@openclaw/slack 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{account-inspect-DEKpg9Ip.js → account-inspect-Drw2gAiN.js}

@@ -1,4 +1,4 @@
-import { i as resolveDefaultSlackAccountId, r as mergeSlackAccountConfig } from "./accounts-CHAeNZOX.js";
+import { i as resolveDefaultSlackAccountId, r as mergeSlackAccountConfig } from "./accounts-CK4AVI2_.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/account-inspect-api.js

@@ -1,4 +1,4 @@
-import { t as inspectSlackAccount } from "./account-inspect-DEKpg9Ip.js";
+import { t as inspectSlackAccount } from "./account-inspect-Drw2gAiN.js";
 //#region extensions/slack/account-inspect-api.ts
 function inspectSlackReadOnlyAccount(cfg, accountId) {
 	return inspectSlackAccount({

package/dist/{accounts-CHAeNZOX.js → accounts-CK4AVI2_.js}

@@ -1,6 +1,6 @@
 import { DEFAULT_ACCOUNT_ID, createAccountListHelpers, hasConfiguredAccountValue, normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { mapAllowFromEntries, normalizeChannelDmPolicy } from "openclaw/plugin-sdk/channel-config-helpers";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/routing";
 //#region extensions/slack/src/token.ts
@@ -60,7 +60,7 @@ function resolveSlackAccountConfig(cfg, accountId) {
 	return resolveAccountEntry(cfg.channels?.slack?.accounts, accountId);
 }
 function asStreamingConfigObject(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	return asOptionalRecord(value);
 }
 function asLegacyStreamingScalar(value) {
 	return typeof value === "boolean" || typeof value === "string" ? value : void 0;

package/dist/{accounts.runtime-BHD4Ma2R.js → accounts.runtime-Cb7QwWBz.js}

@@ -1,2 +1,2 @@
-import { a as resolveSlackAccount, l as resolveSlackOperationToken, o as resolveSlackAccountAllowFrom } from "./accounts-CHAeNZOX.js";
+import { a as resolveSlackAccount, l as resolveSlackOperationToken, o as resolveSlackAccountAllowFrom } from "./accounts-CK4AVI2_.js";
 export { resolveSlackAccount, resolveSlackAccountAllowFrom, resolveSlackOperationToken };

package/dist/{action-runtime-DfuYoMjG.js → action-runtime-BkGe7ny_.js}

@@ -1,8 +1,8 @@
-import { a as resolveSlackChannelId, i as parseSlackTarget } from "./target-parsing-N6lHogYZ.js";
-import { t as slackContextTargetsMatch } from "./targets-KmjP2E8s.js";
-import { C as hasSlackNativeDataBlock, rt as parseSlackBlocksInput } from "./group-policy-NQZti9t-.js";
-import { a as readPositiveIntegerParam, c as withNormalizedTimestamp, n as imageResultFromFile, o as readReactionParams, r as jsonResult, s as readStringParam, t as createActionGate } from "./runtime-api-QMb-Q5Ko.js";
-import { n as resolveSlackChannelConfig, t as isSlackChannelAllowedByPolicy } from "./policy-PRysPn23.js";
+import { a as parseSlackTarget, n as formatSlackTarget, o as resolveSlackChannelId } from "./target-parsing-BnMD2ZqZ.js";
+import { t as slackContextTargetsMatch } from "./targets-Cx5W_n3W.js";
+import { St as getSlackInstallationKind, T as hasSlackNativeDataBlock, lt as parseSlackBlocksInput, p as assertSlackDetachedTargetAllowed, t as buildSlackChannelIdCandidates } from "./group-policy-c4RP9bjc.js";
+import { a as readPositiveIntegerParam, c as withNormalizedTimestamp, n as imageResultFromFile, o as readReactionParams, r as jsonResult, s as readStringParam, t as createActionGate } from "./runtime-api-Cj9nxBNv.js";
+import { n as resolveSlackChannelConfig, t as isSlackChannelAllowedByPolicy } from "./policy-TapwbeaT.js";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
@@ -24,9 +24,10 @@ const pinActions = /* @__PURE__ */ new Set([
 	"unpinMessage",
 	"listPins"
 ]);
