hXCfDt.mjs").then((n) => n.n));
+const slackSecurityAdapter = {
+	resolveDmPolicy: resolveSlackDmPolicy,
+	collectWarnings: collectSlackSecurityFindings,
+	collectAuditFindings: async (params) => {
+		const { collectSlackSecurityAuditFindings } = await loadSlackSecurityAuditModule();
+		return await collectSlackSecurityAuditFindings(params);
+	}
+};
+// extensions/slack/src/doctor.ts
+const isSlackMutableUnqualifiedAllowEntry = buildMutableAllowEntryDetector({ stableIdPattern: /^(?:(?:(?:[sS][lL][aA][cC][kK]|[uU][sS][eE][rR]):)?(?:[UWBCGDT][A-Z0-9]{2,}|[A-Za-z0-9]{8,})|<@[A-Za-z0-9]{8,}>)$/ });
+const collectSlackMutableAllowlistWarnings = createDangerousNameMatchingMutableAllowlistWarningCollector({
+	channel: "slack",
+	detector: (entry) => {
+		if (/^team:/i.test(entry)) try {
+			const target = parseSlackTarget(entry);
+			if (target?.kind === "user" && target.teamId) return false;
+		} catch {}
+		return isSlackMutableUnqualifiedAllowEntry(entry);
+	},
+	collectLists: (scope) => collectStandardAllowlistLists(scope, {
+		includeGroupAllowFrom: false,
+		includeDm: true,
+		includeGroups: true,
+		groupsKey: "channels",
+		groupField: "users"
+	})
+});
+const SLACK_CANONICAL_CHANNEL_ID_RE = /^(?:channel:)?[CG][A-Z0-9]{8,}$/;
+const SLACK_LOWERCASE_CHANNEL_ID_RE = /^(?:channel:)?[cg][0-9][a-z0-9]{7,}$/;
+const SLACK_CANONICAL_DM_ID_RE = /^(?:channel:)?D[A-Z0-9]{8,}$/;
+const SLACK_PREFIXED_LOWERCASE_DM_ID_RE = /^channel:d[a-z0-9]{8,}$/;
+const SLACK_AMBIGUOUS_LOWERCASE_DM_ID_RE = /^d[a-z0-9]{8,}$/;
+const SLACK_AMBIGUOUS_LOWERCASE_CHANNEL_ID_RE = /^(?:channel:)?[cgd][a-z][a-z0-9]{7,}$/;
+const SLACK_CHANNEL_NAME_RE = /^[\p{L}\p{M}\p{N}_-]{1,80}$/u;
+const SLACK_CHANNEL_NAME_ALPHANUMERIC_RE = /[\p{L}\p{N}]/u;
+function looksLikeSlackChannelId(channelKey) {
+	const workspaceChannelId = parseWorkspaceQualifiedChannelId(channelKey);
+	return workspaceChannelId !== void 0 && /^[CG]/i.test(workspaceChannelId) || SLACK_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_LOWERCASE_CHANNEL_ID_RE.test(channelKey);
+}
+function looksLikeSlackDmId(channelKey) {
+	const workspaceChannelId = parseWorkspaceQualifiedChannelId(channelKey);
+	return workspaceChannelId !== void 0 && /^D/i.test(workspaceChannelId) || SLACK_CANONICAL_DM_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_DM_ID_RE.test(channelKey);
+}
+function parseWorkspaceQualifiedChannelId(channelKey) {
+	if (!/^team:/i.test(channelKey)) return;
+	try {
+		const target = parseSlackTarget(channelKey);
+		return target?.kind === "channel" && target.teamId ? target.id : void 0;
+	} catch {
+		return;
+	}
+}
+function looksLikeSlackChannelNameKey(channelKey) {
+	const name = channelKey.startsWith("#") ? channelKey.slice(1) : channelKey;
+	return name === name.toLowerCase() && SLACK_CHANNEL_NAME_RE.test(name) && SLACK_CHANNEL_NAME_ALPHANUMERIC_RE.test(name);
+}
+function collectSlackNameKeyedChannelWarnings({ cfg }) {
+	const warnings = /* @__PURE__ */ new Set();
+	const slackCfg = (0, runtime_doctor_migrations_exports.asObjectRecord)((0, runtime_doctor_migrations_exports.asObjectRecord)(cfg.channels)?.slack);
+	const providerChannels = (0, runtime_doctor_migrations_exports.asObjectRecord)(slackCfg?.channels);
+	const accounts = (0, runtime_doctor_migrations_exports.asObjectRecord)(slackCfg?.accounts);
