@opentag/slack 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,17 +1,30 @@
 // src/events.ts
-import { parseThreadActionCommand } from "@opentag/core";
+import {
+  createDoctorSummaryPresentation,
+  createSourceThreadStatusPresentation,
+  parseProjectTargetRef,
+  parseThreadActionCommand,
+  renderOpenTagPresentationPlainText
+} from "@opentag/core";
 
 // src/normalize.ts
 import { commandFromRawText } from "@opentag/core";
+var LEADING_MENTION_RUN = /^(?:<@[^>]+>\s*)+/;
+var MENTION_TOKEN = /<@([^>]+)>/g;
 function stripSlackAppMention(text2, botUserId) {
-  const patterns = botUserId ? [new RegExp(`^<@${botUserId}>\\s*`, "i"), /^<@[^>]+>\s*/] : [/^<@[^>]+>\s*/];
-  for (const pattern of patterns) {
-    const stripped = text2.replace(pattern, "").trim();
-    if (stripped !== text2.trim()) {
-      return stripped.length > 0 ? stripped : null;
-    }
+  const run = text2.match(LEADING_MENTION_RUN);
+  if (!run) return null;
+  const leadingRun = run[0];
+  if (botUserId) {
+    const mentionedIds = leadingRun.match(MENTION_TOKEN) ?? [];
+    const botIsMentioned = mentionedIds.some((token) => {
+      const id = token.slice(2, -1).split("|")[0] ?? "";
+      return id.toLowerCase() === botUserId.toLowerCase();
+    });
+    if (!botIsMentioned) return null;
   }
-  return null;
+  const stripped = text2.slice(leadingRun.length).trim();
+  return stripped.length > 0 ? stripped : null;
 }
 function encodeSlackThreadKey(input) {
   return `${input.teamId}|${input.channelId}|${input.threadTs}`;
@@ -23,18 +36,27 @@ function parseSlackThreadKey(threadKey) {
   }
   return { teamId, channelId, threadTs };
 }
-function permissionsForIntent(intent) {
+var UNKNOWN_WRITE_VERB_PATTERN = /\b(add|append|apply|change|commit|create|delete|edit|fix|modify|open\s+a?\s*pr|pull\s+request|remove|update|write)\b/i;
+var REPO_WRITE_TARGET_PATTERN = /\b(repo|repository|code|file|files|branch|commit|diff|patch|readme|pr|pull\s+request|package\.json|pnpm|npm|test|build)\b|(?:^|\s)[./\w-]+\.(?:cjs|css|gitignore|go|html|js|json|jsx|lock|md|mjs|py|rb|rs|sh|toml|ts|tsx|txt|yaml|yml)\b|(?:^|[\s`'"(])(?:[./\w-]+\/)?(?:Dockerfile|Makefile|Procfile|Rakefile|Gemfile|Brewfile|Justfile|Taskfile|\.dockerignore|\.env(?:\.[\w-]+)?|\.gitignore|\.npmrc)(?=$|[\s`'",.):])/i;
+function commandLooksRepoWriteCapable(command) {
+  return UNKNOWN_WRITE_VERB_PATTERN.test(command.rawText) && REPO_WRITE_TARGET_PATTERN.test(command.rawText);
+}
+function permissionsForCommand(command) {
   const permissions = [
     {
       scope: "chat:postMessage",
       reason: "reply in the originating Slack thread"
     },
+    {
+      scope: "reactions:write",
+      reason: "mark the originating Slack message as received without posting a thread reply"
+    },
     {
       scope: "runner:local",
       reason: "execute the run on a paired local daemon"
     }
   ];
-  if (intent === "fix" || intent === "run") {
+  if (command.intent === "fix" || command.intent === "run" || command.intent === "unknown" && commandLooksRepoWriteCapable(command)) {
     permissions.push(
       {
         scope: "repo:read",
@@ -129,7 +151,7 @@ function normalizeSlackAppMention(input) {
       },
       ...contextPointersForCommand(command)
     ],
-    permissions: permissionsForIntent(command.intent),
+    permissions: permissionsForCommand(command),
     callback: {
       provider: "slack",
       uri: input.callbackUri ?? "https://slack.com/api/chat.postMessage",
@@ -143,8 +165,11 @@ function normalizeSlackAppMention(input) {
       teamId: input.teamId,
       channelId: input.channelId,
       messageTs: input.ts,
+      sourceDeliveryId: input.eventId,
+      slackEventId: input.eventId,
       ...input.appId ? { slackAppId: input.appId } : {},
       ...input.botUserId ? { slackBotUserId: input.botUserId } : {},
+      ...typeof input.signatureVerified === "boolean" ? { webhookSignatureVerified: input.signatureVerified, signatureState: input.signatureVerified ? "verified" : "unverified" } : {},
       ...commandMetadata(command),
       repoProvider: input.binding.repoProvider ?? "github",
       owner: input.binding.owner,
@@ -153,6 +178,414 @@ function normalizeSlackAppMention(input) {
   };
 }
 
+// src/render.ts
+import {
+  createFinalSummaryPresentation
+} from "@opentag/core";
+var MAX_SLACK_SUGGESTED_ACTION_CANDIDATES = 20;
+function buildSlackSuggestedActionButtonValue(input) {
+  return JSON.stringify(input);
+}
+function parseSlackSuggestedActionButtonValue(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed.version !== 1 || typeof parsed.command !== "string" || parsed.command.trim().length === 0 || typeof parsed.proposalId !== "string" || parsed.proposalId.length === 0 || typeof parsed.intentId !== "string" || parsed.intentId.length === 0) {
+      return null;
+    }
+    return {
+      version: 1,
+      command: parsed.command.trim(),
+      proposalId: parsed.proposalId,
+      intentId: parsed.intentId
+    };
+  } catch {
+    return null;
+  }
+}
+function escapeSlackText(text2) {
+  return text2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function markdownToSlackMrkdwn(text2) {
+  const links = [];
+  const withoutLinks = text2.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_match, label, url) => {
+    const token = `\0SLACK_LINK_${links.length}\0`;
+    links.push(`<${url}|${escapeSlackText(label)}>`);
+    return token;
+  });
+  const converted = escapeSlackText(withoutLinks).replace(/\*\*(.+?)\*\*/g, "*$1*").replace(/__(.+?)__/g, "*$1*");
+  return links.reduce((output, link, index) => output.replace(`\0SLACK_LINK_${index}\0`, link), converted);
+}
+function markdownToSlackActionDetail(text2) {
+  return markdownToSlackMrkdwn(text2).replace(/-&gt;/g, "->");
+}
+function renderSlackAcknowledgement(runId) {
+  void runId;
+  return "Working on it.";
+}
+function slackSourceReceiptReactionName(state) {
+  if (state === "received") return "eyes";
+  if (state === "running") return "hourglass_flowing_sand";
+  return "eyes";
+}
+function createSlackReactionPayload(input) {
+  return {
+    channel: input.channelId,
+    timestamp: input.messageTs,
+    name: input.name
+  };
+}
+function truncateSlackText(text2, maxLength) {
+  const normalized = text2.replace(/\s+/g, " ").trim();
+  if (normalized.length <= maxLength) return normalized;
+  return `${normalized.slice(0, Math.max(0, maxLength - 1)).trimEnd()}\u2026`;
+}
+function firstMarkdownSection(text2, heading) {
+  const pattern = new RegExp(`\\*\\*${heading}:\\*\\*\\s*([\\s\\S]*?)(?=\\n\\s*\\n\\*\\*[^*]+:\\*\\*|\\n\\s*\\n[A-Z][^\\n]{0,60}:|$)`, "i");
+  const match = text2.match(pattern);
+  return match?.[1]?.trim();
+}
+function compactSlackSummary(summary) {
+  const whatChanged = firstMarkdownSection(summary, "What changed");
+  const firstParagraph = summary.split(/\n\s*\n/).map((part) => part.trim()).find(Boolean);
+  const selected = whatChanged ?? firstParagraph ?? summary;
+  return truncateSlackText(selected.replace(/^\*\*[^*]+:\*\*\s*/i, ""), 360);
+}
+function compactNextAction(nextAction) {
