@openclaw/slack 2026.7.1-beta.6 → 2026.7.2-beta.1

package/dist/{provider-C1-DFSpw.js → provider-Ds-y-imP.js}

@@ -1,13 +1,13 @@
 import { n as registerSlackHttpHandler, r as normalizeSlackWebhookPath } from "./registry-bbjH7IHX.js";
-import { a as resolveSlackAccount, d as formatSlackBotTokenIdentityWarning, f as resolveSlackAppToken, o as resolveSlackAccountAllowFrom, p as resolveSlackBotToken, s as resolveSlackAccountDmPolicy } from "./accounts-BOJJiHSr.js";
-import { B as isSlackExecApprovalAuthorizedSender, D as isSlackAnyNativeApprovalClientEnabled, R as isSlackApprovalAuthorizedSender, a as SLACK_TEXT_LIMIT, b as truncateSlackText, c as formatSlackError, d as normalizeAllowListLower, f as normalizeSlackAllowOwnerEntry, l as allowListMatches, m as resolveSlackAllowListMatch, p as normalizeSlackSlug, u as normalizeAllowList } from "./reply-blocks-BGQ6zSqM.js";
-import { n as isSlackInteractiveRepliesEnabled, t as compileSlackInteractiveReplies } from "./interactive-replies-CXpT-vA_.js";
-import { c as resolveSlackWebClientOptions } from "./client-DGxwSL7f.js";
-import { t as getOptionalSlackRuntime } from "./runtime-BOk7xkOl.js";
-import { i as setSlackDefaultSendIdentity } from "./send-DKDXoeoV.js";
-import { t as resolveSlackChannelAllowlist } from "./resolve-channels-CstkChBE.js";
-import { t as resolveSlackUserAllowlist } from "./resolve-users-C3NP2c-Q.js";
-import { n as resolveSlackChannelConfig, r as resolveSlackChannelLabel, t as isSlackChannelAllowedByPolicy } from "./policy-Dj-puVPb.js";
+import { a as resolveSlackAccount, d as formatSlackBotTokenIdentityWarning, f as resolveSlackAppToken, i as resolveDefaultSlackAccountId, o as resolveSlackAccountAllowFrom, p as resolveSlackBotToken, s as resolveSlackAccountDmPolicy } from "./accounts-BOJJiHSr.js";
+import { $ as isSlackAnyNativeApprovalClientEnabled, F as SLACK_TEXT_LIMIT, K as escapeSlackMrkdwn, U as isSlackApprovalActionId, W as isSlackCallbackActionId, a as allowListMatches, c as normalizeSlackAllowOwnerEntry, dt as isSlackExecApprovalAuthorizedSender, l as normalizeSlackSlug, lt as isSlackApprovalAuthorizedSender, o as normalizeAllowList, q as decodeSlackApprovalAction, r as formatSlackError, s as normalizeAllowListLower, u as resolveSlackAllowListMatch, z as truncateSlackText } from "./group-policy-C-b2ZnSl.js";
+import { n as isSlackInteractiveRepliesEnabled, t as compileSlackInteractiveReplies } from "./interactive-replies-BilWUdcI.js";
+import { o as getSlackListenerUploadCompletionClient, u as resolveSlackWebClientOptions } from "./client-D2F6m8CP.js";
+import { t as getOptionalSlackRuntime } from "./runtime-CauEvswP.js";
+import { i as setSlackDefaultSendIdentity } from "./send-NEfJ0GvM.js";
+import { t as resolveSlackChannelAllowlist } from "./resolve-channels-DOMgNCWb.js";
+import { t as resolveSlackUserAllowlist } from "./resolve-users-aL6-Ssee.js";
+import { n as resolveSlackChannelConfig, r as resolveSlackChannelLabel, t as isSlackChannelAllowedByPolicy } from "./policy-f8b0edSi.js";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { asOptionalRecord, isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries, normalizeStringEntriesLower, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { normalizeAccountId, normalizeMainKey, resolveAgentRoute, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
@@ -20,9 +20,10 @@ import { CHANNEL_APPROVAL_NATIVE_RUNTIME_CONTEXT_CAPABILITY } from "openclaw/plu
 import { parseExecApprovalCommandText } from "openclaw/plugin-sdk/approval-reply-runtime";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { addAllowlistUserEntriesFromConfigEntry, buildAllowlistResolutionSummary, formatAllowlistMatchMeta, mergeAllowlist, patchAllowlistUsersInConfigEntries, summarizeMapping } from "openclaw/plugin-sdk/allow-from";
-import { collectErrorGraphCandidates, formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { collectErrorGraphCandidates, formatErrorMessage, isApprovalNotFoundError } from "openclaw/plugin-sdk/error-runtime";
 import { asDateTimestampMs, parseFiniteNumber, parseStrictFiniteNumber, resolveExpiresAtMsFromDurationMs, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { resolveTextChunkLimit } from "openclaw/plugin-sdk/reply-chunking";
+import { buildUntrustedChannelMetadata } from "openclaw/plugin-sdk/security-runtime";
 import { createDedupeCache, createPersistentDedupeCache } from "openclaw/plugin-sdk/dedupe-runtime";
 import { buildPluginBindingResolvedText, parsePluginBindingApprovalCustomId, recordInboundSession, resolveConversationLabel as resolveConversationLabel$1, resolvePluginConversationBindingApproval, resolveRuntimeConversationBindingRoute, upsertChannelPairingRequest } from "openclaw/plugin-sdk/conversation-runtime";
 import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "openclaw/plugin-sdk/native-command-config-runtime";
@@ -45,7 +46,6 @@ import { createInteractiveConversationBindingHelpers, dispatchPluginInteractiveH
 import { createChannelIngressResolver, defineStableChannelIngressIdentity, readChannelIngressStoreAllowFromForDmPolicy } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { createChannelInboundDebouncer, shouldDebounceTextInbound } from "openclaw/plugin-sdk/channel-inbound";
 import { generateSecureToken } from "openclaw/plugin-sdk/secure-random-runtime";
-import { buildUntrustedChannelMetadata } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/slack/src/monitor/commands.ts
 /**
 * Strip Slack mentions (<@U123>, <@U123|name>) so command detection works on
@@ -96,6 +96,9 @@ function resolveSlackChatType(channelType) {
 //#endregion
 //#region extensions/slack/src/monitor/context.ts
 const SLACK_ASSISTANT_THREAD_CONTEXT_METADATA_EVENT = "assistant_thread_context";
+const SLACK_CHANNEL_CACHE_MAX_ENTRIES = 1024;
+const SLACK_CHANNEL_DENIAL_WARNING_TTL_MS = 5 * 6e4;
+const SLACK_CHANNEL_DENIAL_WARNING_MAX_ENTRIES = 1024;
 function buildSlackAssistantThreadMetadata(context) {
 	const eventPayload = {};
 	if (context.channelId) eventPayload.channel_id = context.channelId;
@@ -134,23 +137,61 @@ function createSlackMonitorContext(params) {
 		ttlMs: 6e4,
 		maxSize: 500
 	});
+	const channelDenialWarnings = createDedupeCache({
+		ttlMs: SLACK_CHANNEL_DENIAL_WARNING_TTL_MS,
+		maxSize: SLACK_CHANNEL_DENIAL_WARNING_MAX_ENTRIES
+	});
 	const assistantThreadContexts = /* @__PURE__ */ new Map();
 	let lastAssistantContextCleanupAt = Date.now();
 	const allowFrom = normalizeAllowList(params.allowFrom);
 	const groupDmChannels = normalizeAllowList(params.groupDmChannels);
-	const groupDmChannelsLower = normalizeAllowListLower(groupDmChannels);
+	const groupDmChannelsLower = new Set(normalizeAllowListLower(groupDmChannels).map((entry) => entry.replace(/^channel:/, "")));
 	const defaultRequireMention = params.defaultRequireMention ?? true;
 	const hasChannelAllowlistConfig = Object.keys(params.channelsConfig ?? {}).length > 0;
 	const channelsConfigKeys = Object.keys(params.channelsConfig ?? {});
-	const markMessageSeen = (channelId, ts) => {
+	const scopedKey = (key, eventScope) => eventScope ? `${params.accountId}:${eventScope.teamId}:${key}` : key;
+	const readCachedChannel = (cacheKey) => {
+		const cached = channelCache.get(cacheKey);
+		if (cached) {
+			channelCache.delete(cacheKey);
+			channelCache.set(cacheKey, cached);
+		}
+		return cached;
+	};
+	const writeCachedChannel = (cacheKey, entry) => {
+		channelCache.delete(cacheKey);
+		channelCache.set(cacheKey, entry);
+		pruneMapToMaxSize(channelCache, SLACK_CHANNEL_CACHE_MAX_ENTRIES);
+	};
+	const rememberSlackChannelType = (channelId, channelType, eventScope) => {
+		const id = normalizeOptionalString(channelId);
+		const normalizedType = normalizeOptionalString(channelType)?.toLowerCase();
+		if (!id || normalizedType !== "im" && normalizedType !== "mpim" && normalizedType !== "channel" && normalizedType !== "group") return;
+		const cacheKey = scopedKey(id, eventScope);
+		const cached = readCachedChannel(cacheKey);
+		const type = normalizeSlackChannelType(normalizedType, id);
+		if (cached?.info.type === type) return;
+		writeCachedChannel(cacheKey, {
+			info: {
+				...cached?.info,
+				type
+			},
+			metadataLoaded: cached?.metadataLoaded ?? false
+		});
+	};
+	const recallSlackChannelType = (channelId, eventScope) => {
+		const id = normalizeOptionalString(channelId);
+		return id ? readCachedChannel(scopedKey(id, eventScope))?.info.type : void 0;
+	};
+	const markMessageSeen = (channelId, ts, eventScope) => {
 		if (!channelId || !ts) return false;
-		return seenMessages.check(`${channelId}:${ts}`);
+		return seenMessages.check(scopedKey(`${channelId}:${ts}`, eventScope));
 	};
-	const releaseSeenMessage = (channelId, ts) => {
+	const releaseSeenMessage = (channelId, ts, eventScope) => {
 		if (!channelId || !ts) return;
-		seenMessages.delete(`${channelId}:${ts}`);
+		seenMessages.delete(scopedKey(`${channelId}:${ts}`, eventScope));
 	};
-	const assistantContextKey = (channelId, threadTs) => `${channelId}:${threadTs}`;
+	const assistantContextKey = (channelId, threadTs, eventScope) => scopedKey(`${channelId}:${threadTs}`, eventScope);
 	const cleanupAssistantThreadContexts = () => {
 		const now = Date.now();
 		if (now - lastAssistantContextCleanupAt < SLACK_ASSISTANT_CONTEXT_CLEANUP_INTERVAL_MS) return;
@@ -158,9 +199,9 @@ function createSlackMonitorContext(params) {
 		const cutoff = now - SLACK_ASSISTANT_CONTEXT_TTL_MS;
 		for (const [key, entry] of assistantThreadContexts) if (entry.updatedAt < cutoff) assistantThreadContexts.delete(key);
 	};
-	const getSlackAssistantThreadContext = (channelId, threadTs) => {
+	const getSlackAssistantThreadContext = (channelId, threadTs, eventScope) => {
 		if (!channelId || !threadTs) return;
