@openclaw/slack 2026.9.1-beta.1 → 2026.9.2

package/dist/{policy-BoP6t88v.js → policy-Bh5TOqII.js}

@@ -1,4 +1,5 @@
-import { f as normalizeSlackSlug, m as resolveSlackUserAllowListForTeam, n as buildSlackChannelPolicyScope, t as buildSlackChannelIdCandidates } from "./group-policy-CU1tEGpS.js";
+import { i as buildSlackChannelPolicyScope, r as buildSlackChannelIdCandidates } from "./session-status-BynwcZSO.js";
+import { D as resolveSlackUserAllowListForTeam, T as normalizeSlackSlug } from "./probe-Biy--yhL.js";
 import { applyChannelMatchMeta, buildChannelKeyCandidates } from "openclaw/plugin-sdk/channel-targets";
 import { mergePairLoopGuardConfig } from "openclaw/plugin-sdk/pair-loop-guard-runtime";
 //#region extensions/slack/src/monitor/channel-config.ts
@@ -17,9 +18,10 @@ function resolveSlackChannelConfig(params) {
 	const keys = channelKeys ?? Object.keys(entries);
 	const normalizedName = channelName ? normalizeSlackSlug(channelName) : "";
 	const directName = channelName ? channelName.trim() : "";
+	const candidates = buildChannelKeyCandidates(...buildSlackChannelIdCandidates(channelId, params.teamId, { allowUnscoped: params.allowUnscoped }), allowNameMatching ? channelName ? `#${directName}` : void 0 : void 0, allowNameMatching ? directName : void 0, allowNameMatching ? normalizedName : void 0);
 	const match = buildSlackChannelPolicyScope({
 		channels: entries,
-		candidates: buildChannelKeyCandidates(...buildSlackChannelIdCandidates(channelId, params.teamId, { allowUnscoped: params.allowUnscoped }), allowNameMatching ? channelName ? `#${directName}` : void 0 : void 0, allowNameMatching ? directName : void 0, allowNameMatching ? normalizedName : void 0)
+		candidates
 	});
 	const { entry: matched, wildcardEntry: fallback } = match;
 	const requireMentionDefault = defaultRequireMention ?? true;
@@ -46,7 +48,7 @@ function resolveSlackChannelConfig(params) {
 	const skills = firstDefined(resolved.skills, fallback?.skills);
 	const systemPrompt = firstDefined(resolved.systemPrompt, fallback?.systemPrompt);
 	const presenceEvents = firstDefined(resolved.presenceEvents, fallback?.presenceEvents);
-	return applyChannelMatchMeta({
+	const result = {
 		allowed,
 		requireMention,
 		ignoreOtherMentions,
@@ -57,7 +59,8 @@ function resolveSlackChannelConfig(params) {
 		skills,
 		systemPrompt,
 		presenceEvents
-	}, match);
+	};
+	return applyChannelMatchMeta(result, match);
 }
 //#endregion
 //#region extensions/slack/src/monitor/policy.ts

package/dist/{probe-4_aHtVT3.js → probe-Biy--yhL.js}

@@ -1,16 +1,130 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { u as formatSlackBotTokenIdentityWarning } from "./accounts-Dm_H77gH.js";
+import { a as parseSlackTarget } from "./target-parsing-PbxGDbr9.js";
 import { createRequire } from "node:module";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isRecord, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
+import { compileAllowlist, resolveCompiledAllowlistMatch } from "openclaw/plugin-sdk/allow-from";
+import { normalizeHyphenSlug, normalizeStringEntries as normalizeStringEntries$1, normalizeStringEntriesLower } from "openclaw/plugin-sdk/string-normalization-runtime";
 import { runChannelProbe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createHash } from "node:crypto";
-import { WebClient } from "@slack/web-api";
+import { WebAPIRateLimitedError, WebClient } from "@slack/web-api";