+  return truncateSlackText(nextAction, 180);
+}
+function resultForFinalSummaryPresentation(result) {
+  if (!result.suggestedChanges) return result;
+  const visibleSuggestedChanges = result.suggestedChanges.filter((snapshot) => snapshot.intents.length > 0);
+  if (visibleSuggestedChanges.length === result.suggestedChanges.length) return result;
+  const { suggestedChanges: _suggestedChanges, ...withoutSuggestedChanges } = result;
+  return visibleSuggestedChanges.length > 0 ? { ...withoutSuggestedChanges, suggestedChanges: visibleSuggestedChanges } : withoutSuggestedChanges;
+}
+function slackSection(text2) {
+  return {
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: text2
+    }
+  };
+}
+function slackContext(text2) {
+  return {
+    type: "context",
+    elements: [{ type: "mrkdwn", text: text2 }]
+  };
+}
+function slackCheckStatusLabel(status) {
+  if (status === "ok") return "OK";
+  if (status === "warn") return "WARN";
+  if (status === "fail") return "FAIL";
+  return "UNKNOWN";
+}
+function slackStatusActiveRun(presentation) {
+  if (!presentation.activeRun) return "none";
+  return `${presentation.activeRun.id} (${presentation.activeRun.status})${presentation.activeRun.updatedAt ? `, updated ${presentation.activeRun.updatedAt}` : ""}`;
+}
+function slackStatusQueuedFollowUps(presentation) {
+  const total = presentation.queuedFollowUpsTotal ?? presentation.queuedFollowUps.length;
+  if (total === 0) return "none";
+  const visible = presentation.queuedFollowUps.map((followUp) => {
+    const status = followUp.status ? ` (${followUp.status})` : "";
+    const command = followUp.command ? `: ${markdownToSlackMrkdwn(truncateSlackText(followUp.command, 120))}` : "";
+    return `${followUp.id}${status}${command}`;
+  });
+  const remaining = Math.max(total - visible.length, 0);
+  return `${total}${visible.length ? ` (${visible.join(", ")}${remaining > 0 ? `, +${remaining} more` : ""})` : ""}`;
+}
+function renderPresentationActionLines(action) {
+  const lines = [`${action.index}. *${markdownToSlackMrkdwn(action.title)}*`];
+  lines.push(`Target: ${markdownToSlackMrkdwn(action.targetLabel)}`);
+  if (action.setupReason) {
+    lines.push(`Status: ${markdownToSlackMrkdwn(action.setupReason)}`);
+  }
+  if (action.details?.length) {
+    lines.push(...action.details.map(markdownToSlackActionDetail));
+  }
+  return lines;
+}
+var ACTION_RECEIPT_GROUP_ORDER = [
+  "ready_to_apply",
+  "needs_setup",
+  "needs_approval",
+  "unsupported"
+];
+function actionReceiptGroupTitle(state) {
+  if (state === "ready_to_apply") return "Ready to apply";
+  if (state === "needs_setup") return "Needs setup";
+  if (state === "unsupported") return "Needs attention";
+  return "Needs approval";
+}
+function actionReceiptGroups(actions) {
+  return ACTION_RECEIPT_GROUP_ORDER.flatMap((state) => {
+    const groupedActions = actions.filter((action) => action.state === state);
+    return groupedActions.length > 0 ? [
+      {
+        state,
+        title: actionReceiptGroupTitle(state),
+        actions: groupedActions
+      }
+    ] : [];
+  });
+}
+function renderActionReceiptMarkdownLines(input) {
+  if (input.actions.length === 0) return [];
+  const visibleActions = input.actions.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
+  const groups = actionReceiptGroups(visibleActions);
+  const showGroupHeadings = groups.length > 1;
+  const lines = [`*${input.title}*`, "", "Choose an action in this thread. Details stay in the OpenTag audit log."];
+  for (const group of groups) {
+    if (showGroupHeadings) {
+      lines.push("", `*${group.title}*`);
+    }
+    for (const action of group.actions) {
+      lines.push("", ...renderPresentationActionLines(action));
+    }
+  }
+  const remainingCount = input.actions.length - visibleActions.length;
+  if (remainingCount > 0) {
+    lines.push("", `Showing first ${visibleActions.length} of ${input.actions.length} actions. Reply with an action number for the rest.`);
+  }
+  lines.push("", "Use the buttons below, or reply with the matching command.");
+  return lines;
+}
+function renderSuggestedActionsMarkdown(presentation) {
+  const actions = presentation.actions ?? [];
+  if (actions.length === 0 || !presentation.actionReceiptTitle) return [];
+  return renderActionReceiptMarkdownLines({ title: presentation.actionReceiptTitle, actions });
+}
+function createSuggestedActionButton(action, decision) {
+  const index = action.index;
+  const labels = {
+    apply: `Apply ${index}`,
+    approve: "Approve only",
+    continue: "Continue",
+    reject: "Reject"
+  };
+  return {
+    type: "button",
+    text: { type: "plain_text", text: labels[decision], emoji: true },
+    action_id: `opentag:${decision}:${index}`,
+    value: buildSlackSuggestedActionButtonValue({
+      version: 1,
+      command: `${decision} ${index}`,
+      proposalId: action.proposalId,
+      intentId: action.intentId
+    }),
+    ...decision === "apply" ? { style: "primary" } : {},
+    ...decision === "reject" ? { style: "danger" } : {}
+  };
+}
+function actionHasInteractiveIdentity(action) {
+  return Boolean(action.proposalId && action.intentId);
+}
+function createSuggestedActionButtons(action) {
+  if (!actionHasInteractiveIdentity(action)) return [];
+  return action.visibleDecisions.map((decision) => createSuggestedActionButton(action, decision));
+}
+function createSlackActionReceiptBlockSet(input) {
+  const blocks = [];
+  if (input.includeDivider) blocks.push({ type: "divider" });
+  blocks.push(
+    slackSection(`*${markdownToSlackMrkdwn(input.title)}*
+
+Choose an action in this thread. Details stay in the OpenTag audit log.`)
+  );
+  const visibleActions = input.actions.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
+  const groups = actionReceiptGroups(visibleActions);
+  const showGroupHeadings = groups.length > 1;
+  for (const group of groups) {
+    if (showGroupHeadings) {
+      blocks.push(slackSection(`*${markdownToSlackMrkdwn(group.title)}*`));
+    }
+    for (const action of group.actions) {
+      blocks.push(slackSection(renderPresentationActionLines(action).join("\n")));
+      const buttons = createSuggestedActionButtons(action);
+      if (buttons.length === 0) continue;
+      blocks.push({
+        type: "actions",
+        block_id: `opentag_actions_${action.index}`,
+        elements: buttons
+      });
+    }
+  }
+  const remainingCount = input.actions.length - visibleActions.length;
+  if (remainingCount > 0) {
+    blocks.push(slackSection(`Showing first ${visibleActions.length} of ${input.actions.length} actions. Reply with an action number for the rest.`));
+  }
+  if (input.auditRunId) {
+    blocks.push(slackContext(markdownToSlackMrkdwn(`Audit: \`opentag status --run ${input.auditRunId}\``)));
+  }
+  return blocks;
+}
+function renderSlackActionReceiptPresentation(presentation) {
+  const lines = renderActionReceiptMarkdownLines({ title: presentation.title, actions: presentation.actions });
+  if (presentation.auditRunId) {
+    lines.push("", markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``));