-		const key = assistantContextKey(channelId, threadTs);
+		const key = assistantContextKey(channelId, threadTs, eventScope);
 		const entry = assistantThreadContexts.get(key);
 		if (!entry) return;
 		if (Date.now() - entry.updatedAt > SLACK_ASSISTANT_CONTEXT_TTL_MS) {
@@ -169,9 +210,9 @@ function createSlackMonitorContext(params) {
 		}
 		return entry;
 	};
-	const saveSlackAssistantThreadContext = (context) => {
+	const saveSlackAssistantThreadContext = (context, eventScope) => {
 		cleanupAssistantThreadContexts();
-		assistantThreadContexts.set(assistantContextKey(context.assistantChannelId, context.threadTs), {
+		assistantThreadContexts.set(assistantContextKey(context.assistantChannelId, context.threadTs, eventScope), {
 			...context,
 			updatedAt: Date.now()
 		});
@@ -179,7 +220,7 @@ function createSlackMonitorContext(params) {
 	const resolveSlackSystemEventSessionKey = (p) => {
 		const channelId = normalizeOptionalString(p.channelId) ?? "";
 		const senderId = normalizeOptionalString(p.senderId) ?? "";
-		const channelType = normalizeSlackChannelType(p.channelType, channelId);
+		const channelType = normalizeSlackChannelType(p.channelType ?? recallSlackChannelType(channelId), channelId);
 		const isDirectMessage = channelType === "im";
 		if (!channelId && (!isDirectMessage || !senderId)) return params.mainKey;
 		const isGroup = channelType === "mpim";
@@ -237,39 +278,47 @@ function createSlackMonitorContext(params) {
 			parentSessionKey: normalizeOptionalString(p.threadTs) && params.threadInheritParent ? legacySessionKey : void 0
 		}).sessionKey;
 	};
-	const resolveChannelName = async (channelId) => {
-		const cached = channelCache.get(channelId);
-		if (cached) return cached;
+	const resolveChannelName = async (channelId, eventScope) => {
+		const cacheKey = scopedKey(channelId, eventScope);
+		const cached = readCachedChannel(cacheKey);
+		if (cached?.metadataLoaded) return cached.info;
 		try {
-			const info = await params.app.client.conversations.info({
+			const info = await (eventScope?.client ?? params.app.client).conversations.info({
 				token: params.botToken,
 				channel: channelId
 			});
 			const name = info.channel && "name" in info.channel ? info.channel.name : void 0;
 			const channel = info.channel ?? void 0;
+			const type = channel?.is_im ? "im" : channel?.is_mpim ? "mpim" : channel?.is_channel ? "channel" : channel?.is_group ? "group" : void 0;
+			const topic = channel && "topic" in channel ? channel.topic?.value ?? void 0 : void 0;
+			const purpose = channel && "purpose" in channel ? channel.purpose?.value ?? void 0 : void 0;
 			const entry = {
-				name,
-				type: channel?.is_im ? "im" : channel?.is_mpim ? "mpim" : channel?.is_channel ? "channel" : channel?.is_group ? "group" : void 0,
-				topic: channel && "topic" in channel ? channel.topic?.value ?? void 0 : void 0,
-				purpose: channel && "purpose" in channel ? channel.purpose?.value ?? void 0 : void 0
+				info: {
+					name,
+					type: cached?.info.type ?? type,
+					topic,
+					purpose
+				},
+				metadataLoaded: true
 			};
-			channelCache.set(channelId, entry);
-			return entry;
+			writeCachedChannel(cacheKey, entry);
+			return entry.info;
 		} catch {
-			return {};
+			return cached?.info ?? {};
 		}
 	};
-	const resolveUserName = async (userId) => {
-		const cached = userCache.get(userId);
+	const resolveUserName = async (userId, eventScope) => {
+		const cacheKey = scopedKey(userId, eventScope);
+		const cached = userCache.get(cacheKey);
 		if (cached) return cached;
 		try {
-			const info = await params.app.client.users.info({
+			const info = await (eventScope?.client ?? params.app.client).users.info({
 				token: params.botToken,
 				user: userId
 			});
 			const profile = info.user?.profile;
 			const entry = { name: profile?.display_name || profile?.real_name || info.user?.name || void 0 };
-			userCache.set(userId, entry);
+			userCache.set(cacheKey, entry);
 			return entry;
 		} catch {
 			return {};
@@ -278,7 +327,7 @@ function createSlackMonitorContext(params) {
 	const setSlackThreadStatus = async (p) => {
 		if (!p.threadTs) return;
 		try {
-			await params.app.client.assistant.threads.setStatus({
+			await (p.eventScope?.client ?? params.app.client).assistant.threads.setStatus({
 				token: params.botToken,
 				channel_id: p.channelId,
 				thread_ts: p.threadTs,
@@ -323,7 +372,7 @@ function createSlackMonitorContext(params) {
 				p.channelName,
 				p.channelName ? normalizeSlackSlug(p.channelName) : void 0
 			].filter((value) => Boolean(value)).map((value) => normalizeLowercaseStringOrEmpty(value));
-			if (!(groupDmChannelsLower.includes("*") || candidates.some((candidate) => groupDmChannelsLower.includes(candidate)))) return false;
+			if (!(groupDmChannelsLower.has("*") || candidates.some((candidate) => groupDmChannelsLower.has(candidate)))) return false;
 		}
 		if (isRoom && p.channelId) {
 			const channelConfig = resolveSlackChannelConfig({
@@ -337,19 +386,33 @@ function createSlackMonitorContext(params) {
 			const channelMatchMeta = formatAllowlistMatchMeta(channelConfig);
 			const channelAllowed = channelConfig?.allowed !== false;
 			const channelAllowlistConfigured = hasChannelAllowlistConfig;
-			if (!isSlackChannelAllowedByPolicy({
+			const allowedByPolicy = isSlackChannelAllowedByPolicy({
 				groupPolicy: params.groupPolicy,
 				channelAllowlistConfigured,
 				channelAllowed
-			})) {
+			});
+			const explicitlyDisabled = params.groupPolicy !== "disabled" && channelConfig?.allowed === false && channelConfig.matchSource !== void 0;
+			if (!allowedByPolicy || params.groupPolicy === "open" && explicitlyDisabled) {
+				if (explicitlyDisabled) {
+					const reason = "channel_not_allowed";
+					const warningKey = `${params.accountId}:${p.channelId}:${reason}`;
+					if (!channelDenialWarnings.peek(warningKey)) {
+						channelDenialWarnings.check(warningKey);
+						logger.warn({
+							provider: "slack",
+							accountId: params.accountId,
+							channelId: p.channelId,
+							reason,
+							cause: "channel_disabled",
+							groupPolicy: params.groupPolicy,
+							matchSource: channelConfig.matchSource,
+							matchKey: channelConfig.matchKey
+						}, "Slack channel denied by configuration");
+					}
+				}
 				logVerbose(`slack: drop channel ${p.channelId} (groupPolicy=${params.groupPolicy}, ${channelMatchMeta})`);
 				return false;
 			}
-			const hasExplicitConfig = Boolean(channelConfig?.matchSource);
-			if (!channelAllowed && (params.groupPolicy !== "open" || hasExplicitConfig)) {
-				logVerbose(`slack: drop channel ${p.channelId} (${channelMatchMeta})`);
-				return false;
-			}
 			logVerbose(`slack: allow channel ${p.channelId} (${channelMatchMeta})`);
 		}
 		return true;
@@ -380,6 +443,10 @@ function createSlackMonitorContext(params) {
 		botId: params.botId,
 		teamId: params.teamId,
 		apiAppId: params.apiAppId,
+		installationIdentity: params.installationIdentity ?? {
+			kind: "degraded",
+			reason: "auth_test_failed"
+		},
 		historyLimit: params.historyLimit,
 		dmHistoryLimit: Math.max(0, params.dmHistoryLimit ?? 0),
 		channelHistories,
@@ -415,6 +482,8 @@ function createSlackMonitorContext(params) {
 		resolveSlackSystemEventSessionKey,
 		isChannelAllowed,
 		resolveChannelName,
+		rememberSlackChannelType,
+		recallSlackChannelType,
 		resolveUserName,
 		setSlackThreadStatus,
 		getSlackAssistantThreadContext,
@@ -423,6 +492,121 @@ function createSlackMonitorContext(params) {
 	};
 }
 //#endregion
+//#region extensions/slack/src/monitor/enterprise-install.ts
+const SLACK_CHANNEL_ID_RE = /^[CDG][A-Z0-9]{8,}$/;
+const SLACK_USER_ID_RE = /^[UW][A-Z0-9]{8,}$/;
+function isStableSlackChannelEntry(value, options) {
+	if (typeof value !== "string") return false;
+	const normalized = value.trim();
+	if (normalized === "*") return options?.allowWildcard === true;
+	if (/^channel:([CDG][A-Z0-9]{8,})$/.exec(normalized)?.[1]) return true;
+	return SLACK_CHANNEL_ID_RE.test(normalized);
+}
+function isStableSlackAllowlistUserEntry(value) {
+	if (typeof value !== "string") return false;
+	const normalized = value.trim();
+	if (normalized === "*") return true;
+	const prefixed = /^(?:slack|user):([UW][A-Z0-9]{8,})$/.exec(normalized);
+	return Boolean(prefixed?.[1]) || SLACK_USER_ID_RE.test(normalized);
+}
+function isStableSlackToolsBySenderEntry(value) {
+	if (typeof value !== "string") return false;
+	const normalized = value.trim();
+	if (normalized === "*") return true;
+	const prefixed = /^(?:id:|channel:slack:)([UW][A-Z0-9]{8,})$/.exec(normalized);
+	return Boolean(prefixed?.[1]) || SLACK_USER_ID_RE.test(normalized);
+}
+function assertStableEntries(params) {
+	const invalid = params.values?.find((value) => !params.predicate(value));
+	if (invalid !== void 0) throw new Error(`Slack Enterprise Grid org installs require stable Slack IDs in ${params.path}; invalid entry ${JSON.stringify(invalid)}`);
+}
+/** Validate every policy surface that would otherwise require name resolution. */
+function assertEnterpriseSlackPolicyConfig(params) {
+	const { config, accountId } = params;
+	if (config.dangerouslyAllowNameMatching === true) throw new Error(`Slack Enterprise Grid org account "${accountId}" cannot use dangerouslyAllowNameMatching`);
+	if (config.mentionPatterns?.allowIn !== void 0 || config.mentionPatterns?.denyIn !== void 0) throw new Error(`Slack Enterprise Grid org account "${accountId}" cannot use mentionPatterns.allowIn or mentionPatterns.denyIn because Slack channel IDs are not workspace-qualified`);
+	assertStableEntries({
+		values: config.allowFrom,
+		path: `channels.slack.accounts.${accountId}.allowFrom`,
+		predicate: isStableSlackAllowlistUserEntry
+	});
+	assertStableEntries({