 import { addActiveManagedProxyTlsOptions, resolveEnvHttpProxyAgentOptions, resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
 import { isDebugProxyGlobalFetchPatchInstalled } from "openclaw/plugin-sdk/proxy-capture";
+import { parseRetryAfterHeaderSeconds, retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { redactSensitiveText } from "openclaw/plugin-sdk/logging-core";
+import { defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
+//#region extensions/slack/src/monitor/allow-list.ts
+const SLACK_SLUG_CACHE_MAX = 512;
+const SLACK_STABLE_USER_ID_RE = /^[ubw][a-z0-9]+$/;
+const slackSlugCache = /* @__PURE__ */ new Map();
+function normalizeSlackSlug(raw) {
+	const key = raw ?? "";
+	const cached = slackSlugCache.get(key);
+	if (cached !== void 0) return cached;
+	const normalized = normalizeHyphenSlug(raw);
+	slackSlugCache.set(key, normalized);
+	if (slackSlugCache.size > SLACK_SLUG_CACHE_MAX) {
+		const oldest = slackSlugCache.keys().next();
+		if (!oldest.done) slackSlugCache.delete(oldest.value);
+	}
+	return normalized;
+}
+function normalizeAllowList(list) {
+	return normalizeStringEntries$1(list);
+}
+function normalizeAllowListLower(list) {
+	return normalizeStringEntriesLower(list);
+}
+function normalizeSlackAllowOwnerEntry(entry) {
+	const trimmed = normalizeOptionalLowercaseString(entry);
+	if (!trimmed || trimmed === "*") return;
+	try {
+		const target = parseSlackTarget(trimmed);
+		if (target?.kind === "user" && target.teamId) return target.id.toLowerCase();
+	} catch {
+		return;
+	}
+	const withoutPrefix = trimmed.replace(/^(slack:|user:)/, "");
+	return SLACK_STABLE_USER_ID_RE.test(withoutPrefix) ? withoutPrefix : void 0;
+}
+function resolveSlackAllowListMatch(params) {
+	const compiledAllowList = compileAllowlist(params.allowList);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	const id = normalizeOptionalLowercaseString(params.id);
+	const name = normalizeOptionalLowercaseString(params.name);
+	const slug = normalizeSlackSlug(name);
+	const scopedCandidates = [{
+		value: teamId && id ? `team:${teamId}:user:${id}` : void 0,
+		source: "workspace-id"
+	}];
+	const unscopedCandidates = [
+		{
+			value: id,
+			source: "id"
+		},
+		{
+			value: id ? `slack:${id}` : void 0,
+			source: "prefixed-id"
+		},
+		{
+			value: id ? `user:${id}` : void 0,
+			source: "prefixed-user"
+		},
+		...params.allowNameMatching === true ? [
+			{
+				value: name,
+				source: "name"
+			},
+			{
+				value: name ? `slack:${name}` : void 0,
+				source: "prefixed-name"
+			},
+			{
+				value: slug,
+				source: "slug"
+			}
+		] : []
+	];
+	return resolveCompiledAllowlistMatch({
+		compiledAllowlist: compiledAllowList,
+		candidates: [...scopedCandidates, ...unscopedCandidates]
+	});
+}
+function allowListMatches(params) {
+	return resolveSlackAllowListMatch(params).allowed;
+}
+function resolveSlackUserAllowed(params) {
+	const allowList = normalizeAllowListLower(params.allowList);
+	if (allowList.length === 0) return true;
+	return allowListMatches({
+		allowList,
+		teamId: params.teamId,
+		id: params.userId,
+		name: params.userName,
+		allowNameMatching: params.allowNameMatching
+	});
+}
+function resolveSlackUserAllowListForTeam(params) {
+	const allowList = normalizeAllowListLower(params.allowList);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	return allowList.flatMap((entry) => {
+		if (entry === "*") return [entry];
