@openclaw/slack 2026.6.6 → 2026.6.8-beta.2

package/dist/replies-Bt4nWmSd.js

@@ -0,0 +1,285 @@
+import { r as resolveSlackReplyBlocks, s as SLACK_TEXT_LIMIT } from "./thread-ts-Cffag8e2.js";
+import { o as markdownToSlackMrkdwnChunks, t as sendMessageSlack } from "./send-rekB-Xjp.js";
+import { createReplyReferencePlanner } from "openclaw/plugin-sdk/reply-reference";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { SILENT_REPLY_TOKEN, chunkMarkdownTextWithMode, isSilentReplyText } from "openclaw/plugin-sdk/reply-chunking";
+import { deliverTextOrMediaReply, getReplyPayloadTtsSupplement, resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
+import { getGlobalHookRunner } from "openclaw/plugin-sdk/plugin-runtime";
+import { buildCanonicalSentMessageHookContext, createInternalHookEvent, fireAndForgetHook, toInternalMessageSentContext, toPluginMessageContext, toPluginMessageSentEvent, triggerInternalHook } from "openclaw/plugin-sdk/hook-runtime";
+//#region extensions/slack/src/message-sent-hook.ts
+/**
+* Slack-side emission of the `message_sent` plugin hook.
+*
+* Mirrors the Telegram pattern in `extensions/telegram/src/bot/delivery.replies.ts`
+* (`buildTelegramSentHookContext`, `emitMessageSentHooks`, `emitTelegramMessageSentHooks`).
+*
+* Without this, plugins observing `message_sent` see Telegram outbound but not
+* Slack outbound — even though `docs/plugins/hooks.md` documents the hook as
+* firing for all successful outbound deliveries.
+*/
+function buildSlackSentHookContext(params) {
+	return buildCanonicalSentMessageHookContext({
+		to: params.to,
+		content: params.content,
+		success: params.success,
+		error: params.error,
+		channelId: "slack",
+		accountId: params.accountId ?? void 0,
+		conversationId: params.to,
+		sessionKey: params.sessionKeyForInternalHooks,
+		messageId: params.messageId,
+		isGroup: params.isGroup,
+		groupId: params.groupId
+	});
+}
+function emitInternalSlackMessageSentHook(params) {
+	if (!params.sessionKeyForInternalHooks) return;
+	const canonical = buildSlackSentHookContext(params);
+	fireAndForgetHook(triggerInternalHook(createInternalHookEvent("message", "sent", params.sessionKeyForInternalHooks, toInternalMessageSentContext(canonical))), "slack: message:sent internal hook failed");
+}
+function emitMessageSentHooks(params) {
+	if (!params.enabled && !params.sessionKeyForInternalHooks) return;
+	const canonical = buildSlackSentHookContext(params);
+	if (params.enabled) fireAndForgetHook(Promise.resolve(params.hookRunner.runMessageSent(toPluginMessageSentEvent(canonical), toPluginMessageContext(canonical))), "slack: message_sent plugin hook failed");
+	emitInternalSlackMessageSentHook(params);
+}
+/**
+* Fire both the plugin `message_sent` hook and (if a session key is supplied)
+* the internal `message:sent` hook for a successful or failed Slack outbound
+* delivery.
+*
+* Safe to call after every `chat.postMessage` — the function self-gates on
+* `hookRunner.hasHooks("message_sent")` so plugins not observing the hook
+* incur no cost.
+*/
+function emitSlackMessageSentHooks(params) {
+	const hookRunner = getGlobalHookRunner();
+	emitMessageSentHooks({
+		...params,
+		hookRunner,
+		enabled: hookRunner?.hasHooks("message_sent") ?? false
+	});
+}
+//#endregion
+//#region extensions/slack/src/monitor/replies.ts
+function readSlackReplyBlocks(payload) {
+	return resolveSlackReplyBlocks(payload);
+}
+function resolveSlackMediaHookSpokenText(payload) {
+	return (getReplyPayloadTtsSupplement(payload)?.spokenText ?? payload.spokenText)?.trim() || void 0;
+}
+function resolveDeliveredSlackReplyThreadTs(params) {
+	return (params.replyToMode === "off" ? void 0 : params.payloadReplyToId) ?? params.replyThreadTs;
+}
+async function deliverReplies(params) {
+	let latestResult;
+	for (const payload of params.replies) {