+		values: config.dm?.allowFrom,
+		path: `channels.slack.accounts.${accountId}.dm.allowFrom`,
+		predicate: isStableSlackAllowlistUserEntry
+	});
+	assertStableEntries({
+		values: config.dm?.groupChannels,
+		path: `channels.slack.accounts.${accountId}.dm.groupChannels`,
+		predicate: (value) => isStableSlackChannelEntry(value)
+	});
+	if (config.reactionNotifications === "allowlist") assertStableEntries({
+		values: config.reactionAllowlist,
+		path: `channels.slack.accounts.${accountId}.reactionAllowlist`,
+		predicate: isStableSlackAllowlistUserEntry
+	});
+	for (const [channelKey, channel] of Object.entries(config.channels ?? {})) {
+		if (!isStableSlackChannelEntry(channelKey, { allowWildcard: true })) throw new Error(`Slack Enterprise Grid org installs require stable Slack channel IDs; invalid channels key ${JSON.stringify(channelKey)}`);
+		assertStableEntries({
+			values: channel?.users,
+			path: `channels.slack.accounts.${accountId}.channels.${channelKey}.users`,
+			predicate: isStableSlackAllowlistUserEntry
+		});
+		assertStableEntries({
+			values: Object.keys(channel?.toolsBySender ?? {}),
+			path: `channels.slack.accounts.${accountId}.channels.${channelKey}.toolsBySender`,
+			predicate: isStableSlackToolsBySenderEntry
+		});
+	}
+}
+/** Prevent account-wide user authorization state from crossing workspace boundaries. */
+function assertEnterpriseSlackDmPolicy(params) {
+	if (!params.dmEnabled || params.dmPolicy === "disabled") return;
+	if (params.dmPolicy === "open" && params.allowFrom?.includes("*")) return;
+	throw new Error(`Slack Enterprise Grid org account "${params.accountId}" supports DMs only with dm.enabled=false, dmPolicy="disabled", or dmPolicy="open" with effective allowFrom containing "*"; dmPolicy=${JSON.stringify(params.dmPolicy)} and allowFrom=${JSON.stringify(params.allowFrom ?? [])} would share per-user authorization across workspaces`);
+}
+function assertNoEnterpriseSlackBindings(params) {
+	const defaultAccountId = resolveDefaultSlackAccountId(params.cfg);
+	if (params.cfg.bindings?.find((binding) => {
+		if (binding.match.channel.trim().toLowerCase() !== "slack") return false;
+		const accountId = binding.match.accountId?.trim();
+		return accountId === "*" || accountId === params.accountId || !accountId && params.accountId === defaultAccountId;
+	})) throw new Error(`Slack Enterprise Grid org account "${params.accountId}" cannot use configured Slack bindings`);
+}
+function resolveSlackInstallationIdentity(params) {
+	const auth = params.auth;
+	if (!auth) {
+		if (params.enterpriseOrgInstall) throw new Error(`Slack enterpriseOrgInstall=true requires a successful auth.test (${formatSlackError(params.authError)})`);
+		return {
+			kind: "degraded",
+			reason: "auth_test_failed"
+		};
+	}
+	const isEnterpriseInstall = auth.is_enterprise_install === true;
+	if (isEnterpriseInstall !== params.enterpriseOrgInstall) throw new Error(isEnterpriseInstall ? "Slack auth.test detected an org-wide installation; set enterpriseOrgInstall=true" : "Slack enterpriseOrgInstall=true requires an org-wide bot installation");
+	const apiAppId = normalizeOptionalString(auth.app_id);
+	const enterpriseId = normalizeOptionalString(auth.enterprise_id);
+	if (params.enterpriseOrgInstall) {
+		if (!enterpriseId) throw new Error("Slack org-wide auth.test returned no enterprise_id");
+		const transportApiAppId = normalizeOptionalString(params.transportApiAppId);
+		if (apiAppId && transportApiAppId && apiAppId !== transportApiAppId) throw new Error(`Slack token mismatch: bot token app_id=${apiAppId} but transport app_id=${transportApiAppId}`);
+		const effectiveApiAppId = apiAppId ?? transportApiAppId;
+		return {
+			kind: "enterprise",
+			...effectiveApiAppId ? { apiAppId: effectiveApiAppId } : {},
+			enterpriseId
+		};
+	}
+	const teamId = normalizeOptionalString(auth.team_id);
+	if (!teamId) throw new Error("Slack workspace auth.test returned no team_id");
+	return {
+		kind: "workspace",
+		teamId,
+		...apiAppId ? { apiAppId } : {},
+		...enterpriseId ? { enterpriseId } : {}
+	};
+}
+//#endregion
 //#region extensions/slack/src/monitor/events/assistant.ts
 const DEFAULT_ASSISTANT_PROMPTS = [
 	{
@@ -557,7 +741,12 @@ function migrateSlackChannelsInPlace(channels, oldChannelId, newChannelId) {
 		migrated: false,
 		skippedExisting: true
 	};
-	channels[newChannelId] = channels[oldChannelId];
+	const channelConfig = channels[oldChannelId];
+	if (!channelConfig) return {
+		migrated: false,
+		skippedExisting: false
+	};
+	channels[newChannelId] = channelConfig;
 	delete channels[oldChannelId];
 	return {
 		migrated: true,
@@ -702,7 +891,7 @@ function registerSlackChannelEvents(params) {
 }
 //#endregion
 //#region extensions/slack/src/monitor/events/home.ts
-function buildSlackHomeView() {
+function buildSlackHomeView(slashCommandName) {
 	return {
 		type: "home",
 		callback_id: "openclaw:home",
@@ -718,7 +907,7 @@ function buildSlackHomeView() {
 				type: "section",
 				text: {
 					type: "mrkdwn",
-					text: "Send a DM, mention OpenClaw in a channel, or use `/openclaw` to start a session."
+					text: slashCommandName ? `Send a DM, mention OpenClaw in a channel, or use \`/${slashCommandName}\` to start a session.` : "Send a DM or mention OpenClaw in a channel to start a session."
 				}
 			},
 			{
@@ -732,7 +921,7 @@ function buildSlackHomeView() {
 	};
 }
 function registerSlackHomeEvents(params) {
-	const { ctx, trackEvent } = params;
+	const { ctx, slashCommandName, trackEvent } = params;
 	ctx.app.event("app_home_opened", async ({ event, body }) => {
 		try {
 			if (ctx.shouldDropMismatchedSlackEvent(body)) return;
@@ -742,7 +931,7 @@ function registerSlackHomeEvents(params) {
 			await ctx.app.client.views.publish({
 				token: ctx.botToken,
 				user_id: payload.user,
-				view: buildSlackHomeView()
+				view: buildSlackHomeView(slashCommandName)
 			});
 		} catch (err) {
 			ctx.runtime.error?.(danger(`slack app home handler failed: ${formatErrorMessage(err)}`));
@@ -783,7 +972,7 @@ async function dispatchSlackPluginInteractiveHandler(params) {
 }
 //#endregion
 //#region extensions/slack/src/monitor/auth.ts
-let slackChannelMembersCache = /* @__PURE__ */ new WeakMap();
+const slackChannelMembersCache = /* @__PURE__ */ new WeakMap();
 const DEFAULT_CHANNEL_MEMBERS_CACHE_TTL_MS = 6e4;
 const CHANNEL_MEMBERS_CACHE_MAX = 512;
 const SLACK_CHANNEL_ID = "slack";
@@ -891,11 +1080,11 @@ async function resolveSlackEffectiveAllowFrom(ctx, options) {
 	}
 	return normalizeAllowListLower([...base, ...storeAllowFrom]);
 }
-async function fetchSlackChannelMemberIds(ctx, channelId) {
+async function fetchSlackChannelMemberIds(ctx, channelId, eventScope) {
 	const members = /* @__PURE__ */ new Set();
 	let cursor;
 	do {
-		const response = await ctx.app.client.conversations.members({
+		const response = await (eventScope?.client ?? ctx.app.client).conversations.members({
 			token: ctx.botToken,
 			channel: channelId,
 			limit: 999,
@@ -907,9 +1096,9 @@ async function fetchSlackChannelMemberIds(ctx, channelId) {
 	} while (cursor);
 	return members;
 }
-async function resolveSlackChannelMemberIds(ctx, channelId) {
+async function resolveSlackChannelMemberIds(ctx, channelId, eventScope) {
 	const cache = getChannelMembersCache(ctx);
-	const key = `${ctx.accountId}:${channelId}`;
+	const key = `${ctx.accountId}:${eventScope ? `${eventScope.teamId}:` : ""}${channelId}`;
 	const ttlMs = readSlackCacheTtlMs("OPENCLAW_SLACK_CHANNEL_MEMBERS_CACHE_TTL_MS", DEFAULT_CHANNEL_MEMBERS_CACHE_TTL_MS);
 	const rawNowMs = Date.now();
 	const nowMs = asDateTimestampMs(rawNowMs);
@@ -919,7 +1108,7 @@ async function resolveSlackChannelMemberIds(ctx, channelId) {
 		cache.delete(key);
 	}
 	if (cached?.pending) return await cached.pending;
-	const pending = fetchSlackChannelMemberIds(ctx, channelId);
+	const pending = fetchSlackChannelMemberIds(ctx, channelId, eventScope);
 	const pendingExpiresAtMs = ttlMs > 0 ? resolveExpiresAtMsFromDurationMs(ttlMs, { nowMs: rawNowMs }) : void 0;
 	cache.set(key, {
 		expiresAtMs: pendingExpiresAtMs ?? 0,
@@ -963,7 +1152,7 @@ async function authorizeSlackBotRoomMessage(params) {
 		return false;
 	}
 	try {
-		const channelMemberIds = await resolveSlackChannelMemberIds(params.ctx, params.channelId);
+		const channelMemberIds = await resolveSlackChannelMemberIds(params.ctx, params.channelId, params.eventScope);
 		if (explicitOwnerIds.some((ownerId) => channelMemberIds.has(ownerId))) return true;
 		logVerbose(`slack: drop bot message ${params.senderId} in ${params.channelId} (no owner present)`);
 	} catch (error) {
@@ -979,8 +1168,10 @@ function slackIngressConversationKind(channelType) {
 }
 async function resolveSlackCommandIngress(params) {
 	const isDirectMessage = params.channelType === "im";
+	const isGroupDm = params.channelType === "mpim";
 	const channelUsers = normalizeAllowListLower(params.channelUsers);
-	const channelUsersConfigured = !isDirectMessage && channelUsers.length > 0;
+	const channelUsersConfigured = !isDirectMessage && !isGroupDm && channelUsers.length > 0;
+	const groupAllowFrom = isGroupDm ? params.ownerAllowFromLower : channelUsersConfigured ? channelUsers : [];
 	return await createSlackIngressResolver(params.ctx).message({
 		subject: createSlackIngressSubject({
 			senderId: params.senderId,
@@ -996,7 +1187,7 @@ async function resolveSlackCommandIngress(params) {
 			mayPair: false
 		},
 		dmPolicy: isDirectMessage ? "open" : "disabled",
-		groupPolicy: channelUsersConfigured ? "allowlist" : "open",
+		groupPolicy: isGroupDm || channelUsersConfigured ? "allowlist" : "open",
 		policy: {
 			groupAllowFromFallbackToAllowFrom: false,
 			mutableIdentifierMatching: params.ctx.allowNameMatching ? "enabled" : "disabled",