+  }
+  return lines.join("\n");
+}
+function createSlackActionReceiptBlocks(presentation) {
+  return createSlackActionReceiptBlockSet({
+    title: presentation.title,
+    actions: presentation.actions,
+    ...presentation.auditRunId ? { auditRunId: presentation.auditRunId } : {}
+  });
+}
+function renderSlackFinalResult(result, options = {}) {
+  return renderSlackFinalSummaryPresentation(
+    createFinalSummaryPresentation({
+      result: resultForFinalSummaryPresentation(result),
+      ...options.receiptContext ? { receiptContext: options.receiptContext } : {},
+      ...options.auditRunId ? { auditRunId: options.auditRunId } : {}
+    })
+  );
+}
+function renderSlackFinalSummaryPresentation(presentation) {
+  const lines = [`*Finished: ${presentation.outcome}.*`, markdownToSlackMrkdwn(compactSlackSummary(presentation.summary))];
+  if (presentation.verification?.length) {
+    lines.push(
+      `Verified: ${presentation.verification.slice(0, 3).map((check) => `\`${markdownToSlackMrkdwn(check.command)}\` ${markdownToSlackMrkdwn(check.outcome)}`).join(", ")}`
+    );
+  }
+  const suggestedActions = renderSuggestedActionsMarkdown(presentation);
+  if (presentation.nextActions?.length && suggestedActions.length === 0) {
+    lines.push(`Next: ${markdownToSlackMrkdwn(compactNextAction(presentation.nextActions[0] ?? ""))}`);
+  }
+  if (suggestedActions.length > 0) {
+    lines.push("", ...suggestedActions);
+  }
+  if (presentation.auditRunId) {
+    lines.push("", markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``));
+  }
+  return lines.join("\n");
+}
+function createSlackFinalResultBlocks(result, options = {}) {
+  return createSlackFinalSummaryBlocks(
+    createFinalSummaryPresentation({
+      result: resultForFinalSummaryPresentation(result),
+      ...options.receiptContext ? { receiptContext: options.receiptContext } : {},
+      ...options.auditRunId ? { auditRunId: options.auditRunId } : {}
+    })
+  );
+}
+function createSlackFinalSummaryBlocks(presentation) {
+  const blocks = [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `*Finished: ${presentation.outcome}.*
+${markdownToSlackMrkdwn(compactSlackSummary(presentation.summary))}`
+      }
+    }
+  ];
+  if (presentation.verification?.length) {
+    blocks.push({
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `Verified: ${markdownToSlackMrkdwn(
+          presentation.verification.slice(0, 3).map((check) => `\`${check.command}\` ${check.outcome}`).join(", ")
+        )}`
+      }
+    });
+  }
+  const actions = presentation.actions ?? [];
+  if (presentation.nextActions?.length && actions.length === 0) {
+    blocks.push({
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `Next: ${markdownToSlackMrkdwn(compactNextAction(presentation.nextActions[0] ?? ""))}`
+      }
+    });
+  }
+  if (actions.length > 0 && presentation.actionReceiptTitle) {
+    blocks.push(...createSlackActionReceiptBlockSet({ title: presentation.actionReceiptTitle, actions, includeDivider: true }));
+  }
+  if (presentation.auditRunId) {
+    blocks.push({
+      type: "context",
+      elements: [
+        {
+          type: "mrkdwn",
+          text: markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``)
+        }
+      ]
+    });
+  }
+  return blocks;
+}
+function createSlackDoctorSummaryBlocks(presentation) {
+  const blocks = [slackSection(`*${markdownToSlackMrkdwn(presentation.title)}*`)];
+  if (presentation.checks.length === 0) {
+    blocks.push(slackContext("No readiness checks were reported."));
+    return blocks;
+  }
+  for (const check of presentation.checks.slice(0, 10)) {
+    blocks.push(
+      slackSection(
+        `*${slackCheckStatusLabel(check.status)} ${markdownToSlackMrkdwn(check.name)}*${check.message ? `
+${markdownToSlackMrkdwn(check.message)}` : ""}`
+      )
+    );
+  }
+  if (presentation.checks.length > 10) {
+    blocks.push(slackContext(`Showing first 10 of ${presentation.checks.length} readiness checks. Use \`opentag doctor\` locally for full detail.`));
+  }
+  return blocks;
+}
+function createSlackSourceThreadStatusBlocks(presentation) {
+  const blocks = [
+    slackSection(`*${markdownToSlackMrkdwn(presentation.title)}*`),
+    slackContext(
+      [
+        presentation.sourceContainer ? `Source: \`${presentation.sourceContainer}\`` : void 0,
+        `Project Target: \`${presentation.projectTarget ?? "not bound"}\``
+      ].filter((line) => Boolean(line)).join(" | ")
+    ),
+    slackSection(
+      [
+        `*Active run:* ${markdownToSlackMrkdwn(slackStatusActiveRun(presentation))}`,
+        presentation.currentCommand ? `*Command:* ${markdownToSlackMrkdwn(presentation.currentCommand)}` : void 0,
+        `*Queued follow-ups:* ${markdownToSlackMrkdwn(slackStatusQueuedFollowUps(presentation))}`,
+        `*Next action:* ${markdownToSlackMrkdwn(presentation.nextAction)}`
+      ].filter((line) => Boolean(line)).join("\n")
+    )
+  ];
+  if (presentation.stopHint || presentation.detailHint) {
+    blocks.push(
+      slackContext(
+        [
+          presentation.stopHint ? `Stop/timeout: ${presentation.stopHint}` : void 0,
+          presentation.detailHint ? `Details: ${presentation.detailHint}` : void 0
+        ].filter((line) => Boolean(line)).map(markdownToSlackMrkdwn).join(" | ")
+      )
+    );
+  }
+  return blocks;
+}
+function createSlackPostMessagePayload(input) {
+  return {
+    channel: input.channelId,
+    text: markdownToSlackMrkdwn(input.text),
+    thread_ts: input.threadTs,
+    ...input.blocks?.length ? { blocks: input.blocks } : {}
+  };
+}
+function createSlackUpdateMessagePayload(input) {
+  return {
+    channel: input.channelId,
+    text: markdownToSlackMrkdwn(input.text),
+    ts: input.messageTs,
+    ...input.blocks?.length ? { blocks: input.blocks } : {}
+  };
+}
+
 // src/events.ts
 function json(body, status = 200) {
   return { kind: "json", status, body };
@@ -160,9 +593,203 @@ function json(body, status = 200) {
 function text(body, status = 200) {
   return { kind: "text", status, body };
 }
+var HELP_TEXT = [
+  "OpenTag commands:",
+  "- @mention the app with `/bind <owner>/<repo>` or `/bind <provider>:<owner>/<repo>` to connect this Slack channel to a Project Target.",
+  "- @mention the app with `/status` to see the Project Target, active run, queued follow-ups, and next safe action.",
+  "- @mention the app with `/doctor` to see a redacted readiness summary for this Slack channel.",
+  "- @mention the app with `/stop [run_id]` to request cancellation for the active channel run or a specific run; OpenTag will not treat stop as successful completion.",
+  "- @mention the app with `/unbind confirm` to disconnect this Slack channel from its Project Target; this does not delete local checkout config.",
+  "- Reply in a source thread with `apply 1`, `approve 1`, `reject 1`, or `continue 1` when OpenTag posts source-thread actions.",
+  "Project Targets never use absolute local paths. Keep local checkout paths in runner config and allowlists."
