@openclaw/slack 2026.5.12-beta.7

package/dist/runtime-Bo-KHM-F.js

@@ -0,0 +1,8 @@
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+//#region extensions/slack/src/runtime.ts
+const { setRuntime: setSlackRuntime, clearRuntime: clearSlackRuntime, tryGetRuntime: getOptionalSlackRuntime } = createPluginRuntimeStore({
+	pluginId: "slack",
+	errorMessage: "Slack runtime not initialized"
+});
+//#endregion
+export { setSlackRuntime as n, getOptionalSlackRuntime as t };

package/dist/runtime-api-Dd1xIV5v.js

@@ -0,0 +1,9 @@
+import "./target-parsing-CQmv-iSm.js";
+import "./channel-api-B_nZwosg.js";
+import "./config-api-B_jq4NJW.js";
+import { createActionGate as createActionGate$1, imageResultFromFile, jsonResult, readNumberParam, readReactionParams, readStringParam, withNormalizedTimestamp } from "openclaw/plugin-sdk/channel-actions";
+import "openclaw/plugin-sdk/account-id";
+import "openclaw/plugin-sdk/channel-status";
+import "openclaw/plugin-sdk/channel-plugin-common";
+import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
+export { readNumberParam as a, withNormalizedTimestamp as c, loadOutboundMediaFromUrl as i, imageResultFromFile as n, readReactionParams as o, jsonResult as r, readStringParam as s, createActionGate$1 as t };

package/dist/runtime-api.js

@@ -0,0 +1,14 @@
+import { a as resolveSlackAccount, d as resolveSlackBotToken, i as resolveDefaultSlackAccountId, n as listSlackAccountIds, t as listEnabledSlackAccounts, u as resolveSlackAppToken } from "./accounts-ClAPP5ry.js";
+import { n as resolveSlackGroupToolPolicy, t as resolveSlackGroupRequireMention } from "./group-policy-CyLUK6My.js";
+import { n as setSlackRuntime } from "./runtime-Bo-KHM-F.js";
+import { t as sendMessageSlack } from "./send-D_A9kL-C.js";
+import { a as listSlackEmojis, c as pinSlackMessage, d as removeOwnSlackReactions, f as removeSlackReaction, i as getSlackMemberInfo, l as reactSlackMessage, m as unpinSlackMessage, o as listSlackPins, p as sendSlackMessage, r as editSlackMessage, s as listSlackReactions, t as deleteSlackMessage, u as readSlackMessages } from "./actions-CYLFK-Zy.js";
+import { t as probeSlack } from "./probe-3eZf1FjI.js";
+import { t as resolveSlackChannelAllowlist } from "./resolve-channels-BRYqyNVJ.js";
+import { t as resolveSlackUserAllowlist } from "./resolve-users-Bd_SdP8j.js";
+import { t as monitorSlackProvider } from "./provider-D7uAN3Fq.js";
+import { t as registerSlackPluginHttpRoutes } from "./plugin-routes-DtTPmga1.js";
+import { n as slackActionRuntime, t as handleSlackAction } from "./action-runtime-e2UhRsNx.js";
+import { n as listSlackDirectoryGroupsLive, r as listSlackDirectoryPeersLive } from "./directory-live-Bf16GwDh.js";
+import "./monitor-a97o17G6.js";
+export { deleteSlackMessage, editSlackMessage, getSlackMemberInfo, handleSlackAction, listEnabledSlackAccounts, listSlackAccountIds, listSlackDirectoryGroupsLive, listSlackDirectoryPeersLive, listSlackEmojis, listSlackPins, listSlackReactions, monitorSlackProvider, pinSlackMessage, probeSlack, reactSlackMessage, readSlackMessages, registerSlackPluginHttpRoutes, removeOwnSlackReactions, removeSlackReaction, resolveDefaultSlackAccountId, resolveSlackAccount, resolveSlackAppToken, resolveSlackBotToken, resolveSlackChannelAllowlist, resolveSlackGroupRequireMention, resolveSlackGroupToolPolicy, resolveSlackUserAllowlist, sendMessageSlack, sendSlackMessage, setSlackRuntime, slackActionRuntime, unpinSlackMessage };

package/dist/runtime-setter-api.js

@@ -0,0 +1,2 @@
+import { n as setSlackRuntime } from "./runtime-Bo-KHM-F.js";
+export { setSlackRuntime };