@@ -1004,7 +1195,7 @@ async function resolveSlackCommandIngress(params) {
 		},
 		mentionFacts: params.mentionFacts,
 		allowFrom: isDirectMessage ? ["*"] : params.ownerAllowFromLower,
-		groupAllowFrom: channelUsersConfigured ? channelUsers : [],
+		groupAllowFrom,
 		command: {
 			allowTextCommands: params.allowTextCommands,
 			hasControlCommand: params.hasControlCommand,
@@ -1015,12 +1206,14 @@ async function resolveSlackCommandIngress(params) {
 }
 async function decideSlackSystemIngress(params) {
 	const isDirectMessage = params.channelType === "im";
+	const isGroupDm = params.channelType === "mpim";
 	const channelUsers = normalizeAllowListLower(params.channelUsers);
-	const channelUsersConfigured = !isDirectMessage && channelUsers.length > 0;
+	const channelUsersConfigured = !isDirectMessage && !isGroupDm && channelUsers.length > 0;
 	const ownerAllowFrom = params.interactiveEvent && channelUsersConfigured ? params.ownerAllowFromLower.filter((entry) => entry !== "*") : params.ownerAllowFromLower;
 	const hasAnyCommandAllowlist = ownerAllowFrom.length > 0 || channelUsersConfigured;
 	const groupAllowFrom = (() => {
 		if (isDirectMessage) return [];
+		if (isGroupDm) return ownerAllowFrom;
 		if (params.interactiveEvent && hasAnyCommandAllowlist) return channelUsersConfigured ? channelUsers : [];
 		if (channelUsersConfigured) return channelUsers;
 		return params.channelId ? ["*"] : wildcardWhenOpen(params.ownerAllowFromLower);
@@ -1040,7 +1233,7 @@ async function decideSlackSystemIngress(params) {
 			mayPair: false
 		},
 		dmPolicy: isDirectMessage ? "open" : "disabled",
-		groupPolicy: params.interactiveEvent && hasAnyCommandAllowlist ? "open" : channelUsersConfigured || !params.channelId && params.ownerAllowFromLower.length > 0 ? "allowlist" : "open",
+		groupPolicy: isGroupDm ? "allowlist" : params.interactiveEvent && hasAnyCommandAllowlist ? "open" : channelUsersConfigured || !params.channelId && params.ownerAllowFromLower.length > 0 ? "allowlist" : "open",
 		policy: {
 			groupAllowFromFallbackToAllowFrom: false,
 			mutableIdentifierMatching: params.ctx.allowNameMatching ? "enabled" : "disabled"
@@ -1149,11 +1342,6 @@ async function authorizeSlackSystemEventSender(params) {
 	};
 }
 //#endregion
-//#region extensions/slack/src/monitor/mrkdwn.ts
-function escapeSlackMrkdwn(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replace(/([*_`~])/g, "\\$1");
-}
-//#endregion
 //#region extensions/slack/src/monitor/events/interactions.block-actions.ts
 function readOptionValues(options) {
 	if (!Array.isArray(options)) return;
@@ -1235,9 +1423,6 @@ function summarizeAction(action) {
 		workflowId: typed.workflow?.workflow_id
 	};
 }
-function isBulkActionsBlock(block) {
-	return block.type === "actions" && Array.isArray(block.elements) && block.elements.length > 0 && block.elements.every((el) => typeof el.action_id === "string" && el.action_id.includes("_all_"));
-}
 function formatInteractionSelectionLabel(params) {
 	if (params.summary.actionType === "button" && params.buttonText?.trim()) return params.buttonText.trim();
 	if (params.summary.selectedLabels?.length) {
@@ -1267,12 +1452,15 @@ function buildSlackPluginInteractionData(params) {
 	const actionId = normalizeOptionalString(params.actionId) ?? "";
 	if (!actionId) return null;
 	const payload = normalizeOptionalString(params.summary.value) || params.summary.selectedValues?.map((value) => normalizeOptionalString(value)).find(Boolean) || "";
-	if (actionId === "openclaw:reply_button" || actionId === "openclaw:reply_select" || actionId.startsWith(`openclaw:reply_button:`) || actionId.startsWith(`openclaw:reply_select:`)) return payload || null;
+	if (actionId === "openclaw:reply_button" || actionId === "openclaw:reply_select" || isSlackCallbackActionId(actionId) || actionId.startsWith(`openclaw:reply_button:`) || actionId.startsWith(`openclaw:reply_select:`)) return payload || null;
 	return payload ? `${actionId}:${payload}` : actionId;
 }
 function isSlackReplyActionId(actionId) {
 	return actionId === "openclaw:reply_button" || actionId === "openclaw:reply_select" || actionId.startsWith(`openclaw:reply_button:`) || actionId.startsWith(`openclaw:reply_select:`);
 }
+function readSlackApprovalAction(parsed) {
+	return decodeSlackApprovalAction(normalizeOptionalString(parsed.actionSummary.value) ?? parsed.actionSummary.selectedValues?.map((entry) => normalizeOptionalString(entry)).find((entry) => Boolean(entry)));
+}
 function isSlackReplyLinkAction(parsed) {
 	if (parsed.actionId === "openclaw:reply_link" || parsed.actionId.startsWith(`openclaw:reply_link:`)) return true;
 	const legacyUrl = normalizeOptionalString(parsed.typedAction.url);
@@ -1328,6 +1516,37 @@ async function updateSlackInteractionMessage(params) {
 		...params.blocks ? { blocks: params.blocks } : {}
 	});
 }
+function resolveSlackApprovalTerminalLabel(approval) {
+	if (approval.status === "allowed") return approval.decision === "allow-always" ? "Allowed always" : "Allowed once";
+	if (approval.status === "denied") return "Denied";
+	if (approval.status === "expired") return "Expired";
+	return "Cancelled";
+}
+function removeSlackApprovalControls(blocks) {
+	return blocks.flatMap((block) => {
+		if (!block || typeof block !== "object" || Array.isArray(block)) return [block];
+		const typedBlock = block;
+		if (typedBlock.type !== "actions" || !Array.isArray(typedBlock.elements)) return [block];
+		const elements = typedBlock.elements.filter((element) => typeof element.action_id !== "string" || !isSlackApprovalActionId(element.action_id));
+		return elements.length > 0 ? [{
+			...block,
+			elements
+		}] : [];
+	});
+}
+function buildSlackApprovalTerminalBlocks(params) {
+	const blocks = removeSlackApprovalControls(params.blocks ?? []).filter((block) => {
+		const text = block.text?.text;
+		return !(block.type === "section" && typeof text === "string" && /^\*(?:Exec|Plugin) approval required\*/u.test(text));
+	});
+	return [{
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: `*${params.prefix}: ${params.label}*`
+		}
+	}, ...blocks];
+}
 async function authorizeSlackBlockAction(params) {
 	const auth = await authorizeSlackSystemEventSender({
 		ctx: params.ctx,
@@ -1361,9 +1580,7 @@ async function handleSlackPluginBindingApproval(params) {
 	await respondEphemeral(params.respond, buildPluginBindingResolvedText(resolved));
 	return true;
 }
-async function handleSlackExecApprovalInteraction(params) {
-	const approval = parseExecApprovalCommandText(params.pluginInteractionData);
-	if (!approval) return false;
+async function handleSlackApprovalInteraction(params) {
 	const pluginApprovalAuthorizedSender = isSlackApprovalAuthorizedSender({
 		cfg: params.ctx.cfg,
 		accountId: params.ctx.accountId,
@@ -1374,38 +1591,95 @@ async function handleSlackExecApprovalInteraction(params) {
 		accountId: params.ctx.accountId,
 		senderId: params.parsed.userId
 	});
-	const isPluginApproval = approval.approvalId.startsWith("plugin:");
-	const resolveUnprefixedAsPlugin = !isPluginApproval && !execApprovalAuthorizedSender && pluginApprovalAuthorizedSender;
-	const authorized = isPluginApproval ? pluginApprovalAuthorizedSender : execApprovalAuthorizedSender || resolveUnprefixedAsPlugin;
-	const allowPluginFallback = !isPluginApproval && execApprovalAuthorizedSender && pluginApprovalAuthorizedSender;
-	if (!authorized) {
-		params.ctx.runtime.log?.(`slack:interaction drop exec approval user=${params.parsed.userId} (not authorized)`);
+	if (!(params.approval.approvalKind === "plugin" ? pluginApprovalAuthorizedSender : execApprovalAuthorizedSender)) {
+		params.ctx.runtime.log?.(`slack:interaction drop ${params.approval.approvalKind} approval user=${params.parsed.userId} (not authorized)`);
 		await respondEphemeral(params.respond, "You are not authorized to approve this request.");
 		return true;
 	}
 	try {
-		await resolveApprovalOverGateway({
+		const result = await resolveApprovalOverGateway({
 			cfg: params.ctx.cfg,
-			approvalId: approval.approvalId,
-			decision: approval.decision,
+			approvalId: params.approval.approvalId,
+			approvalKind: params.approval.approvalKind,
+			decision: params.approval.decision,
 			senderId: params.parsed.userId,
-			allowPluginFallback,
-			...resolveUnprefixedAsPlugin ? { resolveMethod: "plugin" } : {},
 			clientDisplayName: `Slack approval (${params.parsed.userId.trim() || "unknown"})`
 		});
+		const terminalLabel = resolveSlackApprovalTerminalLabel(result.approval);
+		const prefix = result.applied ? "Resolved" : "Already resolved";
+		let terminalized = false;
+		try {
+			const terminalText = `${prefix}: ${terminalLabel}`;
+			await updateSlackInteractionMessage({
+				ctx: params.ctx,
+				channelId: params.parsed.channelId,
+				messageTs: params.parsed.messageTs,
+				text: truncateSlackText(terminalText, 4e3),
+				blocks: buildSlackApprovalTerminalBlocks({
+					blocks: params.parsed.typedBody.message?.blocks,
+					label: terminalLabel,
+					prefix
+				})
+			});
+			terminalized = true;
+		} catch {}
+		if (!terminalized || !result.applied) await respondEphemeral(params.respond, result.applied ? `Approval resolved: ${terminalLabel}.` : `This approval was already resolved: ${terminalLabel}.`);
 	} catch (error) {
-		params.ctx.runtime.log?.(`slack:interaction exec approval resolve failed id=${approval.approvalId}: ${String(error)}`);
+		params.ctx.runtime.log?.(`slack:interaction approval resolve failed id=${params.approval.approvalId}: ${String(error)}`);
+		if (isApprovalNotFoundError(error)) {
+			await respondEphemeral(params.respond, "This approval is no longer pending.");
+			return true;
+		}