+		if (payload.isReasoning === true) continue;
+		const threadTs = resolveDeliveredSlackReplyThreadTs({
+			replyToMode: params.replyToMode,
+			payloadReplyToId: payload.replyToId,
+			replyThreadTs: params.replyThreadTs
+		});
+		const reply = resolveSendableOutboundReplyParts(payload);
+		const slackBlocks = readSlackReplyBlocks(payload);
+		if (!reply.hasContent && !slackBlocks?.length) continue;
+		const emitSent = (content, result) => {
+			if (params.deferMessageSentHooks) return;
+			emitSlackMessageSentHooks({
+				sessionKeyForInternalHooks: params.sessionKeyForInternalHooks,
+				to: params.messageSentHookTarget ?? params.target,
+				accountId: params.accountId,
+				content,
+				success: true,
+				messageId: result?.messageId,
+				isGroup: params.isGroup,
+				groupId: params.groupId
+			});
+		};
+		const emitFailed = (content, error) => {
+			if (params.deferMessageSentHooks) return;
+			emitSlackMessageSentHooks({
+				sessionKeyForInternalHooks: params.sessionKeyForInternalHooks,
+				to: params.messageSentHookTarget ?? params.target,
+				accountId: params.accountId,
+				content,
+				success: false,
+				error: formatErrorMessage(error),
+				isGroup: params.isGroup,
+				groupId: params.groupId
+			});
+		};
+		if (!reply.hasMedia && slackBlocks?.length) {
+			const trimmed = reply.trimmedText;
+			if (!trimmed && !slackBlocks?.length) continue;
+			if (trimmed && isSilentReplyText(trimmed, SILENT_REPLY_TOKEN)) continue;
+			let result;
+			try {
+				result = await sendMessageSlack(params.target, trimmed, {
+					cfg: params.cfg,
+					token: params.token,
+					threadTs,
+					accountId: params.accountId,
+					...slackBlocks?.length ? { blocks: slackBlocks } : {},
+					...params.identity ? { identity: params.identity } : {},
+					...params.metadata ? { metadata: params.metadata } : {}
+				});
+			} catch (error) {
+				emitFailed(trimmed, error);
+				throw error;
+			}
+			emitSent(trimmed, result);
+			latestResult = result;
+			params.runtime.log?.(`delivered reply to ${params.target}`);
+			continue;
+		}
+		const spokenText = resolveSlackMediaHookSpokenText(payload);
+		const mediaHookContent = reply.hasText ? reply.text : spokenText || reply.text;
+		const hookContent = reply.hasMedia ? mediaHookContent : reply.trimmedText;
+		let lastResult;
+		let delivered;
+		try {
+			delivered = await deliverTextOrMediaReply({
+				payload,
+				text: reply.text,
+				chunkText: !reply.hasMedia ? (value) => {
+					const trimmed = value.trim();
+					if (!trimmed || isSilentReplyText(trimmed, SILENT_REPLY_TOKEN)) return [];
+					return [trimmed];
+				} : void 0,
+				sendText: async (trimmed) => {
+					lastResult = await sendMessageSlack(params.target, trimmed, {
+						cfg: params.cfg,
+						token: params.token,
+						threadTs,
+						accountId: params.accountId,
+						...params.identity ? { identity: params.identity } : {},
+						...params.metadata ? { metadata: params.metadata } : {}
+					});
+				},
+				sendMedia: async ({ mediaUrl, caption }) => {
+					lastResult = await sendMessageSlack(params.target, caption ?? "", {
+						cfg: params.cfg,
+						token: params.token,
+						mediaUrl,
+						threadTs,
+						accountId: params.accountId,
+						...params.identity ? { identity: params.identity } : {},
+						...params.metadata ? { metadata: params.metadata } : {}
+					});
+				}
+			});
+		} catch (error) {
+			emitFailed(hookContent, error);
+			throw error;
+		}
+		if (delivered !== "empty") {
+			emitSent(hookContent, reply.hasMedia ? void 0 : lastResult);
+			latestResult = lastResult;
+			params.runtime.log?.(`delivered reply to ${params.target}`);
+		}
+	}
+	return latestResult;
+}
+/**
+* Compute effective threadTs for a Slack reply based on replyToMode.
+* - "off": stay in thread if already in one, otherwise main channel