-const loadSlackActionsRuntime = createLazyRuntimeModule(() => import("./actions.runtime-BIRU_G4M.js"));
-const loadSlackAccountsRuntime = createLazyRuntimeModule(() => import("./accounts.runtime-BHD4Ma2R.js"));
-const loadSlackChannelTypeRuntime = createLazyRuntimeModule(() => import("./channel-type-DXyos1d2.js").then((n) => n.t));
+const SLACK_REACTION_USER_LIMIT = 100;
+const loadSlackActionsRuntime = createLazyRuntimeModule(() => import("./actions.runtime-DLFyUkvg.js"));
+const loadSlackAccountsRuntime = createLazyRuntimeModule(() => import("./accounts.runtime-Cb7QwWBz.js"));
+const loadSlackChannelTypeRuntime = createLazyRuntimeModule(() => import("./channel-type-B9MSdoGN.js").then((n) => n.t));
 function createLazySlackAction(key) {
 	return (async (...args) => {
 		const action = (await loadSlackActionsRuntime())[key];
@@ -116,7 +117,7 @@ async function isSlackDmTargetConfigured(params) {
 }
 function isCurrentSlackReadTarget(params) {
 	const requesterAccountId = params.context?.requesterAccountId?.trim();
-	return Boolean(normalizeOptionalLowercaseString(params.context?.currentChannelProvider) === "slack" && requesterAccountId && normalizeAccountId(requesterAccountId) === normalizeAccountId(params.account.accountId) && params.context && slackContextTargetsMatch(params.channelId, params.context));
+	return Boolean(normalizeOptionalLowercaseString(params.context?.currentChannelProvider) === "slack" && requesterAccountId && normalizeAccountId(requesterAccountId) === normalizeAccountId(params.account.accountId) && params.context && slackContextTargetsMatch(params.target, params.context));
 }
 function assertSlackMemberInfoAllowed(params) {
 	if (params.context?.conversationReadOrigin === "direct-operator") return;
@@ -128,6 +129,8 @@ function resolveSlackChannelReadPolicy(params) {
 	const channels = params.account.config.channels;
 	const channelKeys = Object.keys(channels ?? {});
 	const channelConfig = resolveSlackChannelConfig({
+		teamId: params.teamId,
+		allowUnscoped: getSlackInstallationKind(params.account.accountId) !== "enterprise",
 		channelId: params.channelId,
 		channelName: params.channelName,
 		channels,
@@ -163,7 +166,7 @@ function resolveSlackChannelReadPolicy(params) {
 	return {
 		channelAllowed: baseChannelAllowed,
 		channelExplicitlyDisabled,
-		groupDmAllowed: params.account.config.dm?.enabled !== false && params.account.config.dm?.groupEnabled === true && (params.currentConversation || isSlackGroupDmTargetConfigured(params.account, params.channelId)),
+		groupDmAllowed: params.account.config.dm?.enabled !== false && params.account.config.dm?.groupEnabled === true && (params.currentConversation || isSlackGroupDmTargetConfigured(params.account, params.channelId, params.teamId)),
 		shouldResolveName
 	};
 }
@@ -173,7 +176,11 @@ async function assertSlackReadTargetAllowed(params) {
 	};
 	const currentConversation = isCurrentSlackReadTarget({
 		account: params.account,
-		channelId: params.channelId,
+		target: formatSlackTarget({
+			teamId: params.teamId,
+			kind: "channel",
+			id: params.channelId
+		}),
 		context: params.context
 	});
 	const directOperator = params.conversationReadOrigin === "direct-operator";
@@ -184,6 +191,7 @@ async function assertSlackReadTargetAllowed(params) {
 			cfg: params.cfg,
 			accountId: params.account.accountId,
 			channelId: params.channelId,
+			teamId: params.teamId,
 			operation: "read"
 		});
 		if (info.type !== "dm" || !await isSlackDmTargetConfigured({
@@ -205,6 +213,7 @@ async function assertSlackReadTargetAllowed(params) {
 		cfg: params.cfg,
 		accountId: params.account.accountId,