+		if (!entry.startsWith("team:")) return [entry];
+		try {
+			const target = parseSlackTarget(entry);
+			if (target?.kind === "user" && target.teamId?.toLowerCase() === teamId) return [entry];
+			return params.preserveUnmatchedScopedEntries ? [entry] : [];
+		} catch {
+			return params.preserveUnmatchedScopedEntries ? [entry] : [];
+		}
+	});
+}
+//#endregion
 //#region extensions/slack/src/client-options.ts
 const requireFromSlackSocketMode = (() => {
-	return createRequire(createRequire(import.meta.url).resolve("@slack/socket-mode/package.json"));
+	const require = createRequire(import.meta.url);
+	return createRequire(require.resolve("@slack/socket-mode/package.json"));
 })();
 function loadSlackUndiciRuntime() {
 	return requireFromSlackSocketMode("undici");
@@ -25,6 +139,11 @@ const SLACK_DEFAULT_RETRY_OPTIONS = {
 const SLACK_WRITE_RETRY_OPTIONS = { retries: 0 };
 const SLACK_READ_TIMEOUT_MS = 3e4;
 const SLACK_LOOKUP_RETRY_OPTIONS = { retries: 0 };
+function normalizeSlackFetchInit(init) {
+	if (init?.body !== "") return init;
+	const { body: _body, ...rest } = init;
+	return rest;
+}
 /** Build the dispatcher shared by Slack Web API fetches and Socket Mode. */
 function resolveSlackProxyDispatcher() {
 	const options = resolveEnvHttpProxyAgentOptions();
@@ -37,12 +156,16 @@ function resolveSlackProxyDispatcher() {
 	}
 }
 function buildSlackFetch(dispatcher) {
-	if (!dispatcher || isDebugProxyGlobalFetchPatchInstalled()) return resolveFetch();
+	if (!dispatcher || isDebugProxyGlobalFetchPatchInstalled()) {
+		const slackFetch = resolveFetch();
+		if (!slackFetch) return;
+		return ((input, init) => slackFetch(input, normalizeSlackFetchInit(init)));
+	}
 	const { fetch: slackFetch } = loadSlackUndiciRuntime();
 	return ((input, init) => {
 		const slackInput = input;
 		const slackInit = {
-			...init,
+			...normalizeSlackFetchInit(init),
 			dispatcher
 		};
 		return slackFetch(slackInput, slackInit);
@@ -73,6 +196,27 @@ function resolveSlackWriteClientOptions(options = {}, dispatcher = resolveSlackP
 	const resolved = Object.assign({}, options);
 	applySlackApiUrlAndProxyOptions(resolved, dispatcher);
 	resolved.retryConfig ??= SLACK_WRITE_RETRY_OPTIONS;
+	if (resolved.rejectRateLimitedCalls !== true && resolved.retryConfig.retries === 0) {
+		const slackFetch = resolved.fetch ?? buildSlackFetch(dispatcher);
+		if (slackFetch) resolved.fetch = (input, init) => retryAsync(async () => {
+			init?.signal?.throwIfAborted();
+			const response = await slackFetch(input, init);
+			if (response.status !== 429) return response;
+			const retryAfter = parseRetryAfterHeaderSeconds(response.headers.get("retry-after"));
+			response.body?.cancel().catch(() => void 0);
+			init?.signal?.throwIfAborted();
+			if (retryAfter === void 0 || retryAfter * 1e3 > 2147e6) return response;
+			throw new WebAPIRateLimitedError(retryAfter);
+		}, {
+			attempts: 3,
+			minDelayMs: 0,
+			maxDelayMs: 0,
+			shouldRetry: (error) => error instanceof WebAPIRateLimitedError,
+			retryAfterMs: (error) => error instanceof WebAPIRateLimitedError ? error.retryAfter * 1e3 : void 0,
+			sleep: (delayMs) => sleepWithAbort(delayMs, init?.signal)
+		});
+		resolved.rejectRateLimitedCalls = true;
+	}
 	return resolved;
 }
 function resolveSlackLookupClientOptions(options = {}, dispatcher = resolveSlackProxyDispatcher()) {
@@ -89,7 +233,7 @@ const SLACK_WRITE_CLIENT_CACHE_MAX = 32;