+* - "first": first reply goes to thread, subsequent replies to main channel
+* - "all": all replies go to thread
+*/
+function resolveSlackThreadTs(params) {
+	return createSlackReplyReferencePlanner({
+		replyToMode: params.replyToMode,
+		incomingThreadTs: params.incomingThreadTs,
+		messageTs: params.messageTs,
+		hasReplied: params.hasReplied,
+		isThreadReply: params.isThreadReply
+	}).use();
+}
+function createSlackReplyReferencePlanner(params) {
+	return createReplyReferencePlanner({
+		replyToMode: params.isThreadReply ?? Boolean(params.incomingThreadTs && params.incomingThreadTs !== params.messageTs) ? "all" : params.replyToMode,
+		existingId: params.incomingThreadTs,
+		startId: params.messageTs,
+		hasReplied: params.hasReplied
+	});
+}
+function createSlackReplyDeliveryPlan(params) {
+	const replyReference = createSlackReplyReferencePlanner({
+		replyToMode: params.replyToMode,
+		incomingThreadTs: params.incomingThreadTs,
+		messageTs: params.messageTs,
+		hasReplied: params.hasRepliedRef.value,
+		isThreadReply: params.isThreadReply
+	});
+	return {
+		peekThreadTs: () => replyReference.peek(),
+		nextThreadTs: () => replyReference.use(),
+		markSent: () => {
+			replyReference.markSent();
+			params.hasRepliedRef.value = replyReference.hasReplied();
+		}
+	};
+}
+async function deliverSlackSlashReplies(params) {
+	const deliveries = [];
+	const chunkLimit = Math.min(params.textLimit, SLACK_TEXT_LIMIT);
+	for (const payload of params.replies) {
+		if (payload.isReasoning === true) continue;
+		const reply = resolveSendableOutboundReplyParts(payload);
+		const slackBlocks = readSlackReplyBlocks(payload);
+		const text = reply.hasText && !isSilentReplyText(reply.trimmedText, SILENT_REPLY_TOKEN) ? reply.trimmedText : void 0;
+		if (slackBlocks?.length && !reply.hasMedia) {
+			deliveries.push({
+				hookContent: text ?? "",
+				messages: [{
+					text: text ?? "",
+					blocks: slackBlocks
+				}]
+			});
+			continue;
+		}
+		const combined = [text ?? "", ...reply.mediaUrls].filter(Boolean).join("\n");
+		if (!combined) continue;
+		const chunkMode = params.chunkMode ?? "length";
+		const chunks = (chunkMode === "newline" ? chunkMarkdownTextWithMode(combined, chunkLimit, chunkMode) : [combined]).flatMap((markdown) => markdownToSlackMrkdwnChunks(markdown, chunkLimit, { tableMode: params.tableMode }));
+		if (!chunks.length && combined) chunks.push(combined);
+		deliveries.push({
+			hookContent: text ?? resolveSlackMediaHookSpokenText(payload) ?? combined,
+			messages: chunks.map((chunk) => ({ text: chunk }))
+		});
+	}
+	if (deliveries.length === 0) return;
+	const responseType = params.ephemeral ? "ephemeral" : "in_channel";
+	for (const delivery of deliveries) {
+		try {
+			for (const message of delivery.messages) await params.respond({
+				...message,
+				response_type: responseType
+			});
+		} catch (error) {
+			if (params.messageSentHookTarget) emitSlackMessageSentHooks({
+				sessionKeyForInternalHooks: params.sessionKeyForInternalHooks,
+				to: params.messageSentHookTarget,
+				accountId: params.accountId,
+				content: delivery.hookContent,
+				success: false,
+				error: formatErrorMessage(error),
+				isGroup: params.isGroup,
+				groupId: params.groupId
+			});
+			throw error;
+		}
+		if (params.messageSentHookTarget) emitSlackMessageSentHooks({
+			sessionKeyForInternalHooks: params.sessionKeyForInternalHooks,
+			to: params.messageSentHookTarget,
+			accountId: params.accountId,
+			content: delivery.hookContent,
+			success: true,
+			isGroup: params.isGroup,
+			groupId: params.groupId
+		});
+	}
+}
+//#endregion
+export { resolveDeliveredSlackReplyThreadTs as a, readSlackReplyBlocks as i, deliverReplies as n, resolveSlackThreadTs as o, deliverSlackSlashReplies as r, emitSlackMessageSentHooks as s, createSlackReplyDeliveryPlan as t };