 		channelId: params.channelId,
+		teamId: params.teamId,
 		operation: "read",
 		...preliminary.shouldResolveName ? { requireFreshName: true } : {}
 	});
@@ -225,17 +234,53 @@ async function assertSlackReadTargetAllowed(params) {
 	}
 	if (!(info.type === "channel" ? resolved.channelAllowed : info.type === "group" ? resolved.groupDmAllowed : resolved.channelAllowed && resolved.groupDmAllowed)) deny();
 }
-function isSlackGroupDmTargetConfigured(account, channelId) {
+function isSlackGroupDmTargetConfigured(account, channelId, teamId) {
 	const entries = account.config.dm?.groupChannels ?? [];
 	if (entries.length === 0) return true;
+	const candidates = new Set(buildSlackChannelIdCandidates(channelId, teamId, { allowUnscoped: getSlackInstallationKind(account.accountId) !== "enterprise" }).map((candidate) => candidate.toLowerCase()));
 	const target = channelId.trim().toLowerCase();
 	return entries.some((entry) => {
 		const candidate = String(entry).trim().toLowerCase();
-		return candidate === "*" || candidate === target || candidate === `slack:${target}` || candidate === `channel:${target}` || candidate === `group:${target}` || candidate === `mpim:${target}`;
+		return candidate === "*" || candidates.has(candidate) || candidate === target || candidate === `slack:${target}` || candidate === `channel:${target}` || candidate === `group:${target}` || candidate === `mpim:${target}`;
+	});
+}
+function resolveTrustedCurrentSlackTeamId(params) {
+	const requesterAccountId = params.context?.requesterAccountId?.trim();
+	if (normalizeOptionalLowercaseString(params.context?.currentChannelProvider) !== "slack" || !requesterAccountId || normalizeAccountId(requesterAccountId) !== normalizeAccountId(params.account.accountId)) return;
+	const matchingTeams = /* @__PURE__ */ new Map();
+	for (const raw of [params.context?.currentChannelId, params.context?.currentMessagingTarget]) {
+		if (!raw) continue;
+		const current = parseSlackTarget(raw);
+		if (current?.teamId && (!params.target || current.kind === params.target.kind && current.id.toLowerCase() === params.target.id.toLowerCase())) matchingTeams.set(current.teamId.toLowerCase(), current.teamId);
+	}
+	return matchingTeams.size === 1 ? matchingTeams.values().next().value : void 0;
+}
+function resolveSlackActionTarget(account, raw, context) {
+	const parsed = parseSlackTarget(raw, { defaultKind: "channel" });
+	if (!parsed) throw new Error("Slack target is required.");
+	const teamId = parsed.teamId ?? resolveTrustedCurrentSlackTeamId({
+		account,
+		target: parsed,
+		context
 	});
+	assertSlackDetachedTargetAllowed(account.accountId, teamId);
+	return {
+		routingTarget: teamId ? formatSlackTarget({
+			teamId,
+			kind: parsed.kind,
+			id: parsed.id
+		}) : raw,
+		teamId
+	};
+}
+function resolveSlackActionChannelTarget(account, raw, context) {
+	const resolved = resolveSlackActionTarget(account, raw, context);
+	return {
+		channelId: resolveSlackChannelId(raw),
+		teamId: resolved.teamId
+	};
 }
 async function handleSlackAction(params, cfg, context) {
-	const resolveChannelId = () => resolveSlackChannelId(readStringParam(params, "channelId", { required: true }));
 	const action = readStringParam(params, "action", { required: true });
 	const accountId = readStringParam(params, "accountId");
 	const { resolveSlackAccount, resolveSlackOperationToken } = await loadSlackAccountsRuntime();
@@ -243,38 +288,42 @@ async function handleSlackAction(params, cfg, context) {
 		cfg,
 		accountId
 	});
-	if (account.config.enterpriseOrgInstall === true) throw new Error("Slack action tools are unavailable for Enterprise Grid org installs.");