 const SLACK_STARTUP_AUTH_TIMEOUT_MS = 1e4;
 const SLACK_STARTUP_AUTH_RETRY_BUDGET_MS = 35e3;
 const slackWriteClientCache = /* @__PURE__ */ new Map();
-const slackListenerUploadCompletionClientCache = /* @__PURE__ */ new WeakMap();
+const slackListenerWriteClientCache = /* @__PURE__ */ new WeakMap();
 function createSlackWebClient(token, options = {}) {
 	return new WebClient(token, resolveSlackWebClientOptions(options));
 }
@@ -153,11 +297,11 @@ function getSlackWriteClient(token, options = {}) {
 	slackWriteClientCache.set(tokenKey, client);
 	return client;
 }
-function getSlackListenerUploadCompletionClient(params) {
+function getSlackListenerWriteClient(params) {
 	const token = params.listenerClient.token?.trim();
-	const teamId = params.teamId.trim().toUpperCase();
-	if (!token || !teamId) return;
-	const cached = slackListenerUploadCompletionClientCache.get(params.listenerClient);
+	const teamId = params.teamId?.trim().toUpperCase();
+	if (!token) return;
+	const cached = slackListenerWriteClientCache.get(params.listenerClient);
 	if (cached) return cached.teamId === teamId ? cached.client : void 0;
 	const headers = Object.fromEntries(Object.entries(params.clientOptions?.headers ?? {}).filter(([name]) => name.toLowerCase() !== "authorization"));
 	const client = new WebClient(token, resolveSlackWriteClientOptions({
@@ -168,7 +312,7 @@ function getSlackListenerUploadCompletionClient(params) {
 		retryConfig: SLACK_WRITE_RETRY_OPTIONS,
 		timeout: 0
 	}));
-	slackListenerUploadCompletionClientCache.set(params.listenerClient, {
+	slackListenerWriteClientCache.set(params.listenerClient, {
 		teamId,
 		client
 	});
@@ -279,6 +423,101 @@ function formatSlackError(error, fallback = NO_ERROR_DETAIL) {
 	return safeStringify(error) ?? fallback;
 }
 //#endregion
+//#region extensions/slack/src/monitor/ingress-identity.ts
+const SLACK_USER_NAME_KIND = "plugin:slack-user-name";
+const SLACK_WORKSPACE_USER_ID_KIND = "plugin:slack-workspace-user-id";
+function normalizeSlackUserId(raw) {
+	const value = (raw ?? "").trim().toLowerCase();
+	if (!value) return "";
+	const mention = value.match(/^<@([a-z0-9_]+)>$/i);
+	if (mention?.[1]) return mention[1];
+	return value.replace(/^(slack:|user:)/, "");
+}
+function isSlackStableUserId(value) {
+	return /^[ubw][a-z0-9_]+$/i.test(value);
+}
+function normalizeSlackWorkspaceUserEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized) return null;
+	try {
+		const target = parseSlackTarget(normalized);
+		if (target?.kind === "user" && target.teamId) return target.normalized;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function normalizeSlackBareUserEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized || normalizeSlackWorkspaceUserEntry(normalized)) return null;
+	const userId = normalizeSlackUserId(normalized);
+	return isSlackStableUserId(userId) ? userId : null;
+}
+function normalizeSlackStableEntry(entry) {
+	return normalizeSlackBareUserEntry(entry) ?? normalizeSlackWorkspaceUserEntry(entry);
+}
+function normalizeSlackNameEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized || normalizeSlackStableEntry(normalized)) return null;
+	return normalized.replace(/^slack:/, "") || null;
+}
+function normalizeSlackNameSubject(value) {
+	return value.trim().toLowerCase() || null;
+}
+function normalizeSlackNameSlugEntry(entry) {
+	const name = normalizeSlackNameEntry(entry);
+	if (!name) return null;