+].join("\n");
+var BIND_USAGE = "Usage: @mention the app with `/bind <owner>/<repo>` \u2014 e.g. `/bind amplifthq/opentag` or `/bind github:amplifthq/opentag`. Project Targets never use absolute local paths.";
+var UNBIND_USAGE = "Usage: @mention the app with `/unbind confirm` to disconnect this Slack channel from its Project Target. This does not remove local checkout config, repository bindings, or allowlists.";
+var UNBOUND_HINT = "This Slack channel is not connected to a Project Target. @mention the app with `/bind <owner>/<repo>` before starting runs, or update local OpenTag channel bindings.";
+var STOP_UNAVAILABLE_TEXT = [
+  "Run cancellation from this Slack ingress is not configured.",
+  "OpenTag will not treat a stop request as a successful completion. Use `opentag status --run <run_id>` for audit detail, or `opentag service stop` if you need to stop the local background service."
+].join("\n");
+var BINDING_AUTH_DENIED_TEXT = "Only an authorized Slack binding manager can change this channel's Project Target. Ask an admin to run the command or update local OpenTag channel bindings.";
+function normalizeSelfServiceReply(reply) {
+  return typeof reply === "string" ? { text: reply } : reply;
+}
+function parseSelfServiceCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed) return null;
+  if (/^\/help(\s|$)/.test(trimmed)) return "help";
+  if (/^\/status(\s|$)/.test(trimmed)) return "status";
+  if (/^\/doctor(\s|$)/.test(trimmed)) return "doctor";
+  return null;
+}
+function parseStopCommand(command) {
+  const match = command?.trim().match(/^\/stop(?:\s+(\S+))?\s*$/);
+  if (!match) return null;
+  return match[1] ? { runId: match[1] } : {};
+}
+function parseBindCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed || !/^\/bind(\s|$)/.test(trimmed)) return null;
+  const match = trimmed.match(/^\/bind\s+(\S+)\s*$/);
+  if (!match) return { ok: false };
+  try {
+    const ref = parseProjectTargetRef(match[1]);
+    return { ok: true, repoProvider: ref.provider, owner: ref.owner, repo: ref.repo };
+  } catch {
+    return { ok: false };
+  }
+}
+function parseUnbindCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed || !/^\/unbind(\s|$)/.test(trimmed)) return null;
+  return /^\/unbind\s+confirm\s*$/.test(trimmed) ? { ok: true } : { ok: false };
+}
+async function canManageSlackBinding(input, context) {
+  if (input.canManageBinding) return input.canManageBinding(context);
+  return false;
+}
+function formatStopResultText(result) {
+  if (result.outcome === "cancelled") {
+    return [
+      `Cancellation requested for run ${result.runId}.`,
+      "- OpenTag will not treat this stop request as a successful completion.",
+      "- The local executor may need a moment to observe the cancellation; further nonessential completion writes are suppressed."
+    ].join("\n");
+  }
+  if (result.outcome === "already_terminal") {
+    return `Run ${result.runId} is already finished. OpenTag will not change its final result.`;
+  }
+  return result.runId ? `Run ${result.runId} was not found or is no longer cancelable.` : "No active run was found for this Slack channel and Project Target.";
+}
+function formatProjectTarget(binding) {
+  return `${binding.repoProvider ?? "github"}:${binding.owner}/${binding.repo}`;
+}
+function statusPresentation(input) {
+  if (!input.binding) {
+    return createSourceThreadStatusPresentation({
+      title: "OpenTag status:",
+      sourceContainer: `slack:${input.teamId}/${input.channelId}`,
+      bindingState: "unbound",
+      nextAction: "bind this Slack channel to a Project Target before starting runs.",
+      detailHint: "active run and queued follow-up status are unavailable until this channel is bound."
+    });
+  }
+  return createSourceThreadStatusPresentation({
+    title: "OpenTag status:",
+    sourceContainer: `slack:${input.teamId}/${input.channelId}`,
+    projectTarget: formatProjectTarget(input.binding),
+    bindingState: "bound",
+    nextAction: "mention the app with a task, send a follow-up in the source thread, or use `opentag status --run <run_id>` locally.",
+    stopHint: "cancellation is explicit and is not reported as successful completion; timeout policy is recorded in audit/status.",
+    detailHint: "at most one run is active per Project Target + source thread; same-thread requests queue behind it."
+  });
+}
+function statusReply(input) {
+  const presentation = statusPresentation(input);
+  return {
+    text: renderOpenTagPresentationPlainText(presentation),
+    blocks: createSlackSourceThreadStatusBlocks(presentation)
+  };
+}
+function doctorPresentation(input) {
+  return createDoctorSummaryPresentation({
+    title: "OpenTag doctor (redacted):",
+    checks: [
+      { status: "ok", name: "Source container", message: `slack:${input.teamId}/${input.channelId}` },
+      {
+        status: input.binding ? "ok" : "warn",
+        name: "Project Target",
+        message: input.binding ? formatProjectTarget(input.binding) : "not bound"
+      },
+      { status: "ok", name: "Secrets", message: "redacted. Use env/file/keychain SecretRef config and never paste tokens into Slack." },
+      {
+        status: "warn",
+        name: "Runtime readiness",
+        message: "check `opentag service status` locally; launchd running is not the same as connector ready."