+	const resolveChannelTarget = () => resolveSlackActionChannelTarget(account, readStringParam(params, "channelId", { required: true }), context);
 	const isActionEnabled = createActionGate(account.actions ?? cfg.channels?.slack?.actions);
 	const botToken = account.botToken?.trim();
-	const buildActionOpts = (operation) => {
+	const buildActionOpts = (operation, teamId) => {
 		const token = resolveSlackOperationToken(account, operation);
 		if (!token && account.identity === "user") throw new Error(`Slack operation token missing for account "${account.accountId}".`);
 		const tokenOverride = token && token !== botToken ? token : void 0;
 		return {
 			cfg,
 			...accountId ? { accountId } : {},
-			...tokenOverride ? { token: tokenOverride } : {}
+			...tokenOverride ? { token: tokenOverride } : {},
+			teamId
 		};
 	};
-	const readOpts = buildActionOpts("read");
-	const writeOpts = buildActionOpts("write");
-	const assertReadTargetAllowed = async (channelId) => await assertSlackReadTargetAllowed({
-		account,
-		cfg,
-		channelId,
-		conversationReadOrigin: context?.conversationReadOrigin,
-		context
-	});
+	const assertReadTargetAllowed = async (target) => {
+		await assertSlackReadTargetAllowed({
+			account,
+			cfg,
+			channelId: target.channelId,
+			teamId: target.teamId,
+			conversationReadOrigin: context?.conversationReadOrigin,
+			context
+		});
+	};
 	if (reactionsActions.has(action)) {
 		if (!isActionEnabled("reactions")) throw new Error("Slack reactions are disabled.");
-		const channelId = resolveChannelId();
+		const target = resolveChannelTarget();
+		const { channelId } = target;
+		const readOpts = buildActionOpts("read", target.teamId);
+		const writeOpts = buildActionOpts("write", target.teamId);
 		const messageId = readStringParam(params, "messageId", { required: true });
 		if (action === "react") {
 			const { emoji, remove, isEmpty } = readReactionParams(params, { removeErrorMessage: "Emoji is required to remove a Slack reaction." });
-			await assertReadTargetAllowed(channelId);
+			await assertReadTargetAllowed(target);
 			if (remove) {
-				if (writeOpts) await slackActionRuntime.removeSlackReaction(channelId, messageId, emoji, writeOpts);
-				else await slackActionRuntime.removeSlackReaction(channelId, messageId, emoji);
+				await slackActionRuntime.removeSlackReaction(channelId, messageId, emoji, writeOpts);
 				return jsonResult({
 					ok: true,
 					removed: emoji
@@ -282,44 +331,47 @@ async function handleSlackAction(params, cfg, context) {
 			}
 			if (isEmpty) return jsonResult({
 				ok: true,
-				removed: writeOpts ? await slackActionRuntime.removeOwnSlackReactions(channelId, messageId, writeOpts) : await slackActionRuntime.removeOwnSlackReactions(channelId, messageId)
+				removed: await slackActionRuntime.removeOwnSlackReactions(channelId, messageId, writeOpts)
 			});
-			if (writeOpts) await slackActionRuntime.reactSlackMessage(channelId, messageId, emoji, writeOpts);
-			else await slackActionRuntime.reactSlackMessage(channelId, messageId, emoji);
+			await slackActionRuntime.reactSlackMessage(channelId, messageId, emoji, writeOpts);
 			return jsonResult({
 				ok: true,
 				added: emoji
 			});
 		}
-		await assertReadTargetAllowed(channelId);
+		await assertReadTargetAllowed(target);
+		const limit = Math.min(readPositiveIntegerParam(params, "limit", { message: "limit must be a positive integer." }) ?? SLACK_REACTION_USER_LIMIT, SLACK_REACTION_USER_LIMIT);
 		return jsonResult({
 			ok: true,