package/dist/runtime-api.js

@@ -7,8 +7,8 @@ import { a as listSlackEmojis, c as pinSlackMessage, d as removeOwnSlackReaction
 import { t as probeSlack } from "./probe-BTKzLT2u.js";
 import { t as resolveSlackChannelAllowlist } from "./resolve-channels-DX2GSx9c.js";
 import { t as resolveSlackUserAllowlist } from "./resolve-users-DOULgUwy.js";
-import { t as monitorSlackProvider } from "./provider-LH_j-bLA.js";
+import { t as monitorSlackProvider } from "./provider-ChhYGpXx.js";
 import { n as slackActionRuntime, t as handleSlackAction } from "./action-runtime-CgrHdqkC.js";
 import { n as listSlackDirectoryGroupsLive, r as listSlackDirectoryPeersLive } from "./directory-live-C1acgXKJ.js";
-import "./monitor-Szm2LjsM.js";
+import "./monitor-DwDmBYfl.js";
 export { deleteSlackMessage, editSlackMessage, getSlackMemberInfo, handleSlackAction, listEnabledSlackAccounts, listSlackAccountIds, listSlackDirectoryGroupsLive, listSlackDirectoryPeersLive, listSlackEmojis, listSlackPins, listSlackReactions, monitorSlackProvider, pinSlackMessage, probeSlack, reactSlackMessage, readSlackMessages, registerSlackPluginHttpRoutes, removeOwnSlackReactions, removeSlackReaction, resolveDefaultSlackAccountId, resolveSlackAccount, resolveSlackAppToken, resolveSlackBotToken, resolveSlackChannelAllowlist, resolveSlackGroupRequireMention, resolveSlackGroupToolPolicy, resolveSlackUserAllowlist, sendMessageSlack, sendSlackMessage, setSlackRuntime, slackActionRuntime, unpinSlackMessage };

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as slackSetupPlugin } from "./channel.setup-DrCTObMp.js";
+import { t as slackSetupPlugin } from "./channel.setup-W5YnieWd.js";
 export { slackSetupPlugin };

package/dist/{setup-surface-BB_ivsoR.js → setup-surface-NNMjGpXc.js}

@@ -1,5 +1,5 @@
 import { a as resolveSlackAccount, i as resolveDefaultSlackAccountId, o as resolveSlackAccountAllowFrom } from "./accounts-f6Xcv9Vi.js";
-import "./shared-Bviszgb6.js";
+import "./shared-Bkkmro6q.js";
 import { i as SLACK_CHANNEL, t as createSlackSetupWizardBase } from "./setup-core-POfI_bgP.js";
 import { t as resolveSlackChannelAllowlist } from "./resolve-channels-DX2GSx9c.js";
 import { t as resolveSlackUserAllowlist } from "./resolve-users-DOULgUwy.js";