+	for (const accountId of listSlackAccountIds(cfg)) {
+		const account = (0, runtime_doctor_migrations_exports.asObjectRecord)(mergeSlackAccountConfig(cfg, accountId));
+		if (!account || slackCfg?.enabled === false || account.enabled === false) continue;
+		const effectiveGroupPolicy = (typeof account.groupPolicy === "string" ? account.groupPolicy : void 0) ?? "allowlist";
+		const rawAccount = (0, runtime_doctor_migrations_exports.asObjectRecord)(accounts?.[accountId]);
+		const accountPrefix = rawAccount ? `channels.slack.accounts.${accountId}` : "channels.slack";
+		const accountChannels = (0, runtime_doctor_migrations_exports.asObjectRecord)(rawAccount?.channels);
+		const channels = accountChannels ?? providerChannels;
+		if (!channels) continue;
+		const channelsPrefix = accountChannels ? `channels.slack.accounts.${accountId}` : "channels.slack";
+		const fallbackDescription = Object.hasOwn(channels, "*") ? `${channelsPrefix}.channels."*" applies instead and this entry's overrides are ignored` : effectiveGroupPolicy === "open" ? "this entry's overrides are ignored and the channel remains allowed by groupPolicy: \"open\"" : "messages from the channel are dropped";
+		for (const channelKey of Object.keys(channels)) {
+			if (channelKey === "*") continue;
+			if (looksLikeSlackDmId(channelKey)) {
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is a Slack DM conversation ID, but ${channelsPrefix}.channels only configures channel and group rooms. Configure DM access with ${accountPrefix}.dmPolicy and ${accountPrefix}.allowFrom instead.`);
+				continue;
+			}
+			if (SLACK_AMBIGUOUS_LOWERCASE_DM_ID_RE.test(channelKey)) {
+				if (account.dangerouslyAllowNameMatching === true && looksLikeSlackChannelNameKey(channelKey)) continue;
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is ambiguous: it may be a lowercase Slack DM conversation ID or a channel name. Configure DMs with ${accountPrefix}.dmPolicy and ${accountPrefix}.allowFrom; otherwise re-key the room with its stable C/G ID.`);
+				continue;
+			}
+			if (effectiveGroupPolicy === "disabled") continue;
+			const channelConfig = (0, runtime_doctor_migrations_exports.asObjectRecord)(channels[channelKey]);
+			if (effectiveGroupPolicy === "open" && Object.keys(channelConfig ?? {}).length === 0) continue;
+			if (looksLikeSlackChannelId(channelKey)) continue;
+			if (account.dangerouslyAllowNameMatching === true && looksLikeSlackChannelNameKey(channelKey)) continue;
+			if (SLACK_AMBIGUOUS_LOWERCASE_CHANNEL_ID_RE.test(channelKey)) {
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is ambiguous: it may be a lowercase Slack channel ID or a channel name. If it is a channel name, inbound routing will not match it and ${fallbackDescription}. Re-key it with the channel's stable ID (e.g. C0123ABCD, from the channel's About details or conversations.info).`);
+				continue;
+			}
+			warnings.add(`${channelsPrefix}.channels."${channelKey}" is keyed by a channel name or unsupported ID form, not a routable Slack channel ID; under groupPolicy: "${effectiveGroupPolicy}" inbound routing does not match this entry, so ${fallbackDescription}. Re-key it with the channel's ID (e.g. C0123ABCD, from the channel's About details or conversations.info).`);
+		}