-			reactions: readOpts ? await slackActionRuntime.listSlackReactions(channelId, messageId, readOpts) : await slackActionRuntime.listSlackReactions(channelId, messageId)
+			reactions: (await slackActionRuntime.listSlackReactions(channelId, messageId, readOpts))?.map((reaction) => reaction.users ? Object.assign({}, reaction, { users: reaction.users.slice(0, limit) }) : reaction)
 		});
 	}
 	if (messagingActions.has(action)) {
 		if (!isActionEnabled("messages")) throw new Error("Slack messages are disabled.");
 		switch (action) {
 			case "sendMessage": {
-				const to = readStringParam(params, "to", { required: true });
+				const destination = resolveSlackActionTarget(account, readStringParam(params, "to", { required: true }), context).routingTarget;
 				const content = readStringParam(params, "content", { allowEmpty: true });
 				const mediaUrl = readStringParam(params, "mediaUrl");
 				const blocks = readSlackBlocksParam(params);
 				const replyBroadcast = readBooleanParam(params, "replyBroadcast");
 				const textIsSlackMrkdwn = readBooleanParam(params, "textIsSlackMrkdwn");
 				const textIsSlackPlainText = readBooleanParam(params, "textIsSlackPlainText");
+				const forceDocument = readBooleanParam(params, "forceDocument") === true;
 				const preparedMessages = context?.preparedMessages;
 				const authoredTextPlacement = readStringParam(params, "authoredTextPlacement");
 				if (authoredTextPlacement && authoredTextPlacement !== "none" && authoredTextPlacement !== "blocks" && authoredTextPlacement !== "outside-blocks") throw new Error("Slack authoredTextPlacement is invalid.");
 				const nativeDataFallbackBaseText = readStringParam(params, "nativeDataFallbackBaseText", { allowEmpty: true });
 				if (!content && !mediaUrl && !blocks && !preparedMessages?.length) throw new Error("Slack sendMessage requires content, blocks, or mediaUrl.");
 				if (replyBroadcast && mediaUrl) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
-				const threadTs = resolveThreadTsFromContext(readStringParam(params, "threadTs"), to, context, { suppressImplicitThread: params.topLevel === true || params.threadTs === null });
+				const threadTs = resolveThreadTsFromContext(readStringParam(params, "threadTs"), destination, context, { suppressImplicitThread: params.topLevel === true || params.threadTs === null });
 				const baseSendOpts = {
-					...writeOpts,
+					...buildActionOpts("write"),
+					mediaAccess: context?.mediaAccess,
 					mediaLocalRoots: context?.mediaLocalRoots,
 					mediaReadFile: context?.mediaReadFile,
-					threadTs: threadTs ?? void 0
+					threadTs: threadTs ?? void 0,
+					...forceDocument ? { forceDocument: true } : {}
 				};
 				const sendOpts = {
 					...baseSendOpts,
@@ -333,24 +385,24 @@ async function handleSlackAction(params, cfg, context) {
 					const shouldSplitLongContent = content && content.length > 8e3 && !hasSlackNativeDataBlock(blocks);
 					if (content && shouldSplitLongContent) {
 						const { replyBroadcast: _replyBroadcast, ...blockSendOpts } = sendOpts;
-						await slackActionRuntime.sendSlackMessage(to, "", {
+						await slackActionRuntime.sendSlackMessage(destination, "", {
 							...blockSendOpts,
 							blocks
 						});
-						return await slackActionRuntime.sendSlackMessage(to, content, sendOpts);
+						return await slackActionRuntime.sendSlackMessage(destination, content, sendOpts);
 					}
-					return await slackActionRuntime.sendSlackMessage(to, content ?? "", {
+					return await slackActionRuntime.sendSlackMessage(destination, content ?? "", {
 						...sendOpts,
 						blocks
 					});
 				};
 				const result = preparedMessages?.length ? await (async () => {