+		await respondEphemeral(params.respond, "Could not reach the Gateway to resolve this approval. Try again.");
 		throw error;
 	}
-	try {
-		await updateSlackInteractionMessage({
-			ctx: params.ctx,
-			channelId: params.parsed.channelId,
-			messageTs: params.parsed.messageTs,
-			text: params.parsed.typedBody.message?.text ?? "",
-			blocks: []
+	return true;
+}
+async function handleSlackLegacyApprovalInteraction(params) {
+	const parsedApproval = parseExecApprovalCommandText(params.pluginInteractionData);
+	if (!parsedApproval) return false;
+	const pluginAuthorized = isSlackApprovalAuthorizedSender({
+		cfg: params.ctx.cfg,
+		accountId: params.ctx.accountId,
+		senderId: params.parsed.userId
+	});
+	const execAuthorized = isSlackExecApprovalAuthorizedSender({
+		cfg: params.ctx.cfg,
+		accountId: params.ctx.accountId,
+		senderId: params.parsed.userId
+	});
+	const resolveMethods = [];
+	if (execAuthorized) resolveMethods.push("exec");
+	if (pluginAuthorized) resolveMethods.push("plugin");
+	if (resolveMethods.length === 0) {
+		params.ctx.runtime.log?.(`slack:interaction drop legacy approval user=${params.parsed.userId} (not authorized)`);
+		await respondEphemeral(params.respond, "You are not authorized to approve this request.");
+		return true;
+	}
+	for (const [index, resolveMethod] of resolveMethods.entries()) try {
+		await resolveApprovalOverGateway({
+			cfg: params.ctx.cfg,
+			approvalId: parsedApproval.approvalId,
+			decision: parsedApproval.decision,
+			senderId: params.parsed.userId,
+			resolveMethod,
+			clientDisplayName: `Slack approval (${params.parsed.userId.trim() || "unknown"})`
 		});
-	} catch {}
+		try {
+			await updateSlackInteractionMessage({
+				ctx: params.ctx,
+				channelId: params.parsed.channelId,
+				messageTs: params.parsed.messageTs,
+				text: params.parsed.typedBody.message?.text ?? "",
+				blocks: []
+			});
+		} catch {}
+		return true;
+	} catch (error) {
+		if (index + 1 < resolveMethods.length && isApprovalNotFoundError(error)) continue;
+		params.ctx.runtime.log?.(`slack:interaction legacy approval resolve failed id=${parsedApproval.approvalId}: ${String(error)}`);
+		throw error;
+	}
 	return true;
 }
 async function dispatchSlackPluginInteraction(params) {
@@ -1572,7 +1846,7 @@ function buildSlackConfirmationBlocks(params) {
 		summary: params.parsed.actionSummary,
 		buttonText: params.parsed.typedActionWithText.text?.text
 	});
-	let updatedBlocks = params.originalBlocks.map((block) => {
+	return params.originalBlocks.map((block) => {
 		const typedBlock = block;
 		if (typedBlock.type === "actions" && typedBlock.block_id === params.parsed.blockId) return {
 			type: "context",
@@ -1586,17 +1860,6 @@ function buildSlackConfirmationBlocks(params) {
 		};
 		return block;
 	});
-	if (!updatedBlocks.some((block) => {
-		const typedBlock = block;
-		return typedBlock.type === "actions" && !isBulkActionsBlock(typedBlock);
-	})) updatedBlocks = updatedBlocks.filter((block, index) => {
-		const typedBlock = block;
-		if (isBulkActionsBlock(typedBlock)) return false;
-		if (typedBlock.type !== "divider") return true;
-		const next = updatedBlocks[index + 1];
-		return !next || !isBulkActionsBlock(next);
-	});
-	return updatedBlocks;
 }
 async function updateSlackLegacyBlockAction(params) {
 	const originalBlocks = params.parsed.typedBody.message?.blocks;
@@ -1631,12 +1894,27 @@ async function handleSlackBlockAction(params) {
 	if (!parsed) return;
 	if (isSlackReplyLinkAction(parsed)) return;
 	params.trackEvent?.();
+	if (isSlackApprovalActionId(parsed.actionId)) {
+		const approval = readSlackApprovalAction(parsed);
+		if (!approval) {
+			params.ctx.runtime.log?.(`slack:interaction drop malformed approval action user=${parsed.userId} channel=${parsed.channelId ?? "unknown"}`);
+			await respondEphemeral(respond, "This approval action is invalid or expired.");
+			return;
+		}
+		await handleSlackApprovalInteraction({
+			ctx: params.ctx,
+			parsed,
+			approval,
+			respond
+		});
+		return;
+	}
 	const pluginInteractionData = buildSlackPluginInteractionData({
 		actionId: parsed.actionId,
 		summary: parsed.actionSummary
 	});
 	if (pluginInteractionData && isSlackReplyActionId(parsed.actionId)) {
-		if (await handleSlackExecApprovalInteraction({
+		if (await handleSlackLegacyApprovalInteraction({
 			ctx: params.ctx,
 			parsed,
 			pluginInteractionData,
@@ -2293,6 +2571,66 @@ function registerSlackMemberEvents(params) {
 	});
 }
 //#endregion
+//#region extensions/slack/src/monitor/event-scope.ts
+function resolveSlackEventScope(params) {
+	const context = params.context ?? {};
+	if (params.identity.kind !== "enterprise") return context.isEnterpriseInstall === true ? {
+		ok: false,
+		reason: "enterprise_event_for_workspace_account"
+	} : { ok: true };
+	const apiAppId = normalizeOptionalString((params.body && typeof params.body === "object" ? params.body : {}).api_app_id);
+	if (!apiAppId) return {
+		ok: false,
+		reason: "missing_api_app_id"
+	};
+	if (params.identity.apiAppId && apiAppId !== params.identity.apiAppId) return {
+		ok: false,
+		reason: "wrong_app"
+	};
+	if (context.isEnterpriseInstall !== true) return {
+		ok: false,
+		reason: "not_enterprise_install"
+	};
+	const enterpriseId = normalizeOptionalString(context.enterpriseId);
+	if (!enterpriseId) return {
+		ok: false,
+		reason: "missing_enterprise_id"
+	};
+	if (enterpriseId !== params.identity.enterpriseId) return {
+		ok: false,
+		reason: "wrong_enterprise"
+	};
+	const teamId = normalizeOptionalString(context.teamId);
+	if (!teamId) return {
+		ok: false,
+		reason: "missing_team_id"
+	};
+	if (!/^T[A-Z0-9]+$/i.test(teamId)) return {
+		ok: false,
+		reason: "invalid_team_id"
+	};
+	if (!params.client) return {
+		ok: false,
+		reason: "missing_listener_client"
+	};
+	const uploadCompletionClient = getSlackListenerUploadCompletionClient({
+		listenerClient: params.client,
+		teamId,
+		clientOptions: params.clientOptions
+	});
+	return {
+		ok: true,
+		scope: {
+			apiAppId,
+			enterpriseId,
+			teamId,
+			isEnterpriseInstall: true,
+			client: params.client,
+			...uploadCompletionClient ? { uploadCompletionClient } : {}
+		}
+	};
+}
+//#endregion
 //#region extensions/slack/src/monitor/events/message-subtype-handlers.ts
 const SUBTYPE_HANDLER_REGISTRY = {
 	message_changed: {
@@ -2340,6 +2678,9 @@ function formatSlackInboundLogLine(params) {
 function isSlackUserId(value) {
 	return /^[UW][A-Z0-9]+$/.test(value);
 }
+function isBotAuthoredEnterpriseEvent(event) {
+	return Boolean(normalizeOptionalString(event.bot_id)) || event.subtype === "bot_message";
+}
 function addUserCandidate(candidates, value, botUserId) {
 	const id = normalizeOptionalString(value);
 	if (!id || id === botUserId || !isSlackUserId(id)) return;
@@ -2396,21 +2737,57 @@ function resolveAssistantMessageChangedInbound(params) {
 		event_ts: changed.event_ts,
 		assistant_thread: asOptionalRecord(message.assistant_thread) ?? asOptionalRecord(changed.assistant_thread),
 		files: Array.isArray(message.files) ? message.files : void 0,
-		attachments: Array.isArray(message.attachments) ? message.attachments : void 0
+		attachments: Array.isArray(message.attachments) ? message.attachments : void 0,
+		blocks: Array.isArray(message.blocks) ? message.blocks : void 0
 	};
 }
 function registerSlackMessageEvents(params) {
 	const { ctx, handleSlackMessage } = params;
-	const handleIncomingMessageEvent = async ({ event, body }) => {
+	const resolveEventScope = (args) => {
+		const resolved = resolveSlackEventScope({
+			identity: ctx.installationIdentity,
+			body: args.body,
+			context: args.context,
+			client: args.client,
+			clientOptions: ctx.app.webClientOptions
+		});
+		if (!resolved.ok) {
+			logVerbose(`slack: drop event (${resolved.reason})`);
+			return null;
+		}
+		return resolved.scope;
+	};
+	const handleIncomingMessageEvent = async ({ event, body, context, client }) => {
 		try {
+			const eventScope = resolveEventScope({
+				body,
+				context,
+				client
+			});
+			if (eventScope === null) return;
 			if (ctx.shouldDropMismatchedSlackEvent(body)) return;
 			const message = event;
+			ctx.rememberSlackChannelType(message.channel, message.channel_type, eventScope);
+			if (eventScope && isBotAuthoredEnterpriseEvent(message)) {
+				logVerbose("slack: drop enterprise bot-authored message");
+				return;
+			}
+			if (eventScope && message.subtype && message.subtype !== "file_share") {
+				logVerbose(`slack: drop enterprise message subtype=${message.subtype}`);
+				return;
+			}
 			const assistantChangedInbound = resolveAssistantMessageChangedInbound({
 				event: message,
 				ctx
 			});
 			if (assistantChangedInbound) {
-				await handleSlackMessage(assistantChangedInbound, { source: "message" });
+				await handleSlackMessage(assistantChangedInbound, {
+					source: "message",
+					...eventScope ? {
+						eventScope,
+						awaitDispatch: true
+					} : {}
+				});
 				return;
 			}
 			if (message.subtype === "message_changed" && isSelfAttributedMessageChange({
@@ -2435,25 +2812,39 @@ function registerSlackMessageEvents(params) {
 				});
 				return;
 			}
-			await handleSlackMessage(message, { source: "message" });
+			await handleSlackMessage(message, {
+				source: "message",
+				...eventScope ? {
+					eventScope,
+					awaitDispatch: true
+				} : {}
+			});
 		} catch (err) {
 			ctx.runtime.error?.(danger(`slack handler failed: ${formatErrorMessage(err)}`));
 		}
 	};
-	ctx.app.event("message", async ({ event, body }) => {
-		await handleIncomingMessageEvent({
-			event,
-			body
-		});
+	ctx.app.event("message", async (args) => {
+		await handleIncomingMessageEvent(args);
 	});
-	ctx.app.event("app_mention", async ({ event, body }) => {