+	}
+	return [...warnings];
+}
+async function collectSlackUserIdentityWarnings(params) {
+	const warnings = [];
+	for (const accountId of listSlackAccountIds(params.cfg)) {
+		const account = inspectSlackAccount({
+			cfg: params.cfg,
+			accountId,
+			envBotToken: params.env?.SLACK_BOT_TOKEN,
+			envAppToken: params.env?.SLACK_APP_TOKEN,
+			envUserToken: params.env?.SLACK_USER_TOKEN
+		});
+		if (!account.enabled || account.identity !== "user") continue;
+		const path = accountId === "default" ? "channels.slack" : `channels.slack.accounts.${accountId}`;
+		const mode = account.mode ?? "socket";
+		if (mode === "socket" && account.appTokenStatus === "missing") warnings.push(`- ${path}: identity "user" in Socket Mode requires appToken for companion-app events.`);
+		else if (mode === "http" && account.signingSecretStatus === "missing") warnings.push(`- ${path}: identity "user" in HTTP mode requires signingSecret for companion-app events.`);
+		if (!account.userToken) {
+			warnings.push(account.userTokenStatus === "configured_unavailable" ? `- ${path}: userToken is configured but unavailable; Slack auth.test validation was skipped.` : `- ${path}: identity "user" requires userToken for the authorizing human.`);
+			continue;
+		}
+		const probe = await probeSlack(account.userToken, 2500, {
+			accountId,
+			identity: "user"
+		});
+		if (!probe.ok) {
+			warnings.push(`- ${path}: userToken auth.test failed: ${probe.error ?? "unknown error"}.`);
+			continue;
+		}
+		const userId = probe.user?.id?.trim();
+		const userName = probe.user?.name?.trim();
+		if (!userId) {
+			warnings.push(`- ${path}: userToken auth.test succeeded but returned no human user_id.`);
+			continue;
+		}
+		warnings.push(`- ${path}: user identity authenticated as ${userName ? `@${userName} ` : ""}(${userId}).`);
+	}
+	return warnings;
+}
+const slackDoctor = {
+	dmAllowFromMode: "topOnly",
+	groupModel: "route",
+	groupAllowFromFallbackToAllowFrom: false,
+	warnOnEmptyGroupSenderAllowlist: false,
+	legacyConfigRules,
+	normalizeCompatibilityConfig,
+	collectPreviewWarnings: collectSlackUserIdentityWarnings,
+	collectMutableAllowlistWarnings: ({ cfg }) => [...collectSlackMutableAllowlistWarnings({ cfg }), ...collectSlackNameKeyedChannelWarnings({ cfg })]
+};
+// extensions/slack/src/shared.ts
+const slackConfigAdapter = {
+	...slackBaseConfigAdapter,
+	inspectAccount: adaptScopedAccountAccessor(inspectSlackAccount)
+};
+const slackPluginBase = {
+	...slackSetupPlugin,
+	meta: {
+		...SLACK_CHANNEL_META,
+		preferSessionLookupForAnnounceTarget: true
+	},
+	doctor: slackDoctor,
+	agentPrompt: {
+		questionInputMode: "buttons",
+		customInlineButtonHint: true,
+		inboundFormattingHints: () => ({
+			text_markup: "markdown",
+			rules: [
+				"Write replies in standard Markdown; OpenClaw converts them to Slack mrkdwn.",
+				"Bold uses **double asterisks**; *single asterisks* or _underscores_ produce italics.",
+				"Links use [label](url). Keep Slack mentions as <@USER_ID>.",
+				"Use presentation table blocks for tabular data; Markdown pipe tables are not auto-promoted.",
+				"Only raw Block Kit or presentation text fields use Slack mrkdwn directly: *bold*, _italic_, ~strike~, and <url|label> links. Avoid Markdown headings or pipe tables in those fields."