+	return normalizeSlackSlug(name) || null;
+}
+const slackIngressIdentity = defineStableChannelIngressIdentity({
+	resolveParticipant: (subject) => {
+		const qualified = subject.aliases?.workspaceSenderId;
+		if (typeof qualified !== "string") return;
+		const normalized = normalizeSlackWorkspaceUserEntry(qualified);
+		const target = normalized ? parseSlackTarget(normalized) : void 0;
+		return target?.teamId ? {
+			domain: target.teamId,
+			idKind: target.id.startsWith("b") ? "bot-id" : "user-id",
+			id: target.id
+		} : void 0;
+	},
+	key: "senderId",
+	kind: "stable-id",
+	authentication: "asserted",
+	normalizeEntry: normalizeSlackBareUserEntry,
+	normalizeSubject: normalizeSlackUserId,
+	sensitivity: "pii",
+	aliases: [{
+		key: "workspaceSenderId",
+		kind: SLACK_WORKSPACE_USER_ID_KIND,
+		authentication: "asserted",
+		normalizeEntry: normalizeSlackWorkspaceUserEntry,
+		normalizeSubject: normalizeSlackWorkspaceUserEntry,
+		sensitivity: "pii"
+	}, ...[["senderName", normalizeSlackNameEntry], ["senderNameSlug", normalizeSlackNameSlugEntry]].map(([key, normalizeEntry]) => ({
+		key,
+		kind: SLACK_USER_NAME_KIND,
+		normalizeEntry,
+		normalizeSubject: normalizeSlackNameSubject,
+		authentication: "mutable",
+		sensitivity: "pii"
+	}))]
+});
+function createSlackIngressSubject(params) {
+	const senderId = normalizeSlackUserId(params.senderId);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	const senderName = params.senderName?.trim().toLowerCase();
+	const senderNameSlug = senderName ? normalizeSlackSlug(senderName) : void 0;
+	return {
+		stableId: senderId,
+		aliases: {
+			workspaceSenderId: teamId && senderId ? `team:${teamId}:user:${senderId}` : void 0,
+			senderName,
+			senderNameSlug
+		}
+	};
+}
+//#endregion
 //#region extensions/slack/src/probe.ts
 var probe_exports = /* @__PURE__ */ __exportAll({ probeSlack: () => probeSlack });
 async function probeSlack(token, timeoutMs = 2500, opts) {
@@ -343,4 +582,4 @@ async function probeSlack(token, timeoutMs = 2500, opts) {
 	}));
 }
 //#endregion
-export { resolveSlackWriteClientOptions as _, createSlackReadClient as a, createSlackWebClient as c, getSlackWriteClient as d, SLACK_DEFAULT_RETRY_OPTIONS as f, resolveSlackWebClientOptions as g, resolveSlackProxyDispatcher as h, createSlackLookupClient as i, createSlackWriteClient as l, resolveSlackLookupClientOptions as m, probe_exports as n, createSlackStartupAuthClient as o, SLACK_WRITE_RETRY_OPTIONS as p, formatSlackError as r, createSlackTokenCacheKey as s, probeSlack as t, getSlackListenerUploadCompletionClient as u };
+export { normalizeAllowListLower as C, resolveSlackUserAllowListForTeam as D, resolveSlackAllowListMatch as E, resolveSlackUserAllowed as O, normalizeAllowList as S, normalizeSlackSlug as T, resolveSlackLookupClientOptions as _, slackIngressIdentity as a, resolveSlackWriteClientOptions as b, createSlackReadClient as c, createSlackWebClient as d, createSlackWriteClient as f, SLACK_WRITE_RETRY_OPTIONS as g, SLACK_DEFAULT_RETRY_OPTIONS as h, createSlackIngressSubject as i, createSlackStartupAuthClient as l, getSlackWriteClient as m, probe_exports as n, formatSlackError as o, getSlackListenerWriteClient as p, SLACK_USER_NAME_KIND as r, createSlackLookupClient as s, probeSlack as t, createSlackTokenCacheKey as u, resolveSlackProxyDispatcher as v, normalizeSlackAllowOwnerEntry as w, allowListMatches as x, resolveSlackWebClientOptions as y };