+	ctx.app.event("app_mention", async (args) => {
+		const { event, body, context, client } = args;
 		try {
+			const eventScope = resolveEventScope({
+				body,
+				context,
+				client
+			});
+			if (eventScope === null) return;
 			if (ctx.shouldDropMismatchedSlackEvent(body)) return;
 			const mention = event;
+			if (eventScope && isBotAuthoredEnterpriseEvent(mention)) {
+				logVerbose("slack: drop enterprise bot-authored app_mention");
+				return;
+			}
 			const channelType = normalizeSlackChannelType(mention.channel_type, mention.channel);
 			if (channelType === "im" || channelType === "mpim") return;
 			slackInboundLog.info(formatSlackInboundLogLine({
-				workspaceId: ctx.teamId,
+				workspaceId: eventScope?.teamId ?? ctx.teamId,
 				channelId: mention.channel,
 				channelType: channelType ?? "channel",
 				userId: normalizeOptionalString(mention.user) ?? "unknown",
@@ -2462,7 +2853,11 @@ function registerSlackMessageEvents(params) {
 			}));
 			await handleSlackMessage(mention, {
 				source: "app_mention",
-				wasMentioned: true
+				wasMentioned: true,
+				...eventScope ? {
+					eventScope,
+					awaitDispatch: true
+				} : {}
 			});
 		} catch (err) {
 			ctx.runtime.error?.(danger(`slack mention handler failed: ${formatErrorMessage(err)}`));
@@ -2591,6 +2986,7 @@ function registerSlackMonitorEvents(params) {
 		ctx: params.ctx,
 		handleSlackMessage: params.handleSlackMessage
 	});
+	if (params.ctx.installationIdentity.kind === "enterprise") return;
 	registerSlackReactionEvents({
 		ctx: params.ctx,
 		trackEvent: params.trackEvent
@@ -2609,6 +3005,7 @@ function registerSlackMonitorEvents(params) {
 	});
 	registerSlackHomeEvents({
 		ctx: params.ctx,
+		slashCommandName: params.appHomeSlashCommandName,
 		trackEvent: params.trackEvent
 	});
 	registerSlackInteractionEvents({
@@ -2640,12 +3037,12 @@ const deliveredMessages = createPersistentDedupeCache({
 		}
 	}
 });
-function makeKey(accountId, channelId, ts) {
-	return `${accountId}:${channelId}:${ts}`;
+function makeKey(accountId, channelId, ts, teamId) {
+	return `${accountId}:${teamId ? `${teamId}:` : ""}${channelId}:${ts}`;
 }
 async function hasSlackInboundMessageDelivery(params) {
 	if (!params.accountId || !params.channelId || !params.ts) return false;
-	return await deliveredMessages.lookup(makeKey(params.accountId, params.channelId, params.ts));
+	return await deliveredMessages.lookup(makeKey(params.accountId, params.channelId, params.ts, params.teamId));
 }
 async function recordSlackInboundMessageDeliveries(params) {
 	if (!params.accountId || params.messages.length === 0) return;
@@ -2653,7 +3050,7 @@ async function recordSlackInboundMessageDeliveries(params) {
 	const keys = /* @__PURE__ */ new Set();
 	for (const message of params.messages) {
 		if (!message.channel || !message.ts) continue;
-		keys.add(makeKey(params.accountId, message.channel, message.ts));
+		keys.add(makeKey(params.accountId, message.channel, message.ts, params.teamId));
 	}
 	await Promise.all(Array.from(keys, (key) => deliveredMessages.register(key, { deliveredAt }, { at: deliveredAt })));
 }
@@ -2668,17 +3065,18 @@ function isSlackDirectMessageChannel(channelId) {
 function isTopLevelSlackMessage(message) {
 	return !message.thread_ts && !message.parent_user_id;
 }
-function buildTopLevelSlackConversationKey(message, accountId) {
+function buildTopLevelSlackConversationKey(message, accountId, teamId) {
 	if (!isTopLevelSlackMessage(message)) return null;
 	const senderId = resolveSlackSenderId(message);
 	if (!senderId) return null;
-	return `slack:${accountId}:${message.channel}:${senderId}`;
+	return `slack:${accountId}:${teamId ? `${teamId}:` : ""}${message.channel}:${senderId}`;
 }
-function buildSlackDebounceKey(message, accountId) {
+function buildSlackDebounceKey(message, accountId, teamId) {
 	const senderId = resolveSlackSenderId(message);
 	if (!senderId) return null;
 	const messageTs = message.ts ?? message.event_ts;
-	return `slack:${accountId}:${message.thread_ts ? `${message.channel}:${message.thread_ts}` : message.parent_user_id && messageTs ? `${message.channel}:maybe-thread:${messageTs}` : messageTs && !isSlackDirectMessageChannel(message.channel) ? `${message.channel}:${messageTs}` : message.channel}:${senderId}`;
+	const threadKey = message.thread_ts ? `${message.channel}:${message.thread_ts}` : message.parent_user_id && messageTs ? `${message.channel}:maybe-thread:${messageTs}` : messageTs && !isSlackDirectMessageChannel(message.channel) ? `${message.channel}:${messageTs}` : message.channel;
+	return `slack:${accountId}:${teamId ? `${teamId}:` : ""}${threadKey}:${senderId}`;
 }
 //#endregion
 //#region extensions/slack/src/monitor/thread-resolution.ts
@@ -2782,7 +3180,7 @@ function createSlackThreadTsResolver(params) {
 }
 //#endregion
 //#region extensions/slack/src/monitor/message-handler.ts
-const loadSlackMessagePipeline = createLazyRuntimeModule(() => import("./pipeline.runtime-rpVpay59.js"));
+const loadSlackMessagePipeline = createLazyRuntimeModule(() => import("./pipeline.runtime-f0eJJoJL.js"));
 function createSlackDispatchCompletion() {
 	let resolve;
 	let reject;
@@ -2799,14 +3197,7 @@ const APP_MENTION_RETRY_TTL_MS = 6e4;
 const RETRYABLE_FLUSH_MAX_ATTEMPTS = 3;
 const RETRYABLE_FLUSH_RETRY_DELAY_MS = 1e3;
 const REPLY_SESSION_INIT_CONFLICT_MESSAGE_RE = /reply session initialization conflicted for \S+/u;
-var SlackRetryableInboundError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "SlackRetryableInboundError";
-	}
-};
 function isRetryableSlackInboundError(error) {
-	if (error instanceof SlackRetryableInboundError) return true;
 	return collectErrorGraphCandidates(error, (current) => [current.cause, current.error]).some((candidate) => REPLY_SESSION_INIT_CONFLICT_MESSAGE_RE.test(formatErrorMessage(candidate)));
 }
 function shouldDebounceSlackMessage(message, cfg) {
@@ -2816,20 +3207,20 @@ function shouldDebounceSlackMessage(message, cfg) {
 		hasMedia: Boolean(message.files && message.files.length > 0)
 	});
 }
-function buildSeenMessageKey(channelId, ts) {
+function buildSeenMessageKey(channelId, ts, teamId) {
 	if (!channelId || !ts) return null;
-	return `${channelId}:${ts}`;
+	return `${teamId ? `${teamId}:` : ""}${channelId}:${ts}`;
 }
 function createSlackMessageHandler(params) {
 	const { ctx, account, trackEvent } = params;
 	const { debounceMs, debouncer } = createChannelInboundDebouncer({
 		cfg: ctx.cfg,
 		channel: "slack",
-		buildKey: (entry) => buildSlackDebounceKey(entry.message, ctx.accountId),
-		shouldDebounce: (entry) => shouldDebounceSlackMessage(entry.message, ctx.cfg),
+		buildKey: (entry) => buildSlackDebounceKey(entry.message, ctx.accountId, entry.opts.eventScope?.teamId),
+		shouldDebounce: (entry) => !entry.opts.eventScope && shouldDebounceSlackMessage(entry.message, ctx.cfg),
 		onFlush: async (entries) => {
 			const retryEntries = (sourceError) => {
-				if (!isRetryableSlackInboundError(sourceError)) return false;
+				if (!isRetryableSlackInboundError(sourceError) || entries.some((entry) => entry.opts.eventScope)) return false;
 				const nextEntries = entries.map((entry) => {
 					if (entry.opts.dispatchCompletion) return null;
 					const retryAttempt = entry.opts.retryAttempt ?? 0;
@@ -2856,8 +3247,9 @@ function createSlackMessageHandler(params) {
 				await (async () => {
 					const last = entries.at(-1);
 					if (!last) return;
-					const flushedKey = buildSlackDebounceKey(last.message, ctx.accountId);
-					const topLevelConversationKey = buildTopLevelSlackConversationKey(last.message, ctx.accountId);
+					const teamId = last.opts.eventScope?.teamId;
+					const flushedKey = buildSlackDebounceKey(last.message, ctx.accountId, teamId);
+					const topLevelConversationKey = buildTopLevelSlackConversationKey(last.message, ctx.accountId, teamId);
 					if (flushedKey && topLevelConversationKey) {
 						const pendingKeys = pendingTopLevelDebounceKeys.get(topLevelConversationKey);
 						if (pendingKeys) {
@@ -2871,7 +3263,7 @@ function createSlackMessageHandler(params) {
 						...last.message,
 						text: combinedText
 					};
-					const seenMessageKey = buildSeenMessageKey(last.message.channel, last.message.ts);
+					const seenMessageKey = buildSeenMessageKey(last.message.channel, last.message.ts, last.opts.eventScope?.teamId);
 					try {
 						const { prepareSlackMessage, dispatchPreparedSlackMessage } = await loadSlackMessagePipeline();
 						const { dispatchCompletion: _completion, awaitDispatch: _awaitDispatch, ...lastOpts } = last.opts;
@@ -2917,20 +3309,22 @@ function createSlackMessageHandler(params) {
 							await dispatchPreparedSlackMessage(prepared);
 							await recordSlackInboundMessageDeliveries({
 								accountId: ctx.accountId,
+								...last.opts.eventScope ? { teamId: last.opts.eventScope.teamId } : {},
 								messages: entries.map((entry) => entry.message)
 							});
 						} catch (error) {
 							if (!isRetryableSlackInboundError(error)) await recordSlackInboundMessageDeliveries({
 								accountId: ctx.accountId,
+								...last.opts.eventScope ? { teamId: last.opts.eventScope.teamId } : {},
 								messages: entries.map((entry) => entry.message)
 							});
 							throw error;
 						}
 					} catch (error) {
 						if (isRetryableSlackInboundError(error)) for (const entry of entries) {
-							const entrySeenKey = buildSeenMessageKey(entry.message.channel, entry.message.ts);
+							const entrySeenKey = buildSeenMessageKey(entry.message.channel, entry.message.ts, entry.opts.eventScope?.teamId);
 							if (entrySeenKey) appMentionDispatchedKeys.delete(entrySeenKey);
-							ctx.releaseSeenMessage(entry.message.channel, entry.message.ts);
+							ctx.releaseSeenMessage(entry.message.channel, entry.message.ts, entry.opts.eventScope);