+			]
+		}),
+		messageToolHints: () => [
+			"- Use `presentation` buttons/selects for discrete choices or parameter picks instead of asking the user to type one.",
+			"- For line, bar, area, or pie data, use a `presentation` chart block; Slack renders it as a native chart and retains a text data summary for accessibility.",
+			"- For row-and-column data, use an explicit `presentation` table block; Slack renders it as a native table and retains a linear text summary for accessibility. Markdown pipe tables are not auto-promoted.",
+			"- Slack plain text sends: write standard Markdown; OpenClaw converts it to Slack mrkdwn, including `**bold**`, headings, lists, and `[label](url)` links.",
+			"- When mentioning Slack users, use the stable `<@USER_ID>` token from Slack context instead of plain `@name` text so Slack notifies and links the user.",
+			"- Slack Block Kit or presentation text fields are sent as Slack mrkdwn directly; use `*bold*`, `_italic_`, `~strike~`, `<url|label>` links, and avoid Markdown headings or pipe tables there."
+		]
+	},
+	config: {
+		...slackSetupPlugin.config,
+		...slackConfigAdapter,
+		isConfigured: isSlackPluginAccountConfigured,
+		describeAccount: (account) => describeAccountSnapshot({
+			account,
+			configured: isSlackPluginAccountConfigured(account),
+			extra: {
+				botTokenSource: account.botTokenSource,
+				appTokenSource: account.appTokenSource
+			}
+		})
+	},
+	secrets: {
+		secretTargetRegistryEntries,
+		collectRuntimeConfigAssignments
+	}
+};
+// extensions/slack/src/threading-tool-context.ts
 function buildSlackThreadingToolContext(params) {
 	const account = resolveSlackAccount({
 		cfg: params.cfg,
@@ -608,24 +850,19 @@ function buildSlackThreadingToolContext(params) {
 		sameChannelThreadRequired: hasExplicitThreadTarget
 	};
 }
-//#endregion
-//#region extensions/slack/src/channel.ts
+// extensions/slack/src/channel.ts
 const loadExtensionSharedSdk = createLazyRuntimeModule(() => import("openclaw/plugin-sdk/extension-shared"));
 const loadTargetResolverRuntimeSdk = createLazyRuntimeModule(() => import("openclaw/plugin-sdk/target-resolver-runtime"));
-const loadSlackScopesModule = createLazyRuntimeModule(() => import("./scopes-DfQVi8Jw.mjs"));
-const loadSlackOutboundAdapterModule = createLazyRuntimeModule(() => import("./outbound-adapter-9dbnYtL1.mjs"));
+const loadSlackScopesModule = createLazyRuntimeModule(() => import("./scopes-CzHC_dwV.mjs"));
+const loadSlackOutboundAdapterModule = createLazyRuntimeModule(() => import("./outbound-adapter-BH6iPWBj.mjs"));
 const bindSlackOutbound = createLazyRuntimeMethodBinder(loadSlackOutboundAdapterModule);
-async function resolveSlackHandleAction() {
-	return getOptionalSlackRuntime()?.channel?.slack?.handleSlackAction ?? (await loadSlackActionRuntime()).handleSlackAction;
-}
-const loadSlackDirectoryConfigModule = createLazyRuntimeModule(() => import("./directory-config-Cjj0N8R0.mjs").then((n) => n.t));
-const loadSlackResolveChannelsModule = createLazyRuntimeModule(() => import("./resolve-channels-DRRhElwz.mjs").then((n) => n.n));
-const loadSlackResolveUsersModule = createLazyRuntimeModule(() => import("./resolve-users-Cz8e17ky.mjs").then((n) => n.n));
-const loadSlackActionRuntime = createLazyRuntimeModule(() => import("./action-runtime.runtime-Ck_j1YTn.mjs"));
-const loadSlackSendRuntime = createLazyRuntimeModule(() => import("./send-C-8wY0lK.mjs").then((n) => n.n));