+      },
+      { status: "ok", name: "Source-thread output", message: "concise final replies by default; detailed process stays in audit/status." }
+    ]
+  });
+}
+function doctorReply(input) {
+  const presentation = doctorPresentation(input);
+  return {
+    text: renderOpenTagPresentationPlainText(presentation),
+    blocks: createSlackDoctorSummaryBlocks(presentation)
+  };
+}
 function createSlackEventProcessor(input) {
+  async function processBlockActions(payload, slackApp) {
+    const action = payload.actions?.find((candidate) => {
+      if (candidate.action_id?.startsWith("opentag:")) return true;
+      return typeof candidate.value === "string" && parseSlackSuggestedActionButtonValue(candidate.value) !== null;
+    });
+    if (!action) {
+      return json({ ok: true });
+    }
+    const parsedValue = typeof action.value === "string" ? parseSlackSuggestedActionButtonValue(action.value) : null;
+    const rawText = parsedValue?.command ?? (typeof action.value === "string" && parseThreadActionCommand(action.value) ? action.value.trim() : void 0);
+    if (!rawText || !parseThreadActionCommand(rawText)) {
+      return json({ error: "invalid_interactive_action" }, 400);
+    }
+    if (!input.submitThreadAction) {
+      return json({ ok: true });
+    }
+    const teamId = payload.team?.id;
+    const userId = payload.user?.id;
+    const channelId = payload.channel?.id ?? payload.container?.channel_id;
+    const messageTs = payload.message?.ts ?? payload.container?.message_ts;
+    const threadTs = payload.message?.thread_ts ?? payload.container?.thread_ts ?? messageTs;
+    if (!teamId || !userId || !channelId || !messageTs || !threadTs) {
+      return json({ error: "invalid_interactive_payload" }, 400);
+    }
+    const binding = await input.resolveChannelBinding({
+      teamId,
+      channelId
+    });
+    if (!binding) {
+      return json({ ok: true, ignored: "unbound_channel" });
+    }
+    await input.submitThreadAction({
+      id: `approval_slack_block_${payload.trigger_id ?? `${action.action_id ?? "action"}_${action.action_ts ?? messageTs}`}`,
+      rawText,
+      actor: {
+        provider: "slack",
+        providerUserId: userId,
+        handle: payload.user?.username ?? payload.user?.name ?? userId,
+        organizationId: teamId
+      },
+      callback: {
+        provider: "slack",
+        uri: slackApp.callbackUri ?? "https://slack.com/api/chat.postMessage",
+        threadKey: encodeSlackThreadKey({
+          teamId,
+          channelId,
+          threadTs
+        })
+      },
+      metadata: {
+        source: "slack_button",
+        teamId,
+        channelId,
+        messageTs,
+        ...payload.api_app_id ? { slackAppId: payload.api_app_id } : {},
+        ...action.action_id ? { actionId: action.action_id } : {},
+        ...action.block_id ? { blockId: action.block_id } : {},
+        ...action.action_ts ? { actionTs: action.action_ts } : {},
+        ...parsedValue ? { proposalId: parsedValue.proposalId, intentId: parsedValue.intentId } : {},
+        repoProvider: binding.repoProvider ?? "github",
+        owner: binding.owner,
+        repo: binding.repo
+      }
+    });
+    return json({ ok: true });
+  }
   return {
-    async process(payload, slackApp) {
+    async process(payload, slackApp, verification = {}) {
+      if (payload.type === "block_actions") {
+        return processBlockActions(payload, slackApp);
+      }
       if (payload.type === "url_verification") {
         return text(payload.challenge ?? "");
       }
@@ -176,6 +803,177 @@ function createSlackEventProcessor(input) {
         return json({ error: "invalid_event_payload" }, 400);
       }
       const rawThreadActionText = payload.event.type === "app_mention" ? stripSlackAppMention(payload.event.text, payload.authorizations?.[0]?.user_id) : payload.event.text.trim();
+      const bindRequest = payload.event.type === "app_mention" ? parseBindCommand(rawThreadActionText) : null;
+      if (bindRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: "bind" });
+        }
+        if (!input.bindChannel) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: "Slack channel binding from source threads is not configured. Re-run `opentag setup` or update local OpenTag channel bindings."
+          });
+          return json({ ok: true, selfService: "bind", unavailable: true });
+        }
+        if (!bindRequest.ok) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BIND_USAGE
+          });
+          return json({ ok: true, selfService: "bind", usage: true });
+        }
+        const authorized = await canManageSlackBinding(input, {
+          action: "bind",
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          eventId: payload.event_id,
+          ...payload.api_app_id ? { appId: payload.api_app_id } : {}
+        });
+        if (!authorized) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BINDING_AUTH_DENIED_TEXT
+          });
+          return json({ ok: true, selfService: "bind", unauthorized: true });
+        }
+        await input.bindChannel({
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          repoProvider: bindRequest.repoProvider,
+          owner: bindRequest.owner,
+          repo: bindRequest.repo
+        });
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: `Connected this Slack channel to Project Target ${bindRequest.repoProvider}:${bindRequest.owner}/${bindRequest.repo}. @mention the app with a task to start a run.`
+        });
+        return json({ ok: true, selfService: "bind" });
+      }
+      const unbindRequest = payload.event.type === "app_mention" ? parseUnbindCommand(rawThreadActionText) : null;
+      if (unbindRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: "unbind" });
+        }
+        if (!input.unbindChannel) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: "Slack channel unbinding is not enabled in this build. Re-run `opentag setup` or update local OpenTag channel bindings."
+          });
+          return json({ ok: true, selfService: "unbind", unavailable: true });
+        }
+        if (!unbindRequest.ok) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: UNBIND_USAGE
+          });
+          return json({ ok: true, selfService: "unbind", usage: true });
+        }
+        const authorized = await canManageSlackBinding(input, {
+          action: "unbind",
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          eventId: payload.event_id,
+          ...payload.api_app_id ? { appId: payload.api_app_id } : {}
+        });
+        if (!authorized) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BINDING_AUTH_DENIED_TEXT
+          });
+          return json({ ok: true, selfService: "unbind", unauthorized: true });
+        }
+        const binding2 = await input.resolveChannelBinding({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        if (!binding2) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: UNBOUND_HINT
+          });
+          return json({ ok: true, selfService: "unbind", ignored: "unbound_channel" });
+        }
+        await input.unbindChannel({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: `Disconnected this Slack channel from Project Target ${formatProjectTarget(binding2)}. Re-run \`opentag setup\` or update local OpenTag channel bindings to connect a new target.`
+        });
+        return json({ ok: true, selfService: "unbind" });
+      }
+      const stopRequest = payload.event.type === "app_mention" ? parseStopCommand(rawThreadActionText) : null;
+      if (stopRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.stopRun) {
+          if (input.reply) {
+            await input.reply({
+              channelId: payload.event.channel,
+              threadTs,
+              text: STOP_UNAVAILABLE_TEXT
+            });
+          }
+          return json({ ok: true, selfService: "stop", unavailable: true });
+        }
+        const result = await input.stopRun({
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          ...stopRequest.runId ? { runId: stopRequest.runId } : {},
+          requestedBy: `slack:${payload.event.user}`
+        });
+        if (input.reply) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: formatStopResultText(result)
+          });
+        }
+        return json({ ok: true, selfService: "stop", outcome: result.outcome, ...result.runId ? { runId: result.runId } : {} });