 					let lastResult;
-					if (mediaUrl) lastResult = await slackActionRuntime.sendSlackMessage(to, "", {
+					if (mediaUrl) lastResult = await slackActionRuntime.sendSlackMessage(destination, "", {
 						...baseSendOpts,
 						mediaUrl
 					});
-					for (const [index, message] of preparedMessages.entries()) lastResult = await slackActionRuntime.sendSlackMessage(to, message.text, {
+					for (const [index, message] of preparedMessages.entries()) lastResult = await slackActionRuntime.sendSlackMessage(destination, message.text, {
 						...baseSendOpts,
 						...index === 0 && replyBroadcast ? { replyBroadcast: true } : {},
 						...message.blocks ? { blocks: message.blocks } : {},
@@ -361,24 +413,24 @@ async function handleSlackAction(params, cfg, context) {
 					if (!lastResult) throw new Error("Slack prepared message plan produced no delivery.");
 					return lastResult;
 				})() : blocks ? await (async () => {
-					if (mediaUrl) await slackActionRuntime.sendSlackMessage(to, "", {
+					if (mediaUrl) await slackActionRuntime.sendSlackMessage(destination, "", {
 						...sendOpts,
 						mediaUrl
 					});
 					return await sendContentAndBlocks();
-				})() : await slackActionRuntime.sendSlackMessage(to, content ?? "", {
+				})() : await slackActionRuntime.sendSlackMessage(destination, content ?? "", {
 					...sendOpts,
 					mediaUrl: mediaUrl ?? void 0,
 					blocks
 				});
-				if (context?.hasRepliedRef && slackContextTargetsMatch(to, context)) context.hasRepliedRef.value = true;
+				if (context?.hasRepliedRef && slackContextTargetsMatch(destination, context)) context.hasRepliedRef.value = true;
 				return jsonResult({
 					ok: true,
 					result
 				});
 			}
 			case "uploadFile": {
-				const to = readStringParam(params, "to", { required: true });
+				const destination = resolveSlackActionTarget(account, readStringParam(params, "to", { required: true }), context).routingTarget;
 				const filePath = readStringParam(params, "filePath", {
 					required: true,
 					trim: false
@@ -386,48 +438,55 @@ async function handleSlackAction(params, cfg, context) {
 				const initialComment = readStringParam(params, "initialComment", { allowEmpty: true });
 				const filename = readStringParam(params, "filename");
 				const title = readStringParam(params, "title");
+				const forceDocument = readBooleanParam(params, "forceDocument") === true;
 				if (readBooleanParam(params, "replyBroadcast")) throw new Error("Slack replyBroadcast is only supported for text or block thread replies.");
-				const threadTs = resolveThreadTsFromContext(readStringParam(params, "threadTs"), to, context, { suppressImplicitThread: params.topLevel === true || params.threadTs === null });
-				const result = await slackActionRuntime.sendSlackMessage(to, initialComment ?? "", {
-					...writeOpts,
+				const threadTs = resolveThreadTsFromContext(readStringParam(params, "threadTs"), destination, context, { suppressImplicitThread: params.topLevel === true || params.threadTs === null });
+				const result = await slackActionRuntime.sendSlackMessage(destination, initialComment ?? "", {
+					...buildActionOpts("write"),
 					mediaUrl: filePath,
+					mediaAccess: context?.mediaAccess,
 					mediaLocalRoots: context?.mediaLocalRoots,
 					mediaReadFile: context?.mediaReadFile,
 					threadTs: threadTs ?? void 0,
+					...forceDocument ? { forceDocument: true } : {},
 					...filename ? { uploadFileName: filename } : {},
 					...title ? { uploadTitle: title } : {}
 				});
-				if (context?.hasRepliedRef && slackContextTargetsMatch(to, context)) context.hasRepliedRef.value = true;