-const loadSlackProbeModule = createLazyRuntimeModule(() => import("./probe-IiHogLQN.mjs").then((n) => n.n));
-const loadSlackMonitorModule = createLazyRuntimeModule(() => import("./monitor-BFilOuM_.mjs").then((n) => n.t));
-const loadSlackDirectoryLiveModule = createLazyRuntimeModule(() => import("./directory-live-BIKD-5B_.mjs").then((n) => n.t));
+const loadSlackDirectoryConfigModule = createLazyRuntimeModule(() => import("./directory-config-CGvKYg9F.mjs").then((n) => n.t));
+const loadSlackResolveChannelsModule = createLazyRuntimeModule(() => import("./resolve-channels-CF2JME9q.mjs").then((n) => n.n));
+const loadSlackResolveUsersModule = createLazyRuntimeModule(() => import("./resolve-users-DDcCAjH1.mjs").then((n) => n.n));
+const loadSlackSendRuntime = createLazyRuntimeModule(() => import("./send-WJZ73VSf.mjs").then((n) => n.n));
+const loadSlackProbeModule = createLazyRuntimeModule(() => import("./probe-B_Ax1vS1.mjs").then((n) => n.n));
+const loadSlackMonitorModule = createLazyRuntimeModule(() => import("./monitor-BD86SotB.mjs").then((n) => n.t));
+const loadSlackDirectoryLiveModule = createLazyRuntimeModule(() => import("./directory-live-DNdw97LA.mjs").then((n) => n.t));
 async function setSlackHeartbeatThreadStatus(params) {
 	const threadTs = resolveSlackThreadTsValue({ threadId: params.threadId });
 	const target = parseSlackTarget(params.to, { defaultKind: "channel" });
@@ -672,106 +909,6 @@ function normalizeSlackAcpConversationId(raw) {
 	const conversationId = normalizeLowercaseStringOrEmpty(parsed?.id ?? trimmed.replace(/^slack:/i, "").replace(/^(?:channel|group|direct|user):/i, ""));
 	return conversationId ? { conversationId } : null;
 }
-function matchSlackAcpConversation(params) {
-	const bindingConversationId = normalizeSlackAcpConversationId(params.bindingConversationId)?.conversationId;
-	const conversationId = normalizeSlackAcpConversationId(params.conversationId)?.conversationId;
-	const parentConversationId = normalizeSlackAcpConversationId(params.parentConversationId)?.conversationId;
-	if (!bindingConversationId || !conversationId) return null;
-	if (bindingConversationId === conversationId) return {
-		conversationId,
-		matchPriority: 2
-	};
-	if (parentConversationId && parentConversationId !== conversationId && bindingConversationId === parentConversationId) return {
-		conversationId: parentConversationId,
-		matchPriority: 1
-	};
-	return null;
-}
-async function resolveSlackOutboundSessionRoute(params) {
-	const parsed = parseSlackTarget(params.target, { defaultKind: "channel" });
-	if (!parsed) return null;
-	const apiTargetId = canonicalizeSlackApiTargetId(parsed.kind, parsed.id, params.target);
-	const isDm = parsed.kind === "user";
-	if (params.deliveryPurpose === "heartbeat-owner" && isDm && !parsed.teamId && /^[UW][A-Z0-9]{8,}$/.test(apiTargetId)) {
-		const teamId = await resolveSlackEnterpriseUserTeamId({
-			cfg: params.cfg,
-			accountId: params.accountId,
-			userId: apiTargetId
-		});
-		if (teamId) {
-			parsed.teamId = teamId;
-			parsed.id = apiTargetId;
-		}
-	}
-	let peerKind = isDm ? "direct" : "channel";
-	let peerId = formatSlackTarget(parsed);
-	let recipientSessionExact = isDm ? /^[UW][A-Z0-9]{8,}$/i.test(parsed.id) : /^C[A-Z0-9]{8,}$/i.test(parsed.id);
-	if (!isDm && /^D/i.test(parsed.id)) {