+      }
+      const selfServiceCommand = payload.event.type === "app_mention" ? parseSelfServiceCommand(rawThreadActionText) : null;
+      if (selfServiceCommand) {
+        const binding2 = selfServiceCommand === "help" ? null : await input.resolveChannelBinding({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: selfServiceCommand });
+        }
+        const context = {
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          binding: binding2
+        };
+        const reply = selfServiceCommand === "help" ? { text: HELP_TEXT } : normalizeSelfServiceReply(
+          selfServiceCommand === "status" ? input.status ? await input.status(context) : statusReply(context) : input.doctor ? await input.doctor(context) : doctorReply(context)
+        );
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: reply.text,
+          ...reply.blocks?.length ? { blocks: reply.blocks } : {}
+        });
+        return json({ ok: true, selfService: selfServiceCommand });
+      }
       if (payload.event.type === "message" && (!rawThreadActionText || !parseThreadActionCommand(rawThreadActionText))) {
         return json({ ok: true });
       }
@@ -209,8 +1007,11 @@ function createSlackEventProcessor(input) {
             teamId: payload.team_id,
             channelId: payload.event.channel,
             messageTs: payload.event.ts,
+            sourceDeliveryId: payload.event_id,
+            slackEventId: payload.event_id,
             ...payload.api_app_id ? { slackAppId: payload.api_app_id } : {},
             ...payload.authorizations?.[0]?.user_id ? { slackBotUserId: payload.authorizations[0].user_id } : {},
+            ...typeof verification.signatureVerified === "boolean" ? { webhookSignatureVerified: verification.signatureVerified, signatureState: verification.signatureVerified ? "verified" : "unverified" } : {},
             repoProvider: binding.repoProvider ?? "github",
             owner: binding.owner,
             repo: binding.repo
@@ -234,7 +1035,8 @@ function createSlackEventProcessor(input) {
         ...payload.api_app_id ? { appId: payload.api_app_id } : {},
         ...payload.event.thread_ts ? { threadTs: payload.event.thread_ts } : {},
         ...payload.authorizations?.[0]?.user_id ? { botUserId: payload.authorizations[0].user_id } : {},
-        ...slackApp.callbackUri ? { callbackUri: slackApp.callbackUri } : {}
+        ...slackApp.callbackUri ? { callbackUri: slackApp.callbackUri } : {},
+        ...typeof verification.signatureVerified === "boolean" ? { signatureVerified: verification.signatureVerified } : {}
       });
       if (!event) {
         return json({ ok: true, ignored: "empty_command" });
@@ -248,17 +1050,128 @@ function createSlackEventProcessor(input) {
 // src/ingress.ts
 import { createHmac, timingSafeEqual } from "crypto";
 import { serve } from "@hono/node-server";
+import { createOpenTagClient as createOpenTagClient2 } from "@opentag/client";
+import { DEFAULT_MAX_REQUEST_BODY_BYTES, RequestBodyTooLargeError, readRequestTextWithLimit } from "@opentag/core";
 import { Hono } from "hono";
 
 // src/dispatcher-events.ts
 import { randomUUID } from "crypto";
 import { createOpenTagClient } from "@opentag/client";
+import { createDoctorSummaryPresentation as createDoctorSummaryPresentation2, createSourceThreadStatusPresentation as createSourceThreadStatusPresentation2, renderOpenTagPresentationPlainText as renderOpenTagPresentationPlainText2 } from "@opentag/core";
+function formatProjectTarget2(input) {
+  return `${input.repoProvider ?? "github"}:${input.owner}/${input.repo}`;
+}
+function queuedFollowUpsSummary(status) {
+  if (status.queuedFollowUps.length === 0) return "none.";
+  const visible = status.queuedFollowUps.slice(0, 3).map((followUp) => followUp.id);
+  const suffix = status.queuedFollowUps.length > visible.length ? `, +${status.queuedFollowUps.length - visible.length} more` : "";
+  return `${status.queuedFollowUps.length} (${visible.join(", ")}${suffix}).`;
+}
+function formatDurationMs(ms) {
+  if (ms % 6e4 === 0) return `${ms / 6e4} minute(s)`;
+  if (ms % 1e3 === 0) return `${ms / 1e3} second(s)`;
+  return `${ms}ms`;
+}
+function runTimeoutPolicy(input) {
+  const hardTimeoutMs = input.status?.runTimeoutPolicy?.hardTimeoutMs ?? input.runTimeoutMs;
+  return hardTimeoutMs ? `hard timeout after ${formatDurationMs(hardTimeoutMs)}` : "disabled";
+}
+function slackRuntimeStatusReply(status, input = {}) {
+  const presentation = createSourceThreadStatusPresentation2({
+    title: "OpenTag status:",
+    sourceContainer: `${status.binding.provider}:${status.binding.accountId}/${status.binding.conversationId}`,
+    projectTarget: formatProjectTarget2(status.binding),
+    bindingState: "bound",
+    ...status.activeRun ? {
+      activeRun: {
+        id: status.activeRun.id,
+        status: status.activeRun.status,
+        updatedAt: status.activeRun.updatedAt
+      }
+    } : {},
+    ...status.activeEvent?.command.rawText ? { currentCommand: status.activeEvent.command.rawText } : {},
+    queuedFollowUps: status.queuedFollowUps.slice(0, 3).map((followUp) => ({
+      id: followUp.id,
+      status: followUp.status,
+      command: followUp.event.command.rawText
+    })),
+    queuedFollowUpsTotal: status.queuedFollowUps.length,
+    nextAction: status.activeRun ? "wait for the final reply, send a follow-up to queue more context, or use `opentag status --run <run_id>` locally." : "@mention the app with a task to start a run.",
+    stopHint: `cancellation is explicit and is not reported as successful completion; timeout policy: ${runTimeoutPolicy({ ...input, status })}.`,
+    detailHint: "use `opentag status --run <run_id>` locally for audit events and executor detail."
+  });
+  return {
+    text: renderOpenTagPresentationPlainText2(presentation),
+    blocks: createSlackSourceThreadStatusBlocks(presentation)
+  };
+}
+function slackRuntimeDoctorReply(input) {
+  const presentation = createDoctorSummaryPresentation2({
+    title: "OpenTag doctor (redacted):",
+    checks: [
+      { status: "ok", name: "Source container", message: `slack:${input.teamId}/${input.channelId}` },
+      { status: "ok", name: "Project Target", message: formatProjectTarget2(input.status.binding) },
+      { status: "ok", name: "Dispatcher", message: "reachable for this source container." },
+      {
+        status: "ok",
+        name: "Active run",
+        message: input.status.activeRun ? `${input.status.activeRun.id} (${input.status.activeRun.status}), updated ${input.status.activeRun.updatedAt}.` : "none."
+      },
+      { status: "ok", name: "Queued follow-ups", message: queuedFollowUpsSummary(input.status) },
+      { status: "ok", name: "Timeout policy", message: runTimeoutPolicy({ ...input, status: input.status }) },
+      {
+        status: "ok",
+        name: "Runtime readiness",
+        message: "source-container status is reachable; run `opentag service status` locally to confirm controller, connector, executor, and heartbeat health."
+      },
+      { status: "ok", name: "Secrets", message: "redacted. Use env/file/keychain SecretRef config and never paste tokens into Slack." }
+    ]
+  });
+  return {
+    text: renderOpenTagPresentationPlainText2(presentation),
+    blocks: createSlackDoctorSummaryBlocks(presentation)
+  };
+}
+function statusUnavailable(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  return [
+    "OpenTag status:",
+    input.binding ? `Project Target: ${formatProjectTarget2(input.binding)}` : "Project Target: not bound.",
+    "Runtime status: unavailable from dispatcher.",
+    `Reason: ${message}`,
+    "Next action: check `opentag service status` and `opentag status` locally."
+  ].join("\n");
+}
+function doctorUnavailable(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  return [
+    "OpenTag doctor (redacted):",
+    `Source container: slack:${input.teamId}/${input.channelId}`,
+    input.binding ? `Project Target: ${formatProjectTarget2(input.binding)}` : "Project Target: not bound.",
+    "Dispatcher: source-container status unavailable.",
+    `Reason: ${message}`,
+    "Runtime readiness: run `opentag service status` and `opentag status --channel slack:<team>/<channel>` locally.",
+    "Secrets: redacted; do not share local config or app tokens in Slack."