package/dist/{shared-Bviszgb6.js → shared-Bkkmro6q.js}

@@ -1,4 +1,4 @@
-import { a as resolveSlackAccount, c as resolveSlackConfigAccessorAccount, i as resolveDefaultSlackAccountId, n as listSlackAccountIds, o as resolveSlackAccountAllowFrom, s as resolveSlackAccountDmPolicy } from "./accounts-f6Xcv9Vi.js";
+import { a as resolveSlackAccount, c as resolveSlackConfigAccessorAccount, i as resolveDefaultSlackAccountId, n as listSlackAccountIds, o as resolveSlackAccountAllowFrom, r as mergeSlackAccountConfig, s as resolveSlackAccountDmPolicy } from "./accounts-f6Xcv9Vi.js";
 import { t as inspectSlackAccount } from "./account-inspect-CdGk6R7l.js";
 import { f as getChatChannelMeta, h as isSlackPluginAccountConfigured } from "./client-Cn2WwpcA.js";
 import { n as isSlackInteractiveRepliesEnabled } from "./interactive-replies-DrBq4Mld.js";
@@ -71,6 +71,92 @@ function isSlackMutableAllowEntry(raw) {
 function asObjectRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+const collectSlackMutableAllowlistWarnings = createDangerousNameMatchingMutableAllowlistWarningCollector({
+	channel: "slack",
+	detector: isSlackMutableAllowEntry,
+	collectLists: (scope) => {
+		const lists = [{
+			pathLabel: `${scope.prefix}.allowFrom`,
+			list: scope.account.allowFrom
+		}];
+		const dm = asObjectRecord(scope.account.dm);
+		if (dm) lists.push({
+			pathLabel: `${scope.prefix}.dm.allowFrom`,
+			list: dm.allowFrom
+		});
+		const channels = asObjectRecord(scope.account.channels);
+		if (channels) for (const [channelKey, channelRaw] of Object.entries(channels)) {
+			const channel = asObjectRecord(channelRaw);
+			if (!channel) continue;
+			lists.push({
+				pathLabel: `${scope.prefix}.channels.${channelKey}.users`,
+				list: channel.users
+			});
+		}
+		return lists;
+	}
+});
+const SLACK_CANONICAL_CHANNEL_ID_RE = /^[CG][A-Z0-9]{8,}$/;
+const SLACK_LOWERCASE_CHANNEL_ID_RE = /^[cg][0-9][a-z0-9]{7,}$/;
+const SLACK_PREFIXED_CANONICAL_CHANNEL_ID_RE = /^channel:[CG][A-Z0-9]{8,}$/;
+const SLACK_PREFIXED_LOWERCASE_CHANNEL_ID_RE = /^channel:[cg][0-9][a-z0-9]{7,}$/;
+const SLACK_CANONICAL_DM_ID_RE = /^(?:channel:)?D[A-Z0-9]{8,}$/;
+const SLACK_PREFIXED_LOWERCASE_DM_ID_RE = /^channel:d[a-z0-9]{8,}$/;
+const SLACK_AMBIGUOUS_LOWERCASE_DM_ID_RE = /^d[a-z0-9]{8,}$/;
+const SLACK_AMBIGUOUS_LOWERCASE_CHANNEL_ID_RE = /^(?:channel:)?[cgd][a-z][a-z0-9]{7,}$/;
+const SLACK_CHANNEL_NAME_RE = /^[\p{L}\p{M}\p{N}_-]{1,80}$/u;
+const SLACK_CHANNEL_NAME_ALPHANUMERIC_RE = /[\p{L}\p{N}]/u;
+function looksLikeSlackChannelId(channelKey) {
+	return SLACK_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_LOWERCASE_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_CHANNEL_ID_RE.test(channelKey);
+}
+function looksLikeSlackDmId(channelKey) {
+	return SLACK_CANONICAL_DM_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_DM_ID_RE.test(channelKey);
+}
+function looksLikeSlackChannelNameKey(channelKey) {
+	const name = channelKey.startsWith("#") ? channelKey.slice(1) : channelKey;
+	return name === name.toLowerCase() && SLACK_CHANNEL_NAME_RE.test(name) && SLACK_CHANNEL_NAME_ALPHANUMERIC_RE.test(name);
+}
+function collectSlackNameKeyedChannelWarnings({ cfg }) {
+	const warnings = /* @__PURE__ */ new Set();
+	const slackCfg = asObjectRecord(asObjectRecord(cfg.channels)?.slack);
+	const providerChannels = asObjectRecord(slackCfg?.channels);
+	const accounts = asObjectRecord(slackCfg?.accounts);
+	for (const accountId of listSlackAccountIds(cfg)) {
+		const account = asObjectRecord(mergeSlackAccountConfig(cfg, accountId));
+		if (!account || slackCfg?.enabled === false || account.enabled === false) continue;
+		const effectiveGroupPolicy = (typeof account.groupPolicy === "string" ? account.groupPolicy : void 0) ?? "allowlist";
+		const rawAccount = asObjectRecord(accounts?.[accountId]);
+		const accountPrefix = rawAccount ? `channels.slack.accounts.${accountId}` : "channels.slack";