+				if (context?.hasRepliedRef && slackContextTargetsMatch(destination, context)) context.hasRepliedRef.value = true;
 				return jsonResult({
 					ok: true,
 					result
 				});
 			}
 			case "editMessage": {
-				const channelId = resolveChannelId();
+				const target = resolveChannelTarget();
+				const { channelId } = target;
 				const messageId = readStringParam(params, "messageId", { required: true });
 				const content = readStringParam(params, "content", { allowEmpty: true });
 				const blocks = readSlackBlocksParam(params);
 				if (!content && !blocks) throw new Error("Slack editMessage requires content or blocks.");
-				await assertReadTargetAllowed(channelId);
-				if (writeOpts) await slackActionRuntime.editSlackMessage(channelId, messageId, content ?? "", {
+				await assertReadTargetAllowed(target);
+				const writeOpts = buildActionOpts("write", target.teamId);
+				await slackActionRuntime.editSlackMessage(channelId, messageId, content ?? "", {
 					...writeOpts,
 					blocks
 				});
-				else await slackActionRuntime.editSlackMessage(channelId, messageId, content ?? "", { blocks });
 				return jsonResult({ ok: true });
 			}
 			case "deleteMessage": {
-				const channelId = resolveChannelId();
+				const target = resolveChannelTarget();
+				const { channelId } = target;
 				const messageId = readStringParam(params, "messageId", { required: true });
-				await assertReadTargetAllowed(channelId);
-				if (writeOpts) await slackActionRuntime.deleteSlackMessage(channelId, messageId, writeOpts);
-				else await slackActionRuntime.deleteSlackMessage(channelId, messageId);
+				await assertReadTargetAllowed(target);
+				const writeOpts = buildActionOpts("write", target.teamId);
+				await slackActionRuntime.deleteSlackMessage(channelId, messageId, writeOpts);
 				return jsonResult({ ok: true });
 			}
 			case "readMessages": {
-				const channelId = resolveChannelId();
-				await assertReadTargetAllowed(channelId);
+				const target = resolveChannelTarget();
+				const { channelId } = target;
+				await assertReadTargetAllowed(target);
+				const readOpts = buildActionOpts("read", target.teamId);
 				const limit = readPositiveIntegerParam(params, "limit", { message: "limit must be a positive integer." });
 				const before = readStringParam(params, "before");
 				const after = readStringParam(params, "after");
@@ -454,14 +513,16 @@ async function handleSlackAction(params, cfg, context) {
 				const fileId = readStringParam(params, "fileId", { required: true });
 				const channelTarget = readStringParam(params, "channelId") ?? readStringParam(params, "to") ?? context?.currentChannelId;
 				if (!channelTarget) throw new Error("Slack file download requires channelId or to so the read target can be authorized.");
-				const channelId = resolveSlackChannelId(channelTarget);
-				await assertReadTargetAllowed(channelId);
+				const target = resolveSlackActionChannelTarget(account, channelTarget, context);
+				const { channelId } = target;
+				await assertReadTargetAllowed(target);
 				const threadId = readStringParam(params, "threadId") ?? readStringParam(params, "replyTo");
 				const maxBytes = account.config?.mediaMaxMb ? account.config.mediaMaxMb * 1024 * 1024 : 20 * 1024 * 1024;
 				const readToken = resolveSlackOperationToken(account, "read");
+				const readOpts = buildActionOpts("read", target.teamId);
 				const downloaded = await slackActionRuntime.downloadSlackFile(fileId, {
 					...readOpts,
-					...readToken && !readOpts?.token ? { token: readToken } : {},