+  ].join("\n");
+}
+function mapStopError(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  if (message.includes("run_already_terminal")) {
+    return { outcome: "already_terminal", runId: input.runId ?? "active run" };
+  }
+  if (message.includes("run_not_found") || message.includes("active_run_not_found") || message.includes("channel_binding_not_found")) {
+    return input.runId ? { outcome: "not_found", runId: input.runId } : { outcome: "not_found" };
+  }
+  return null;
+}
 function createSlackDispatcherEventProcessorInput(config) {
+  const fetchImpl = config.fetchImpl ?? fetch;
   const dispatcherClient = createOpenTagClient({
     dispatcherUrl: config.dispatcherUrl,
-    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {}
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {},
+    fetchImpl
   });
-  return {
+  const processorInput = {
     async resolveChannelBinding(input) {
       try {
         const { binding } = await dispatcherClient.getChannelBinding({
@@ -285,11 +1198,112 @@ function createSlackDispatcherEventProcessorInput(config) {
       const created = await dispatcherClient.createRun({ runId, event });
       return created.outcome === "run_created" ? { runId: created.run.id } : { runId };
     },
+    async bindChannel(input) {
+      await dispatcherClient.bindChannel({
+        provider: "slack",
+        accountId: input.teamId,
+        conversationId: input.channelId,
+        repoProvider: input.repoProvider,
+        owner: input.owner,
+        repo: input.repo
+      });
+    },
     async submitThreadAction(action) {
       await dispatcherClient.submitThreadAction(action);
     },
+    async unbindChannel(input) {
+      await dispatcherClient.unbindChannel({
+        provider: "slack",
+        accountId: input.teamId,
+        conversationId: input.channelId
+      });
+    },
+    canManageBinding(input) {
+      return Boolean(config.bindingAdminUserIds?.includes(input.userId));
+    },
+    async stopRun(input) {
+      try {
+        const result = input.runId ? await dispatcherClient.cancelRun({
+          runId: input.runId,
+          reason: "Stop requested from Slack.",
+          requestedBy: input.requestedBy
+        }) : await dispatcherClient.cancelActiveChannelRun({
+          provider: "slack",
+          accountId: input.teamId,
+          conversationId: input.channelId,
+          reason: "Stop requested from Slack.",
+          requestedBy: input.requestedBy
+        });
+        return { outcome: "cancelled", runId: result.run.id };
+      } catch (error) {
+        const mapped = mapStopError({ error, ...input.runId ? { runId: input.runId } : {} });
+        if (mapped) return mapped;
+        throw error;
+      }
+    },
+    async status(input) {
+      if (!input.binding) return statusUnavailable({ error: "channel not bound" });
+      try {
+        return slackRuntimeStatusReply(
+          await dispatcherClient.getChannelRuntimeStatus({
+            provider: "slack",
+            accountId: input.teamId,
+            conversationId: input.channelId
+          }),
+          { ...config.runTimeoutMs ? { runTimeoutMs: config.runTimeoutMs } : {} }
+        );
+      } catch (error) {
+        return statusUnavailable({ binding: input.binding, error });
+      }
+    },
+    async doctor(input) {
+      if (!input.binding) {
+        return doctorUnavailable({ teamId: input.teamId, channelId: input.channelId, error: "channel not bound" });
+      }
+      try {
+        return slackRuntimeDoctorReply({
+          teamId: input.teamId,
+          channelId: input.channelId,
+          status: await dispatcherClient.getChannelRuntimeStatus({
+            provider: "slack",
+            accountId: input.teamId,
+            conversationId: input.channelId
+          }),
+          ...config.runTimeoutMs ? { runTimeoutMs: config.runTimeoutMs } : {}
+        });
+      } catch (error) {
+        return doctorUnavailable({ teamId: input.teamId, channelId: input.channelId, binding: input.binding, error });
+      }
+    },
     now: () => (/* @__PURE__ */ new Date()).toISOString()
   };
+  if (config.botToken) {
+    processorInput.reply = async (input) => {
+      const response = await fetchImpl(config.callbackUri ?? "https://slack.com/api/chat.postMessage", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${config.botToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(
+          createSlackPostMessagePayload({
+            channelId: input.channelId,
+            threadTs: input.threadTs,
+            text: input.text,
+            ...input.blocks?.length ? { blocks: input.blocks } : {}
+          })
+        )
+      });
+      if (!response.ok) {
+        throw new Error(`deliver Slack self-service reply failed: ${response.status} ${await response.text()}`);
+      }
+      const body = await response.json().catch(() => ({}));
+      if (body.ok === false) {
+        throw new Error(`deliver Slack self-service reply failed: ${body.error ?? "unknown_error"}`);
+      }
+    };
+  }
+  return processorInput;
 }
 
 // src/ingress.ts
@@ -311,11 +1325,101 @@ function verifySlackTimestamp(input) {
   const ageSeconds = Math.abs(Math.floor(input.nowMs / 1e3) - timestampSeconds);
   return ageSeconds <= toleranceSeconds;
 }
+async function recordSlackSignatureFailure(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.signature_failed",
+      severity: "warn",
+      subject: "slack:POST /slack/events",
+      payload: {
+        provider: "slack",
+        endpoint: "POST /slack/events",
+        reason: input.reason,
+        hasSignature: input.hasSignature,
+        hasTimestamp: input.hasTimestamp,
+        ...input.apiAppId ? { apiAppId: input.apiAppId } : {}
+      }
+    });
+  } catch {
+  }
+}
+async function recordSlackRequestBodyRejected(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.request_body_rejected",
+      severity: "warn",
+      subject: "slack:POST /slack/events",
+      payload: {
+        provider: "slack",
+        endpoint: "POST /slack/events",
+        reason: input.reason,
+        ...input.maxBytes !== void 0 ? { maxBytes: input.maxBytes } : {},
+        contentLength: input.contentLength,
+        ...input.apiAppId ? { apiAppId: input.apiAppId } : {}
+      }
+    });
+  } catch {
+  }
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasOptionalStringProperties(value, keys) {
+  return keys.every((key) => value[key] === void 0 || typeof value[key] === "string");
+}
+function isSlackEventEnvelope(value) {
+  if (value.type !== "url_verification" && value.type !== "event_callback") return false;
+  if (!hasOptionalStringProperties(value, ["token", "challenge", "team_id", "api_app_id", "event_id"])) return false;
+  if (value.event_time !== void 0 && typeof value.event_time !== "number") return false;
+  if (value.authorizations !== void 0) {
+    if (!Array.isArray(value.authorizations)) return false;
+    if (!value.authorizations.every(
+      (authorization) => isRecord(authorization) && (authorization.user_id === void 0 || typeof authorization.user_id === "string")
+    )) {
+      return false;
+    }
+  }
+  if (value.event !== void 0) {
+    if (!isRecord(value.event) || typeof value.event.type !== "string") return false;
+    if (!hasOptionalStringProperties(value.event, ["user", "text", "ts", "thread_ts", "channel", "subtype", "bot_id"])) {
+      return false;
+    }
+  }
+  return true;
+}
+function isSlackInteractivePayload(value) {
+  if (value.type !== "block_actions") return false;
+  if (!hasOptionalStringProperties(value, ["api_app_id", "trigger_id"])) return false;
+  if (value.team !== void 0 && (!isRecord(value.team) || !hasOptionalStringProperties(value.team, ["id", "domain"]))) return false;
+  if (value.user !== void 0 && (!isRecord(value.user) || !hasOptionalStringProperties(value.user, ["id", "username", "name"]))) return false;
+  if (value.channel !== void 0 && (!isRecord(value.channel) || !hasOptionalStringProperties(value.channel, ["id", "name"]))) return false;
+  if (value.message !== void 0 && (!isRecord(value.message) || !hasOptionalStringProperties(value.message, ["ts", "thread_ts"]))) return false;