+		const accountChannels = asObjectRecord(rawAccount?.channels);
+		const channels = accountChannels ?? providerChannels;
+		if (!channels) continue;
+		const channelsPrefix = accountChannels ? `channels.slack.accounts.${accountId}` : "channels.slack";
+		const fallbackDescription = Object.hasOwn(channels, "*") ? `${channelsPrefix}.channels."*" applies instead and this entry's overrides are ignored` : effectiveGroupPolicy === "open" ? "this entry's overrides are ignored and the channel remains allowed by groupPolicy: \"open\"" : "messages from the channel are dropped";
+		for (const channelKey of Object.keys(channels)) {
+			if (channelKey === "*") continue;
+			if (looksLikeSlackDmId(channelKey)) {
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is a Slack DM conversation ID, but ${channelsPrefix}.channels only configures channel and group rooms. Configure DM access with ${accountPrefix}.dmPolicy and ${accountPrefix}.allowFrom instead.`);
+				continue;
+			}
+			if (SLACK_AMBIGUOUS_LOWERCASE_DM_ID_RE.test(channelKey)) {
+				if (account.dangerouslyAllowNameMatching === true && looksLikeSlackChannelNameKey(channelKey)) continue;
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is ambiguous: it may be a lowercase Slack DM conversation ID or a channel name. Configure DMs with ${accountPrefix}.dmPolicy and ${accountPrefix}.allowFrom; otherwise re-key the room with its stable C/G ID.`);
+				continue;
+			}
+			if (effectiveGroupPolicy === "disabled") continue;
+			const channelConfig = asObjectRecord(channels[channelKey]);
+			if (effectiveGroupPolicy === "open" && Object.keys(channelConfig ?? {}).length === 0) continue;
+			if (looksLikeSlackChannelId(channelKey)) continue;
+			if (account.dangerouslyAllowNameMatching === true && looksLikeSlackChannelNameKey(channelKey)) continue;
+			if (SLACK_AMBIGUOUS_LOWERCASE_CHANNEL_ID_RE.test(channelKey)) {
+				warnings.add(`${channelsPrefix}.channels."${channelKey}" is ambiguous: it may be a lowercase Slack channel ID or a channel name. If it is a channel name, inbound routing will not match it and ${fallbackDescription}. Re-key it with the channel's stable ID (e.g. C0123ABCD, from the channel's About details or conversations.info).`);
+				continue;
+			}
+			warnings.add(`${channelsPrefix}.channels."${channelKey}" is keyed by a channel name or non-canonical ID form, not a routable Slack channel ID; under groupPolicy: "${effectiveGroupPolicy}" inbound routing does not match this entry, so ${fallbackDescription}. Re-key it with the channel's ID (e.g. C0123ABCD, from the channel's About details or conversations.info).`);
+		}
+	}
+	return [...warnings];
+}
 const slackDoctor = {
 	dmAllowFromMode: "topOnly",
 	groupModel: "route",
@@ -78,31 +164,7 @@ const slackDoctor = {
 	warnOnEmptyGroupSenderAllowlist: false,
 	legacyConfigRules,
 	normalizeCompatibilityConfig,
-	collectMutableAllowlistWarnings: createDangerousNameMatchingMutableAllowlistWarningCollector({
-		channel: "slack",
-		detector: isSlackMutableAllowEntry,
-		collectLists: (scope) => {
-			const lists = [{
-				pathLabel: `${scope.prefix}.allowFrom`,
-				list: scope.account.allowFrom
-			}];
-			const dm = asObjectRecord(scope.account.dm);
-			if (dm) lists.push({
-				pathLabel: `${scope.prefix}.dm.allowFrom`,
-				list: dm.allowFrom
-			});
-			const channels = asObjectRecord(scope.account.channels);
-			if (channels) for (const [channelKey, channelRaw] of Object.entries(channels)) {
-				const channel = asObjectRecord(channelRaw);
-				if (!channel) continue;
-				lists.push({
-					pathLabel: `${scope.prefix}.channels.${channelKey}.users`,
-					list: channel.users
-				});
-			}
-			return lists;
-		}
-	})
+	collectMutableAllowlistWarnings: ({ cfg }) => [...collectSlackMutableAllowlistWarnings({ cfg }), ...collectSlackNameKeyedChannelWarnings({ cfg })]
 };
 //#endregion
 //#region extensions/slack/src/shared.ts