-		const conversation = await resolveSlackConversationInfo({
-			cfg: params.cfg,
-			accountId: params.accountId,
-			channelId: apiTargetId,
-			teamId: parsed.teamId
-		});
-		if (conversation.type !== "dm" || !conversation.user) return null;
-		peerKind = "direct";
-		peerId = formatSlackTarget({
-			teamId: parsed.teamId,
-			kind: "user",
-			id: conversation.user
-		});
-		recipientSessionExact = true;
-	} else if (!isDm && /^G/i.test(parsed.id)) {
-		const channelType = await resolveSlackChannelType({
-			cfg: params.cfg,
-			accountId: params.accountId,
-			channelId: apiTargetId,
-			teamId: parsed.teamId
-		});
-		if (channelType === "group") peerKind = "group";
-		if (channelType === "dm") peerKind = "direct";
-		recipientSessionExact = channelType !== "unknown";
-	}
-	const peer = {
-		kind: peerKind,
-		id: peerId
-	};
-	const unpartitionedBaseSessionKey = buildOutboundBaseSessionKey({
-		channel: "slack",
-		cfg: params.cfg,
-		agentId: params.agentId,
-		accountId: params.accountId,
-		peer
-	});
-	const baseSessionKey = parsed.teamId && peerKind === "direct" && (params.cfg.session?.dmScope ?? "main") === "main" ? `${unpartitionedBaseSessionKey}:account:${encodeURIComponent(resolveSlackAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).accountId).toLowerCase()}:team:${encodeURIComponent(parsed.teamId).toLowerCase()}` : unpartitionedBaseSessionKey;
-	return buildThreadAwareOutboundSessionRoute({
-		route: {
-			sessionKey: baseSessionKey,
-			baseSessionKey,
-			recipientSessionExact,
-			peer,
-			chatType: peerKind === "direct" ? "direct" : "channel",
-			from: peerKind === "direct" ? `slack:${peerId}` : peerKind === "group" ? `slack:group:${peerId}` : `slack:channel:${peerId}`,
-			to: parsed.teamId ? peerId : peerKind === "direct" ? `user:${peerId}` : `channel:${peerId}`
-		},
-		replyToId: params.replyToId,
-		threadId: params.threadId,
-		currentSessionKey: params.currentSessionKey,
-		canRecoverCurrentThread: () => peerKind !== "direct" || (params.cfg.session?.dmScope ?? "main") !== "main"
-	});
-}
-function formatSlackScopeDiagnostic(params) {
-	const source = params.result.source ? ` (${params.result.source})` : "";
-	const label = params.tokenType === "user" ? "User scopes" : "Bot scopes";
-	if (params.result.ok && params.result.scopes?.length) return { text: `${label}${source}: ${params.result.scopes.join(", ")}` };
-	return {
-		text: `${label}: ${params.result.error ?? "scope lookup failed"}`,
-		tone: "error"
-	};
-}
 const resolveSlackAllowlistGroupOverrides = createFlatAllowlistOverrideResolver({
 	resolveRecord: (account) => account.channels,
 	label: (key) => key,
@@ -887,11 +1024,21 @@ const slackPlugin = createChatChannelPlugin({
 		},
 		bindings: {
 			compileConfiguredBinding: ({ conversationId }) => normalizeSlackAcpConversationId(conversationId),
-			matchInboundConversation: ({ compiledBinding, conversationId, parentConversationId }) => matchSlackAcpConversation({
-				bindingConversationId: compiledBinding.conversationId,
-				conversationId,
-				parentConversationId
-			})
+			matchInboundConversation: ({ compiledBinding, conversationId: rawConversationId, parentConversationId: rawParentConversationId }) => {
+				const bindingConversationId = normalizeSlackAcpConversationId(compiledBinding.conversationId)?.conversationId;
+				const conversationId = normalizeSlackAcpConversationId(rawConversationId)?.conversationId;