package/dist/scopes-CDevO8jg.js

@@ -0,0 +1,74 @@
+import { r as createSlackWebClient } from "./client-CPe4GmDR.js";
+import { t as formatSlackError } from "./errors-BYFHR24f.js";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/slack/src/scopes.ts
+function collectScopes(value, into) {
+	if (!value) return;
+	if (Array.isArray(value)) {
+		for (const entry of value) if (typeof entry === "string" && entry.trim()) into.push(entry.trim());
+		return;
+	}
+	if (typeof value === "string") {
+		const raw = value.trim();
+		if (!raw) return;
+		const parts = raw.split(/[,\s]+/).map((part) => part.trim());
+		for (const part of parts) if (part) into.push(part);
+		return;
+	}
+	if (!isRecord(value)) return;
+	for (const entry of Object.values(value)) if (Array.isArray(entry) || typeof entry === "string") collectScopes(entry, into);
+}
+function normalizeScopes(scopes) {
+	return Array.from(new Set(scopes.map((scope) => scope.trim()).filter(Boolean))).toSorted();
+}
+function extractScopes(payload) {
+	if (!isRecord(payload)) return [];
+	const scopes = [];
+	collectScopes(payload.scopes, scopes);
+	collectScopes(payload.scope, scopes);
+	if (isRecord(payload.response_metadata)) collectScopes(payload.response_metadata.scopes, scopes);
+	if (isRecord(payload.info)) {
+		collectScopes(payload.info.scopes, scopes);
+		collectScopes(payload.info.scope, scopes);
+		collectScopes(payload.info.user_scopes, scopes);
+		collectScopes(payload.info.bot_scopes, scopes);
+	}
+	return normalizeScopes(scopes);
+}
+async function callSlack(client, method) {
+	try {
+		const result = await client.apiCall(method);
+		return isRecord(result) ? result : null;
+	} catch (err) {
+		return {
+			ok: false,
+			error: formatSlackError(err)
+		};
+	}
+}
+async function fetchSlackScopes(token, timeoutMs) {
+	const client = createSlackWebClient(token, { timeout: timeoutMs });
+	const attempts = [
+		"auth.test",
+		"auth.scopes",
+		"apps.permissions.info"
+	];
+	const errors = [];
+	for (const method of attempts) {
+		const result = await callSlack(client, method);
+		const scopes = extractScopes(result);
+		if (scopes.length > 0) return {
+			ok: true,
+			scopes,
+			source: method
+		};
+		const error = isRecord(result) ? normalizeOptionalString(result.error) : void 0;
+		if (error) errors.push(`${method}: ${error}`);
+	}
+	return {
+		ok: false,
+		error: errors.length > 0 ? errors.join(" | ") : "no scopes returned"
+	};
+}
+//#endregion
+export { fetchSlackScopes };

package/dist/secret-contract-Bo6lbSkh.js

@@ -0,0 +1,141 @@
+import { collectConditionalChannelFieldAssignments, collectSimpleChannelFieldAssignments, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/slack/src/secret-contract.ts
+const secretTargetRegistryEntries = [
+	{
+		id: "channels.slack.accounts.*.appToken",
+		targetType: "channels.slack.accounts.*.appToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.accounts.*.appToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.accounts.*.botToken",
+		targetType: "channels.slack.accounts.*.botToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.accounts.*.botToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.accounts.*.signingSecret",
+		targetType: "channels.slack.accounts.*.signingSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.accounts.*.signingSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.accounts.*.userToken",
+		targetType: "channels.slack.accounts.*.userToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.accounts.*.userToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.appToken",
+		targetType: "channels.slack.appToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.appToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.botToken",
+		targetType: "channels.slack.botToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.botToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.signingSecret",
+		targetType: "channels.slack.signingSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.signingSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.slack.userToken",
+		targetType: "channels.slack.userToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.slack.userToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	}
+];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "slack");
+	if (!resolved) return;
+	const { channel: slack, surface } = resolved;
+	const baseMode = slack.mode === "http" || slack.mode === "socket" ? slack.mode : "socket";
+	for (const field of ["botToken", "userToken"]) collectSimpleChannelFieldAssignments({
+		channelKey: "slack",
+		field,
+		channel: slack,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topInactiveReason: `no enabled account inherits this top-level Slack ${field}.`,
+		accountInactiveReason: "Slack account is disabled."
+	});
+	const resolveAccountMode = (account) => account.mode === "http" || account.mode === "socket" ? account.mode : baseMode;
+	collectConditionalChannelFieldAssignments({
+		channelKey: "slack",
+		field: "appToken",
+		channel: slack,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: baseMode !== "http",
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "appToken") && resolveAccountMode(account) !== "http",
+		accountActive: ({ account, enabled }) => enabled && resolveAccountMode(account) !== "http",
+		topInactiveReason: "no enabled Slack socket-mode surface inherits this top-level appToken.",
+		accountInactiveReason: "Slack account is disabled or not running in socket mode."
+	});
+	collectConditionalChannelFieldAssignments({
+		channelKey: "slack",
+		field: "signingSecret",
+		channel: slack,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: baseMode === "http",
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "signingSecret") && resolveAccountMode(account) === "http",
+		accountActive: ({ account, enabled }) => enabled && resolveAccountMode(account) === "http",
+		topInactiveReason: "no enabled Slack HTTP-mode surface inherits this top-level signingSecret.",
+		accountInactiveReason: "Slack account is disabled or not running in HTTP mode."
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Bo6lbSkh.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/security-audit-BtHGnD3d.js