package/dist/{slash-dispatch.runtime-CoFAysiw.js → slash-dispatch.runtime-Dvvs747S.js}

@@ -1,4 +1,4 @@
-import { r as deliverSlackSlashReplies$1 } from "./replies-FEOdgSlE.js";
+import { r as deliverSlackSlashReplies$1 } from "./replies-Bt4nWmSd.js";
 import { resolveAgentRoute as resolveAgentRoute$1 } from "openclaw/plugin-sdk/routing";
 import { resolveMarkdownTableMode as resolveMarkdownTableMode$1 } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { recordInboundSessionMetaSafe as recordInboundSessionMetaSafe$1, resolveConversationLabel as resolveConversationLabel$1 } from "openclaw/plugin-sdk/conversation-runtime";

package/node_modules/form-data/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v4.0.5](https://github.com/form-data/form-data/compare/v4.0.4...v4.0.5) - 2025-11-17
+
+### Commits
+
+- [Tests] Switch to newer v8 prediction library; enable node 24 testing [`16e0076`](https://github.com/form-data/form-data/commit/16e00765342106876f98a1c9703314006c9e937a)
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint` [`5822467`](https://github.com/form-data/form-data/commit/5822467f0ec21f6ad613c1c90856375e498793c7)
+- [Fix] set Symbol.toStringTag in the proper place [`76d0dee`](https://github.com/form-data/form-data/commit/76d0dee43933b5e167f7f09e5d9cbbd1cf911aa7)
+
 ## [v4.0.4](https://github.com/form-data/form-data/compare/v4.0.3...v4.0.4) - 2025-07-16
 
 ### Commits
@@ -158,7 +166,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - feat: add setBoundary method [`55d90ce`](https://github.com/form-data/form-data/commit/55d90ce4a4c22b0ea0647991d85cb946dfb7395b)
 
-## [v3.0.0](https://github.com/form-data/form-data/compare/v2.5.4...v3.0.0) - 2019-11-05
+## [v3.0.0](https://github.com/form-data/form-data/compare/v2.5.6...v3.0.0) - 2019-11-05
 
 ### Merged
 
@@ -182,6 +190,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Pass options to constructor if not used with new [`4bde68e`](https://github.com/form-data/form-data/commit/4bde68e12de1ba90fefad2e7e643f6375b902763)
 - Make userHeaders optional [`2b4e478`](https://github.com/form-data/form-data/commit/2b4e4787031490942f2d1ee55c56b85a250875a7)
 
+## [v2.5.6](https://github.com/form-data/form-data/compare/v2.5.5...v2.5.6) - 2026-06-12
+
+### Commits
+
+- [Fix] escape CR, LF, and `"` in field names and filenames [`b620316`](https://github.com/form-data/form-data/commit/b62031603c2d7c329b2a369b49466790f0ba6314)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `tape` [`12be578`](https://github.com/form-data/form-data/commit/12be578e936fd77eee75e2e656955f5343c4b80f)
+- [Dev Deps] update `js-randomness-predictor` [`46cfd23`](https://github.com/form-data/form-data/commit/46cfd23bd40be14cfa0391e1c5357c4d74098f23)
+- [Tests] use `safe-buffer` so the header-injection test runs on node < 4 [`633044a`](https://github.com/form-data/form-data/commit/633044a57a7b19f41cec2271ffd24afa2f6280af)
+- [Deps] update `hasown` [`e3b96ee`](https://github.com/form-data/form-data/commit/e3b96eef1661bca8ea4297de057b78bf2734e900)
+
+## [v2.5.5](https://github.com/form-data/form-data/compare/v2.5.4...v2.5.5) - 2025-07-18
+
+### Commits
+
+- [meta] actually ensure the readme backup isn’t published [`10626c0`](https://github.com/form-data/form-data/commit/10626c0a9b78c7d3fcaa51772265015ee0afc25c)
+- [Fix] use proper dependency [`026abe5`](https://github.com/form-data/form-data/commit/026abe5c5c0489d8a2ccb59d5cfd14fb63078377)
+
 ## [v2.5.4](https://github.com/form-data/form-data/compare/v2.5.3...v2.5.4) - 2025-07-17
 
 ### Fixed

package/node_modules/form-data/README.md

@@ -6,11 +6,11 @@ The API of this library is inspired by the [XMLHttpRequest-2 FormData Interface]
 
 [xhr2-fd]: http://dev.w3.org/2006/webapi/XMLHttpRequest-2/Overview.html#the-formdata-interface
 