+				const parentConversationId = normalizeSlackAcpConversationId(rawParentConversationId)?.conversationId;
+				if (!bindingConversationId || !conversationId) return null;
+				if (bindingConversationId === conversationId) return {
+					conversationId,
+					matchPriority: 2
+				};
+				if (parentConversationId && parentConversationId !== conversationId && bindingConversationId === parentConversationId) return {
+					conversationId: parentConversationId,
+					matchPriority: 1
+				};
+				return null;
+			}
 		},
 		conversationBindings: { isCurrentConversationBindingSupported: ({ accountId }) => isSlackWorkspaceInstallation(accountId) },
 		messaging: {
@@ -912,7 +1059,82 @@ const slackPlugin = createChatChannelPlugin({
 				return normalizeSlackMessagingTarget(`channel:${id}`);
 			},
 			inferTargetChatType: ({ to }) => resolveSlackRouteTarget(to)?.chatType,
-			resolveOutboundSessionRoute: resolveSlackOutboundSessionRoute,
+			resolveOutboundSessionRoute: async (params) => {
+				const parsed = parseSlackTarget(params.target, { defaultKind: "channel" });
+				if (!parsed) return null;
+				const apiTargetId = canonicalizeSlackApiTargetId(parsed.kind, parsed.id, params.target);
+				const isDm = parsed.kind === "user";
+				if (params.deliveryPurpose === "heartbeat-owner" && isDm && !parsed.teamId && /^[UW][A-Z0-9]{8,}$/.test(apiTargetId)) {
+					const teamId = await resolveSlackEnterpriseUserTeamId({
+						cfg: params.cfg,
+						accountId: params.accountId,
+						userId: apiTargetId
+					});
+					if (teamId) {
+						parsed.teamId = teamId;
+						parsed.id = apiTargetId;
+					}
+				}
+				let peerKind = isDm ? "direct" : "channel";
+				let peerId = formatSlackTarget(parsed);
+				let recipientSessionExact = isDm ? /^[UW][A-Z0-9]{8,}$/i.test(parsed.id) : /^C[A-Z0-9]{8,}$/i.test(parsed.id);
+				if (!isDm && /^D/i.test(parsed.id)) {
+					const conversation = await resolveSlackConversationInfo({
+						cfg: params.cfg,
+						accountId: params.accountId,
+						channelId: apiTargetId,
+						teamId: parsed.teamId
+					});
+					if (conversation.type !== "dm" || !conversation.user) return null;
+					peerKind = "direct";
+					peerId = formatSlackTarget({
+						teamId: parsed.teamId,
+						kind: "user",
+						id: conversation.user
+					});
+					recipientSessionExact = true;
+				} else if (!isDm && /^G/i.test(parsed.id)) {
+					const channelType = await resolveSlackChannelType({
+						cfg: params.cfg,
+						accountId: params.accountId,
+						channelId: apiTargetId,
+						teamId: parsed.teamId
+					});
+					if (channelType === "group") peerKind = "group";
+					if (channelType === "dm") peerKind = "direct";
+					recipientSessionExact = channelType !== "unknown";
+				}
+				const peer = {
+					kind: peerKind,
+					id: peerId
+				};
+				const unpartitionedBaseSessionKey = buildOutboundBaseSessionKey({
+					channel: "slack",
+					cfg: params.cfg,
+					agentId: params.agentId,
+					accountId: params.accountId,
+					peer
+				});
+				const baseSessionKey = parsed.teamId && peerKind === "direct" && (params.cfg.session?.dmScope ?? "main") === "main" ? `${unpartitionedBaseSessionKey}:account:${encodeURIComponent(resolveSlackAccount({
+					cfg: params.cfg,
+					accountId: params.accountId
+				}).accountId).toLowerCase()}:team:${encodeURIComponent(parsed.teamId).toLowerCase()}` : unpartitionedBaseSessionKey;