@@ -0,0 +1,51 @@
+import { t as __exportAll } from "./rolldown-runtime-CiIaOW0V.js";
+import { coerceNativeSetting, normalizeAllowFromList } from "openclaw/plugin-sdk/channel-policy";
+import { readChannelAllowFromStore } from "openclaw/plugin-sdk/conversation-runtime";
+import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "openclaw/plugin-sdk/native-command-config-runtime";
+//#region extensions/slack/src/security-audit.ts
+var security_audit_exports = /* @__PURE__ */ __exportAll({ collectSlackSecurityAuditFindings: () => collectSlackSecurityAuditFindings });
+async function collectSlackSecurityAuditFindings(params) {
+	const findings = [];
+	const slackCfg = params.account.config ?? {};
+	const accountId = params.accountId?.trim() || params.account.accountId || "default";
+	if (!(slackCfg.slashCommand?.enabled === true || resolveNativeCommandsEnabled({
+		providerId: "slack",
+		providerSetting: coerceNativeSetting(slackCfg.commands?.native),
+		globalSetting: params.cfg.commands?.native
+	}) || resolveNativeSkillsEnabled({
+		providerId: "slack",
+		providerSetting: coerceNativeSetting(slackCfg.commands?.nativeSkills),
+		globalSetting: params.cfg.commands?.nativeSkills
+	}))) return findings;
+	if (!(params.cfg.commands?.useAccessGroups !== false)) {
+		findings.push({
+			checkId: "channels.slack.commands.slash.useAccessGroups_off",
+			severity: "critical",
+			title: "Slack slash commands bypass access groups",
+			detail: "Slack slash/native commands are enabled while commands.useAccessGroups=false; this can allow unrestricted /… command execution from channels/users you didn't explicitly authorize.",
+			remediation: "Set commands.useAccessGroups=true (recommended)."
+		});
+		return findings;
+	}
+	const allowFromRaw = slackCfg.allowFrom;
+	const legacyAllowFromRaw = params.account.dm?.allowFrom;
+	const allowFrom = Array.isArray(allowFromRaw) ? allowFromRaw : Array.isArray(legacyAllowFromRaw) ? legacyAllowFromRaw : [];
+	const storeAllowFrom = await readChannelAllowFromStore("slack", process.env, accountId).catch(() => []);
+	const ownerAllowFromConfigured = normalizeAllowFromList([...allowFrom, ...storeAllowFrom]).length > 0;
+	const channels = slackCfg.channels ?? {};
+	const hasAnyChannelUsersAllowlist = Object.values(channels).some((value) => {
+		if (!value || typeof value !== "object") return false;
+		const channel = value;
+		return Array.isArray(channel.users) && channel.users.length > 0;
+	});
+	if (!ownerAllowFromConfigured && !hasAnyChannelUsersAllowlist) findings.push({
+		checkId: "channels.slack.commands.slash.no_allowlists",
+		severity: "warn",
+		title: "Slack slash commands have no allowlists",
+		detail: "Slack slash/native commands are enabled, but neither an owner allowFrom list nor any channels.<id>.users allowlist is configured; /… commands will be rejected for everyone.",
+		remediation: "Approve yourself via pairing (recommended), or set channels.slack.allowFrom and/or channels.slack.channels.<id>.users."
+	});
+	return findings;
+}
+//#endregion
+export { security_audit_exports as n, collectSlackSecurityAuditFindings as t };

package/dist/security-contract-api.js

@@ -0,0 +1,2 @@
+import { t as collectSlackSecurityAuditFindings } from "./security-audit-BtHGnD3d.js";
+export { collectSlackSecurityAuditFindings };