 						}
 						throw error;
 					}
@@ -2980,25 +3374,28 @@ function createSlackMessageHandler(params) {
 	async function enqueueSlackMessage(message, opts) {
 		if (opts.source === "message" && message.type !== "message") return;
 		if (opts.source === "message" && message.subtype && message.subtype !== "file_share" && message.subtype !== "bot_message" && message.subtype !== "thread_broadcast") return;
-		const seenMessageKey = buildSeenMessageKey(message.channel, message.ts);
+		ctx.rememberSlackChannelType(message.channel, message.channel_type, opts.eventScope);
+		const seenMessageKey = buildSeenMessageKey(message.channel, message.ts, opts.eventScope?.teamId);
 		if (seenMessageKey && await hasSlackInboundMessageDelivery({
 			accountId: ctx.accountId,
 			channelId: message.channel,
-			ts: message.ts
+			ts: message.ts,
+			...opts.eventScope ? { teamId: opts.eventScope.teamId } : {}
 		})) return;
-		const wasSeen = seenMessageKey ? ctx.markMessageSeen(message.channel, message.ts) : false;
+		const wasSeen = seenMessageKey ? ctx.markMessageSeen(message.channel, message.ts, opts.eventScope) : false;
 		if (seenMessageKey && opts.source === "message" && !wasSeen) rememberAppMentionRetryKey(seenMessageKey);
 		if (seenMessageKey && wasSeen) {
 			if (opts.source !== "app_mention" || !consumeAppMentionRetryKey(seenMessageKey)) return;
 		}
 		trackEvent?.();
-		const resolvedMessage = await threadTsResolver.resolve({
+		const resolvedMessage = await (opts.eventScope ? createSlackThreadTsResolver({ client: opts.eventScope.client }) : threadTsResolver).resolve({
 			message,
 			source: opts.source
 		});
-		const debounceKey = buildSlackDebounceKey(resolvedMessage, ctx.accountId);
-		const conversationKey = buildTopLevelSlackConversationKey(resolvedMessage, ctx.accountId);
-		const canDebounce = debounceMs > 0 && shouldDebounceSlackMessage(resolvedMessage, ctx.cfg);
+		const teamId = opts.eventScope?.teamId;
+		const debounceKey = buildSlackDebounceKey(resolvedMessage, ctx.accountId, teamId);
+		const conversationKey = buildTopLevelSlackConversationKey(resolvedMessage, ctx.accountId, teamId);
+		const canDebounce = !opts.eventScope && debounceMs > 0 && shouldDebounceSlackMessage(resolvedMessage, ctx.cfg);
 		if (!canDebounce && conversationKey) {
 			const pendingKeys = pendingTopLevelDebounceKeys.get(conversationKey);
 			if (pendingKeys && pendingKeys.size > 0) {
@@ -3389,8 +3786,11 @@ async function gracefulStopSlackApp(app) {
 }
 function formatSlackResolvedLabel(params) {
 	const extras = params.extra?.filter(Boolean) ?? [];
-	const suffix = extras.length > 0 ? ` (id:${params.id}, ${extras.join(", ")})` : ` (id:${params.id})`;
-	return `${params.input}→${params.name ?? params.id}${suffix}`;
+	const display = params.name ?? params.id;
+	if (params.input === params.id && !params.name && extras.length === 0) return null;
+	const details = [...params.input === params.id || display === params.id ? [] : [`id:${params.id}`], ...extras];
+	const suffix = details.length > 0 ? ` (${details.join(", ")})` : "";
+	return `${params.input}→${display}${suffix}`;
 }
 function formatSlackChannelResolved(entry) {
 	const id = entry.id ?? entry.input;
@@ -3511,6 +3911,25 @@ function createSlackExternalArgMenuStore() {
 	};
 }
 //#endregion
+//#region extensions/slack/src/monitor/response-url-budget.ts
+const SLACK_RESPONSE_URL_MAX_CALLS = 5;
+var SlackResponseAlreadyReportedError = class extends Error {};
+function isSlackResponseAlreadyReportedError(error) {
+	return error instanceof SlackResponseAlreadyReportedError;
+}
+/** Count every response_url attempt, including requests Slack rejects. */
+function createSlackResponseUrlBudget(respond, maxCalls = SLACK_RESPONSE_URL_MAX_CALLS) {
+	let remaining = maxCalls;
+	return {
+		remaining: () => remaining,
+		respond: async (payload) => {
+			if (remaining <= 0) throw new Error(`Slack response_url cannot be used more than ${String(maxCalls)} times.`);
+			remaining -= 1;
+			return await respond(payload);
+		}
+	};
+}
+//#endregion
 //#region extensions/slack/src/monitor/room-context.ts
 function resolveSlackRoomContextHints(params) {
 	const untrustedChannelMetadata = params.isRoomish ? buildUntrustedChannelMetadata({
@@ -3541,7 +3960,7 @@ const SLACK_COMMAND_ARG_CONFIRM_TEXT_MAX = 300;
 const SLACK_HEADER_TEXT_MAX = 150;
 const SLACK_COMMAND_ARG_ACTION_BLOCKS_MAX = 47;
 const loadSlashCommandsRuntime = createLazyRuntimeModule(() => import("./slash-commands.runtime-BTTMlmwy.js"));
-const loadSlashDispatchRuntime = createLazyRuntimeModule(() => import("./slash-dispatch.runtime-CcMbbT3_.js"));
+const loadSlashDispatchRuntime = createLazyRuntimeModule(() => import("./slash-dispatch.runtime-C0Otuf_T.js"));
 const loadSlackPluginCommandsRuntime = createLazyRuntimeModule(() => import("./slash-plugin-commands.runtime-Dosfcx3X.js"));
 const loadSlashSkillCommandsRuntime = createLazyRuntimeModule(() => import("./slash-skill-commands.runtime-CD1J2ODY.js"));
 function resolveSlackCommandMenuModelContext(params) {
@@ -3771,7 +4190,12 @@ async function registerSlackMonitorSlashCommands(params) {
 	let supportsExternalArgMenus = typeof ctx.app.options === "function";
 	const slashCommand = resolveSlackSlashCommandConfig(ctx.slashCommand ?? account.config.slashCommand);
 	const handleSlashCommand = async (p) => {
-		const { command, ack, respond, body, prompt, commandArgs, commandDefinition } = p;
+		const { command, ack, respond: respondWithoutBudget, body, prompt, commandArgs, commandDefinition } = p;
+		const responseBudget = p.responseTransport === "web-api" ? {
+			respond: respondWithoutBudget,
+			remaining: () => void 0
+		} : createSlackResponseUrlBudget(respondWithoutBudget);
+		const respond = responseBudget.respond;
 		const cfg = getRuntimeConfigSnapshot() ?? ctx.cfg;
 		try {
 			if (ctx.shouldDropMismatchedSlackEvent?.(body)) {
@@ -3887,7 +4311,7 @@ async function registerSlackMonitorSlashCommands(params) {
 				modeWhenAccessGroupsOff: "configured"
 			});
 			const senderGate = slashIngress.senderAccess.gate;
-			if (isRoom && senderGate?.allowed === false) {
+			if (isRoomish && senderGate?.allowed === false) {
 				await respond({
 					text: "You are not authorized to use this command here.",
 					response_type: "ephemeral"
@@ -4062,15 +4486,19 @@ async function registerSlackMonitorSlashCommands(params) {
 						cfg,
 						channel: "slack",
 						accountId: route.accountId
-					})
+					}),
+					responseBudget
 				});
 			};
+			const pendingSlashReplies = [];
 			const { counts } = await dispatchReplyWithDispatcher({
 				ctx: ctxPayload,
 				cfg,
 				dispatcherOptions: {
 					...replyPipeline,
-					deliver: async (payload) => deliverSlashPayloads([payload]),
+					deliver: async (payload) => {
+						pendingSlashReplies.push(payload);
+					},
 					onError: (err, info) => {
 						runtime.error?.(danger(`slack slash ${info.kind} reply failed: ${formatSlackError(err)}`));
 					}
@@ -4080,10 +4508,11 @@ async function registerSlackMonitorSlashCommands(params) {
 					onModelSelected
 				}
 			});
-			if (counts.final + counts.tool + counts.block === 0) await deliverSlashPayloads([]);
+			if (pendingSlashReplies.length > 0) await deliverSlashPayloads(pendingSlashReplies);
+			else if (counts.final + counts.tool + counts.block === 0) await deliverSlashPayloads([]);
 		} catch (err) {
 			runtime.error?.(danger(`slack slash handler failed: ${formatErrorMessage(err)}`));
-			await respond({
+			if (!isSlackResponseAlreadyReportedError(err) && responseBudget.remaining() !== 0) await respond({
 				text: "Sorry, something went wrong handling that command.",
 				response_type: "ephemeral"
 			});
@@ -4117,7 +4546,16 @@ async function registerSlackMonitorSlashCommands(params) {
 			nativeCommands.push(pluginCommand);
 		}
 	}
-	if (nativeCommands.length > 0) {
+	if (slashCommand.enabled) ctx.app.command(buildSlackSlashCommandMatcher(slashCommand.name), async ({ command, ack, respond, body }) => {
+		await handleSlashCommand({
+			command,
+			ack,
+			respond,
+			body,
+			prompt: command.text?.trim() ?? ""
+		});
+	});
+	else if (nativeCommands.length > 0) {
 		if (!slashCommandsRuntime) throw new Error("Missing commands runtime for native Slack commands.");
 		for (const command of nativeCommands) ctx.app.command(`/${command.name}`, async ({ command: cmd, ack, respond, body }) => {
 			const commandDefinition = slashCommandsRuntime.findCommandByNativeName(command.name, "slack");
@@ -4134,17 +4572,12 @@ async function registerSlackMonitorSlashCommands(params) {
 				commandDefinition: commandDefinition ?? void 0
 			});
 		});
-	} else if (slashCommand.enabled) ctx.app.command(buildSlackSlashCommandMatcher(slashCommand.name), async ({ command, ack, respond, body }) => {
-		await handleSlashCommand({
-			command,
-			ack,
-			respond,
-			body,
-			prompt: command.text?.trim() ?? ""
-		});
-	});
-	else logVerbose("slack: slash commands disabled");
-	if (nativeCommands.length === 0 || !supportsInteractiveArgMenus) return;
+	} else logVerbose("slack: slash commands disabled");
+	const registration = nativeCommands.length > 0 ? { mode: "native" } : slashCommand.enabled ? {
+		mode: "single",
+		name: slashCommand.name
+	} : { mode: "disabled" };
+	if (nativeCommands.length === 0 || !supportsInteractiveArgMenus) return registration;
 	const registerArgOptions = () => {
 		const appWithOptions = ctx.app;
 		if (typeof appWithOptions.options !== "function") return;
@@ -4190,21 +4623,24 @@ async function registerSlackMonitorSlashCommands(params) {
 	}
 	const registerArgAction = (actionId) => {
 		ctx.app.action(actionId, async (args) => {
-			const { ack, body, respond } = args;