-[![Linux Build](https://img.shields.io/travis/form-data/form-data/v2.5.4.svg?label=linux:4.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v2.5.4.svg?label=macos:4.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![Windows Build](https://img.shields.io/travis/form-data/form-data/v2.5.4.svg?label=windows:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Linux Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=linux:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=macos:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Windows Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=windows:4.x-12.x)](https://travis-ci.org/form-data/form-data)
 
-[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v2.5.4.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
+[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v2.5.6.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
 [![Dependency Status](https://img.shields.io/david/form-data/form-data.svg)](https://david-dm.org/form-data/form-data)
 
 ## Install

package/node_modules/form-data/lib/form_data.js

@@ -15,6 +15,11 @@ var setToStringTag = require('es-set-tostringtag');
 var populate = require('./populate.js');
 var Buffer = require('safe-buffer').Buffer;
 
+// escape CR/LF/`"` so a name/filename can't inject headers or smuggle parts; matches the WHATWG HTML multipart/form-data encoding
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -190,7 +195,7 @@ FormData.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || []),
   };
@@ -245,7 +250,7 @@ FormData.prototype._getContentDisposition = function (value, options) {
   }
 
   if (filename) {
-    contentDisposition = 'filename="' + filename + '"';
+    contentDisposition = 'filename="' + escapeHeaderParam(filename) + '"';
   }
 
   return contentDisposition;

package/node_modules/form-data/package.json

@@ -2,7 +2,7 @@
   "author": "Felix Geisendörfer <felix@debuggable.com> (http://debuggable.com/)",
   "name": "form-data",
   "description": "A library to create readable \"multipart/form-data\" streams. Can be used to submit forms and file uploads to other web applications.",
-  "version": "2.5.4",
+  "version": "2.5.6",
   "repository": {
     "type": "git",
     "url": "git://github.com/form-data/form-data.git"
@@ -27,10 +27,11 @@
     "files": "pkgfiles --sort=name",
     "get-version": "node -e \"console.log(require('./package.json').version)\"",
     "update-readme": "sed -i.bak 's/\\/master\\.svg/\\/v'$(npm --silent run get-version)'.svg/g' README.md",
-    "restore-readme": "mv README.md.bak README.md",
+    "postupdate-readme": "mv README.md.bak READ.ME.md.bak",
+    "restore-readme": "mv READ.ME.md.bak README.md",
     "prepublish": "not-in-publish || npm run prepublishOnly",
-    "prepublishOnly": "npm run update-readme",
-    "postpublish": "npm run restore-readme",
+    "prepack": "npm run update-readme",
+    "postpack": "npm run restore-readme",
     "version": "auto-changelog && git add CHANGELOG.md",
     "postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""
   },
@@ -41,25 +42,25 @@
     "asynckit": "^0.4.0",
     "combined-stream": "^1.0.8",
     "es-set-tostringtag": "^2.1.0",
-    "has-own": "^1.0.1",
+    "hasown": "^2.0.4",
     "mime-types": "^2.1.35",
     "safe-buffer": "^5.2.1"
   },
   "devDependencies": {
-    "@ljharb/eslint-config": "^21.2.0",
-    "auto-changelog": "^2.5.0",
+    "@ljharb/eslint-config": "^22.2.3",
+    "auto-changelog": "^2.6.0",
     "browserify": "^13.3.0",
     "browserify-istanbul": "^2.0.0",
     "coveralls": "^3.1.1",
     "cross-spawn": "^4.0.2",
     "encoding": "^0.1.13",
-    "eslint": "=8.8.0",
+    "eslint": "^8.57.1",
     "fake": "^0.2.2",
     "far": "^0.0.7",
     "formidable": "^1.2.6",
     "in-publish": "^2.0.1",
     "istanbul": "^0.4.5",
-    "js-randomness-predictor": "^1.5.5",
+    "js-randomness-predictor": "^3.6.0",
     "obake": "^0.1.2",
     "phantomjs-prebuilt": "^2.1.16",
     "pkgfiles": "^2.3.2",
@@ -68,7 +69,7 @@
     "request": "~2.87.0",
     "rimraf": "^2.7.1",
     "semver": "^6.3.1",
-    "tape": "^5.9.0"
+    "tape": "^5.10.1"
   },
   "license": "MIT",
   "auto-changelog": {