+				return buildThreadAwareOutboundSessionRoute({
+					route: {
+						sessionKey: baseSessionKey,
+						baseSessionKey,
+						recipientSessionExact,
+						peer,
+						chatType: peerKind === "direct" ? "direct" : "channel",
+						from: peerKind === "direct" ? `slack:${peerId}` : peerKind === "group" ? `slack:group:${peerId}` : `slack:channel:${peerId}`,
+						to: parsed.teamId ? peerId : peerKind === "direct" ? `user:${peerId}` : `channel:${peerId}`
+					},
+					replyToId: params.replyToId,
+					threadId: params.threadId,
+					currentSessionKey: params.currentSessionKey,
+					canRecoverCurrentThread: () => peerKind !== "direct" || (params.cfg.session?.dmScope ?? "main") !== "main"
+				});
+			},
 			hasStructuredReplyPayload: ({ payload }) => {
 				try {
 					return Boolean(resolveSlackReplyBlocks(payload)?.length);
@@ -974,7 +1196,7 @@ const slackPlugin = createChatChannelPlugin({
 				mapResolved: (entry) => entry
 			});
 		} },
-		actions: createSlackActions(SLACK_CHANNEL, { invoke: async (action, cfg, toolContext) => await (await resolveSlackHandleAction())(action, cfg, toolContext) }),
+		actions: createSlackActions(SLACK_CHANNEL),
 		message: slackMessageAdapter,
 		heartbeat: {
 			sendTyping: (params) => setSlackHeartbeatThreadStatus({
@@ -987,7 +1209,7 @@ const slackPlugin = createChatChannelPlugin({
 			})
 		},
 		status: createComputedAccountStatusAdapter({
-			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID),
+			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID$1),
 			buildChannelSummary: async ({ snapshot }) => {
 				const { buildPassiveProbedChannelStatusSummary } = await loadExtensionSharedSdk();
 				return buildPassiveProbedChannelStatusSummary(snapshot, snapshot.identity === "user" ? {
@@ -1010,8 +1232,7 @@ const slackPlugin = createChatChannelPlugin({
 					...account.identity === "user" ? { identity: "user" } : {}
 				});
 			},
-			formatCapabilitiesProbe: ({ probe }) => {
-				const slackProbe = probe;
+			formatCapabilitiesProbe: ({ probe: slackProbe }) => {
 				const lines = [];
 				if (slackProbe?.warning) lines.push({
 					text: `Warning: ${slackProbe.warning}`,
@@ -1041,10 +1262,12 @@ const slackPlugin = createChatChannelPlugin({
 						ok: false,
 						error: `Slack ${tokenType} token missing.`
 					};
-					lines.push(formatSlackScopeDiagnostic({
-						tokenType,
-						result
-					}));
+					const source = result.source ? ` (${result.source})` : "";
+					const label = tokenType === "user" ? "User scopes" : "Bot scopes";
+					lines.push(result.ok && result.scopes?.length ? { text: `${label}${source}: ${result.scopes.join(", ")}` } : {
+						text: `${label}: ${result.error ?? "scope lookup failed"}`,
+						tone: "error"
+					});
 					details[`${tokenType}Scopes`] = result;
 				}
 				return {
@@ -1090,8 +1313,7 @@ const slackPlugin = createChatChannelPlugin({
 					abortSignal: ctx.abortSignal,
 					mediaMaxMb: account.config.mediaMaxMb,
 					slashCommand: account.config.slashCommand,
-					setStatus: ctx.setStatus,
-					getStatus: ctx.getStatus
+					setStatus: ctx.setStatus
 				});
 			}
 		},
@@ -1161,5 +1383,4 @@ const slackPlugin = createChatChannelPlugin({
 	},
 	outbound: slackChannelOutbound
 });
-//#endregion
 export { buildSlackThreadingToolContext as n, slackPlugin as t };