+			const { ack, body } = args;
+			const respond = args.respond;
 			const action = args.action;
 			await ack();
 			if (ctx.shouldDropMismatchedSlackEvent?.(body)) {
 				runtime.log?.("slack: drop slash arg action payload (mismatched app/team)");
 				return;
 			}
-			const respondFn = respond ?? (async (payload) => {
+			const respondFn = respond ?? (async (message) => {
 				if (!body.channel?.id || !body.user?.id) return;
+				const payload = typeof message === "string" ? { text: message } : message;
 				await ctx.app.client.chat.postEphemeral({
 					token: ctx.botToken,
 					channel: body.channel.id,
 					user: body.user.id,
-					text: payload.text,
-					blocks: payload.blocks
+					text: payload.text ?? "",
+					...payload.blocks ? { blocks: payload.blocks } : {},
+					...typeof payload.mrkdwn === "boolean" ? { mrkdwn: payload.mrkdwn } : {}
 				});
 			});
 			const parsed = parseSlackCommandArgValue(action?.value ?? action?.selected_option?.value);
@@ -4240,6 +4676,7 @@ async function registerSlackMonitorSlashCommands(params) {
 				command: commandPayload,
 				ack: async () => {},
 				respond: respondFn,
+				responseTransport: respond ? "response-url" : "web-api",
 				body,
 				prompt,
 				commandArgs,
@@ -4248,6 +4685,7 @@ async function registerSlackMonitorSlashCommands(params) {
 		});
 	};
 	registerArgAction(SLACK_COMMAND_ARG_ACTION_LISTENER);
+	return registration;
 }
 //#endregion
 //#region extensions/slack/src/monitor/provider.ts
@@ -4262,7 +4700,7 @@ async function getSlackBoltInterop() {
 	}
 	return slackBoltInterop;
 }
-const loadSlackRelaySource = createLazyRuntimeModule(() => import("./relay-source-D2jv1iGg.js"));
+const loadSlackRelaySource = createLazyRuntimeModule(() => import("./relay-source-B-6LFUdz.js"));
 const SLACK_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
 const SLACK_WEBHOOK_BODY_TIMEOUT_MS = 3e4;
 function resolveStableSlackUserIdEntry(raw) {
@@ -4336,6 +4774,19 @@ async function monitorSlackProvider(opts = {}) {
 	const sessionScope = sessionCfg?.scope ?? "per-sender";
 	const mainKey = normalizeMainKey(sessionCfg?.mainKey);
 	const slackMode = opts.mode ?? account.config.mode ?? "socket";
+	const enterpriseOrgInstall = account.config.enterpriseOrgInstall === true;
+	if (enterpriseOrgInstall && slackMode === "relay") throw new Error(`Slack Enterprise Grid org account "${account.accountId}" requires direct socket or HTTP delivery; relay mode is unsupported`);
+	if (enterpriseOrgInstall && account.config.execApprovals?.enabled === true) throw new Error(`Slack Enterprise Grid org account "${account.accountId}" does not support Slack-native exec approvals`);
+	if (enterpriseOrgInstall) {
+		assertEnterpriseSlackPolicyConfig({
+			config: account.config,
+			accountId: account.accountId
+		});
+		assertNoEnterpriseSlackBindings({
+			cfg,
+			accountId: account.accountId
+		});
+	}
 	const slackWebhookPath = normalizeSlackWebhookPath(account.config.webhookPath);
 	const signingSecret = normalizeResolvedSecretInputString({
 		value: account.config.signingSecret,
@@ -4363,6 +4814,12 @@ async function monitorSlackProvider(opts = {}) {
 		cfg,
 		accountId: account.accountId
 	});
+	if (enterpriseOrgInstall) assertEnterpriseSlackDmPolicy({
+		accountId: account.accountId,
+		dmEnabled,
+		dmPolicy,
+		allowFrom
+	});
 	const groupDmEnabled = dmConfig?.groupEnabled ?? false;
 	const groupDmChannels = dmConfig?.groupChannels;
 	let channelsConfig = slackCfg.channels;
@@ -4432,24 +4889,22 @@ async function monitorSlackProvider(opts = {}) {
 	}) : () => {};
 	let botUserId = "";
 	let botId = "";
-	let teamId = "";
-	let apiAppId = "";
 	const expectedApiAppIdFromAppToken = slackMode === "socket" ? parseApiAppIdFromAppToken(appToken) : void 0;
 	let authTestFailed = false;
 	let authTestError;
 	let authIdentityWarning;
+	let authTestIdentity;
 	try {
 		const auth = await app.client.auth.test();
 		const authUserId = normalizeOptionalString(auth.user_id) ?? "";
 		botId = normalizeOptionalString(auth.bot_id) ?? "";
 		botUserId = botId ? authUserId : "";
-		teamId = auth.team_id ?? "";
-		apiAppId = auth.api_app_id ?? "";
+		authTestIdentity = auth;
 		authIdentityWarning = formatSlackBotTokenIdentityWarning({
 			auth,
 			accountId: account.accountId
 		});
-		if (!authUserId) {
+		if (!authUserId && !enterpriseOrgInstall) {
 			authTestFailed = true;
 			authTestError = "auth.test returned no user_id";
 		}
@@ -4457,9 +4912,17 @@ async function monitorSlackProvider(opts = {}) {
 		authTestFailed = true;
 		authTestError = err instanceof Error ? err.message : String(err);
 	}
+	const installationIdentity = resolveSlackInstallationIdentity({
+		enterpriseOrgInstall,
+		auth: authTestFailed ? void 0 : authTestIdentity,
+		authError: authTestError,
+		transportApiAppId: expectedApiAppIdFromAppToken
+	});
+	const teamId = installationIdentity.kind === "workspace" ? installationIdentity.teamId : "";
+	const apiAppId = installationIdentity.kind === "degraded" ? "" : installationIdentity.apiAppId ?? "";
 	if (authTestFailed) runtime.log?.(warn(`[${account.accountId}] slack auth.test failed at boot (${authTestError ?? "unknown error"}); explicit bot-mention detection will be disabled until restart with a valid bot token; required-mention channels will fail closed without another trusted activation signal`));
 	if (authIdentityWarning) runtime.log?.(warn(authIdentityWarning));
-	if (apiAppId && expectedApiAppIdFromAppToken && apiAppId !== expectedApiAppIdFromAppToken) runtime.error?.(`slack token mismatch: bot token api_app_id=${apiAppId} but app token looks like api_app_id=${expectedApiAppIdFromAppToken}`);
+	if (apiAppId && expectedApiAppIdFromAppToken && apiAppId !== expectedApiAppIdFromAppToken) runtime.error?.(`slack token mismatch: bot token app_id=${apiAppId} but app token looks like app_id=${expectedApiAppIdFromAppToken}`);
 	const ctx = createSlackMonitorContext({
 		cfg,
 		accountId: account.accountId,
@@ -4471,6 +4934,7 @@ async function monitorSlackProvider(opts = {}) {
 		botId,
 		teamId,
 		apiAppId,
+		installationIdentity,
 		historyLimit,
 		dmHistoryLimit,
 		sessionScope,
@@ -4509,7 +4973,7 @@ async function monitorSlackProvider(opts = {}) {
 		account,
 		trackEvent
 	});
-	if (isSlackAnyNativeApprovalClientEnabled({
+	if (installationIdentity.kind !== "enterprise" && isSlackAnyNativeApprovalClientEnabled({
 		cfg,
 		accountId: account.accountId
 	})) registerChannelRuntimeContext({
@@ -4523,15 +4987,16 @@ async function monitorSlackProvider(opts = {}) {
 		},
 		abortSignal: opts.abortSignal
 	});
-	registerSlackMonitorEvents({
+	const commandRegistration = installationIdentity.kind === "enterprise" ? { mode: "disabled" } : await registerSlackMonitorSlashCommands({
 		ctx,
 		account,
-		handleSlackMessage,
 		trackEvent
 	});
-	await registerSlackMonitorSlashCommands({
+	registerSlackMonitorEvents({
 		ctx,
 		account,
+		handleSlackMessage,
+		appHomeSlashCommandName: commandRegistration.mode === "single" ? commandRegistration.name : void 0,
 		trackEvent
 	});
 	if (slackMode === "http" && slackHttpHandler) unregisterHttpHandler = registerSlackHttpHandler({
@@ -4540,7 +5005,7 @@ async function monitorSlackProvider(opts = {}) {
 		log: runtime.log,
 		accountId: account.accountId
 	});
-	if (resolveToken) (async () => {
+	if (resolveToken && installationIdentity.kind !== "enterprise") (async () => {
 		if (opts.abortSignal?.aborted) return;
 		if (channelsConfig && Object.keys(channelsConfig).length > 0) try {
 			const entries = Object.keys(channelsConfig).filter((key) => key !== "*");
@@ -4559,7 +5024,8 @@ async function monitorSlackProvider(opts = {}) {
 						unresolved.push(entry.input);
 						continue;
 					}
-					mapping.push(formatSlackChannelResolved(entry));
+					const resolvedLabel = formatSlackChannelResolved(entry);
+					if (resolvedLabel) mapping.push(resolvedLabel);
 					const existing = nextChannels[entry.id] ?? {};
 					nextChannels[entry.id] = {
 						...source,
@@ -4721,4 +5187,4 @@ async function monitorSlackProvider(opts = {}) {
 }
 const resolveSlackRuntimeGroupPolicy = resolveOpenProviderRuntimeGroupPolicy$1;
 //#endregion
-export { stripSlackMentionsForCommandDetection as C, buildSlackSlashCommandMatcher as S, readSessionUpdatedAt as _, SLACK_SOCKET_RECONNECT_POLICY as a, resolveStorePath$1 as b, recordInboundSession as c, resolveSlackCommandIngress as d, resolveSlackEffectiveAllowFrom as f, resolveSlackChatType as g, normalizeSlackChannelType as h, authorizeSlackDirectMessage as i, resolveConversationLabel$1 as l, parseSlackAssistantThreadMetadata as m, resolveSlackRuntimeGroupPolicy as n, formatUnknownError as o, buildSlackAssistantThreadMetadata as p, resolveSlackRoomContextHints as r, escapeSlackMrkdwn as s, monitorSlackProvider as t, authorizeSlackBotRoomMessage as u, resolveChannelContextVisibilityMode as v, updateLastRoute as x, resolveChannelResetConfig as y };
+export { buildSlackSlashCommandMatcher as C, updateLastRoute as S, resolveSlackChatType as _, createSlackResponseUrlBudget as a, resolveChannelResetConfig as b, formatUnknownError as c, authorizeSlackBotRoomMessage as d, resolveSlackCommandIngress as f, normalizeSlackChannelType as g, parseSlackAssistantThreadMetadata as h, SlackResponseAlreadyReportedError as i, recordInboundSession as l, buildSlackAssistantThreadMetadata as m, resolveSlackRuntimeGroupPolicy as n, authorizeSlackDirectMessage as o, resolveSlackEffectiveAllowFrom as p, resolveSlackRoomContextHints as r, SLACK_SOCKET_RECONNECT_POLICY as s, monitorSlackProvider as t, resolveConversationLabel$1 as u, readSessionUpdatedAt as v, stripSlackMentionsForCommandDetection as w, resolveStorePath$1 as x, resolveChannelContextVisibilityMode as y };