+					...readToken && !readOpts.token ? { token: readToken } : {},
 					maxBytes,
 					channelId,
 					threadId: threadId ?? void 0
@@ -499,25 +560,26 @@ async function handleSlackAction(params, cfg, context) {
 	}
 	if (pinActions.has(action)) {
 		if (!isActionEnabled("pins")) throw new Error("Slack pins are disabled.");
-		const channelId = resolveChannelId();
+		const target = resolveChannelTarget();
+		const { channelId } = target;
+		const readOpts = buildActionOpts("read", target.teamId);
+		const writeOpts = buildActionOpts("write", target.teamId);
 		if (action === "pinMessage") {
 			const messageId = readStringParam(params, "messageId", { required: true });
-			await assertReadTargetAllowed(channelId);
-			if (writeOpts) await slackActionRuntime.pinSlackMessage(channelId, messageId, writeOpts);
-			else await slackActionRuntime.pinSlackMessage(channelId, messageId);
+			await assertReadTargetAllowed(target);
+			await slackActionRuntime.pinSlackMessage(channelId, messageId, writeOpts);
 			return jsonResult({ ok: true });
 		}
 		if (action === "unpinMessage") {
 			const messageId = readStringParam(params, "messageId", { required: true });
-			await assertReadTargetAllowed(channelId);
-			if (writeOpts) await slackActionRuntime.unpinSlackMessage(channelId, messageId, writeOpts);
-			else await slackActionRuntime.unpinSlackMessage(channelId, messageId);
+			await assertReadTargetAllowed(target);
+			await slackActionRuntime.unpinSlackMessage(channelId, messageId, writeOpts);
 			return jsonResult({ ok: true });
 		}
-		await assertReadTargetAllowed(channelId);
+		await assertReadTargetAllowed(target);
 		return jsonResult({
 			ok: true,
-			pins: (writeOpts ? await slackActionRuntime.listSlackPins(channelId, readOpts) : await slackActionRuntime.listSlackPins(channelId)).map((pin) => {
+			pins: (await slackActionRuntime.listSlackPins(channelId, readOpts)).map((pin) => {
 				const message = pin.message ? withNormalizedTimestamp(pin.message, pin.message.ts) : pin.message;
 				return message ? Object.assign({}, pin, { message }) : pin;
 			})
@@ -531,15 +593,25 @@ async function handleSlackAction(params, cfg, context) {
 			context,
 			userId
 		});
+		const teamId = resolveTrustedCurrentSlackTeamId({
+			account,
+			context
+		});
+		assertSlackDetachedTargetAllowed(account.accountId, teamId);
 		return jsonResult({
 			ok: true,
-			info: readOpts ? await slackActionRuntime.getSlackMemberInfo(userId, readOpts) : await slackActionRuntime.getSlackMemberInfo(userId)
+			info: await slackActionRuntime.getSlackMemberInfo(userId, buildActionOpts("read", teamId))
 		});
 	}
 	if (action === "emojiList") {
 		if (!isActionEnabled("emojiList")) throw new Error("Slack emoji list is disabled.");
 		const limit = readPositiveIntegerParam(params, "limit", { message: "limit must be a positive integer." });
-		const result = readOpts ? await slackActionRuntime.listSlackEmojis(readOpts) : await slackActionRuntime.listSlackEmojis();
+		const teamId = resolveTrustedCurrentSlackTeamId({
+			account,
+			context
+		});
+		assertSlackDetachedTargetAllowed(account.accountId, teamId);
+		const result = await slackActionRuntime.listSlackEmojis(buildActionOpts("read", teamId));
 		if (limit != null && limit > 0 && result.emoji != null) {
 			const entries = Object.entries(result.emoji).toSorted(([a], [b]) => a.localeCompare(b));
 			if (entries.length > limit) return jsonResult({

package/dist/action-runtime.runtime-D9I6uc0Q.js

@@ -0,0 +1,2 @@
+import { t as handleSlackAction } from "./action-runtime-BkGe7ny_.js";
+export { handleSlackAction };