+  if (value.container !== void 0 && (!isRecord(value.container) || !hasOptionalStringProperties(value.container, ["type", "channel_id", "message_ts", "thread_ts"]))) {
+    return false;
+  }
+  if (value.actions !== void 0) {
+    if (!Array.isArray(value.actions)) return false;
+    return value.actions.every(
+      (action) => isRecord(action) && hasOptionalStringProperties(action, ["type", "action_id", "block_id", "value", "action_ts"])
+    );
+  }
+  return true;
+}
+function isSlackIngressPayload(value) {
+  if (!isRecord(value) || typeof value.type !== "string") return false;
+  return isSlackEventEnvelope(value) || isSlackInteractivePayload(value);
+}
 function createSlackEventsApp(input) {
   const app = new Hono();
   const processor = createSlackEventProcessor(input);
-  function parseSlackPayload(rawBody) {
+  const maxRequestBodyBytes = input.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES;
+  function parseSlackPayload(rawBody, contentType) {
     try {
+      if (contentType?.includes("application/x-www-form-urlencoded") || rawBody.startsWith("payload=")) {
+        const interactivePayload = new URLSearchParams(rawBody).get("payload");
+        if (!interactivePayload) return null;
+        return JSON.parse(interactivePayload);
+      }
       return JSON.parse(rawBody);
     } catch {
       return null;
@@ -340,16 +1444,56 @@ function createSlackEventsApp(input) {
     const timestamp = c.req.header("x-slack-request-timestamp");
     const signature = c.req.header("x-slack-signature");
     if (!timestamp || !signature) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "missing_signature_headers",
+        hasSignature: Boolean(signature),
+        hasTimestamp: Boolean(timestamp)
+      });
       return c.json({ error: "missing_signature_headers" }, 401);
     }
     if (!verifySlackTimestamp({ timestamp, nowMs: input.clock?.() ?? Date.now() })) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "stale_signature_timestamp",
+        hasSignature: true,
+        hasTimestamp: true
+      });
       return c.json({ error: "stale_signature_timestamp" }, 401);
     }
-    const rawBody = await c.req.text();
-    const payload = parseSlackPayload(rawBody);
+    let rawBody;
+    try {
+      rawBody = await readRequestTextWithLimit(c.req.raw, { maxBytes: maxRequestBodyBytes });
+    } catch (error) {
+      if (error instanceof RequestBodyTooLargeError) {
+        await recordSlackRequestBodyRejected({
+          recordControlPlaneEvent: input.recordControlPlaneEvent,
+          reason: "request_body_too_large",
+          maxBytes: error.maxBytes,
+          contentLength: c.req.raw.headers.get("content-length")
+        });
+        return c.json({ error: "request_body_too_large", maxBytes: error.maxBytes }, 413);
+      }
+      throw error;
+    }
+    const payload = parseSlackPayload(rawBody, c.req.header("content-type"));
     if (!payload) {
+      await recordSlackRequestBodyRejected({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "invalid_json_body",
+        contentLength: c.req.raw.headers.get("content-length")
+      });
       return c.json({ error: "invalid_json" }, 400);
     }
+    if (!isSlackIngressPayload(payload)) {
+      await recordSlackRequestBodyRejected({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "invalid_request_body",
+        contentLength: c.req.raw.headers.get("content-length"),
+        ...isRecord(payload) && typeof payload.api_app_id === "string" ? { apiAppId: payload.api_app_id } : {}
+      });
+      return c.json({ error: "invalid_request_body" }, 400);
+    }
     const resolvedSlackApp = resolveSlackApp({
       rawBody,
       signature,
@@ -357,9 +1501,16 @@ function createSlackEventsApp(input) {
       ...payload.api_app_id ? { apiAppId: payload.api_app_id } : {}
     });
     if ("error" in resolvedSlackApp) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: resolvedSlackApp.error,
+        hasSignature: true,
+        hasTimestamp: true,
+        ...payload.api_app_id ? { apiAppId: payload.api_app_id } : {}
+      });
       return c.json({ error: resolvedSlackApp.error }, 401);
     }
-    const result = await processor.process(payload, resolvedSlackApp.slackApp);
+    const result = await processor.process(payload, resolvedSlackApp.slackApp, { signatureVerified: true });
     if (result.kind === "text") {
       return c.text(result.body, result.status);
     }
@@ -369,6 +1520,10 @@ function createSlackEventsApp(input) {
 }
 function startSlackIngress(config) {
   const port = config.port ?? 3040;
+  const dispatcherClient = createOpenTagClient2({
+    dispatcherUrl: config.dispatcherUrl,
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {}
+  });
   const server = serve({
     fetch: createSlackEventsApp({
       slackApps: [
@@ -379,6 +1534,10 @@ function startSlackIngress(config) {
           ...config.callbackUri ? { callbackUri: config.callbackUri } : {}
         }
       ],
+      ...config.maxRequestBodyBytes ? { maxRequestBodyBytes: config.maxRequestBodyBytes } : {},
+      async recordControlPlaneEvent(event) {
+        await dispatcherClient.recordControlPlaneEvent(event);
+      },
       ...createSlackDispatcherEventProcessorInput(config)
     }).fetch,
     port
@@ -400,185 +1559,26 @@ function startSlackIngress(config) {
   };
 }
 
-// src/render.ts
-import { suggestedActionCandidatesFromResult } from "@opentag/core";
-function escapeSlackText(text2) {
-  return text2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function markdownToSlackMrkdwn(text2) {
-  const links = [];
-  const withoutLinks = text2.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_match, label, url) => {
-    const token = `\0SLACK_LINK_${links.length}\0`;
-    links.push(`<${url}|${escapeSlackText(label)}>`);
-    return token;
-  });
-  const converted = escapeSlackText(withoutLinks).replace(/\*\*(.+?)\*\*/g, "*$1*").replace(/__(.+?)__/g, "*$1*");
-  return links.reduce((output, link, index) => output.replace(`\0SLACK_LINK_${index}\0`, link), converted);
-}
-function renderSlackAcknowledgement(runId) {
-  return `I picked this up: \`${runId}\``;
-}
-function nextActionSummary(result) {
-  if (!result.nextAction) return void 0;
-  if (typeof result.nextAction === "string") return result.nextAction;
-  return result.nextAction.summary;
-}
-function stringParam(params, key) {
-  const value = params?.[key];
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function stringArrayParam(params, key) {
-  const value = params?.[key];
-  if (!Array.isArray(value)) return [];
-  return value.filter((item) => typeof item === "string" && item.length > 0);
-}
-function renderVerificationParams(params) {
-  const value = params?.["verification"];
-  if (!Array.isArray(value)) return [];
-  return value.map((item) => {
-    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
-    const command = item["command"];
-    const outcome = item["outcome"];
-    return typeof command === "string" && typeof outcome === "string" ? `   - \`${command}\`: ${outcome}` : void 0;
-  }).filter((line) => Boolean(line));
-}
-function renderSuggestedActionDetails(params, action) {
-  if (action !== "create_pull_request") return [];
-  const lines = [];
-  const title = stringParam(params, "title");
-  const head = stringParam(params, "head") ?? stringParam(params, "branch");
-  const base = stringParam(params, "base") ?? stringParam(params, "baseBranch");
-  const changedFiles = stringArrayParam(params, "changedFiles");
-  const risks = stringArrayParam(params, "risks");
-  const verification = renderVerificationParams(params);
-  if (title) lines.push(`   Title: ${markdownToSlackMrkdwn(title)}`);
-  if (head || base) lines.push(`   Branch: \`${head ?? "unknown"}\` -> \`${base ?? "main"}\``);
-  if (changedFiles.length > 0) lines.push(`   Changed files: ${changedFiles.map((file) => `\`${file}\``).join(", ")}`);
-  if (risks.length > 0) {
-    lines.push("   Risks:");
-    for (const risk of risks) {
-      lines.push(`   - ${markdownToSlackMrkdwn(risk)}`);
-    }
-  }
-  if (verification.length > 0) {
-    lines.push("   Verification:");
-    lines.push(...verification);
-  }
-  return lines;
-}
-function renderSuggestedActionsMarkdown(result) {
-  const candidates = suggestedActionCandidatesFromResult(result);
-  if (candidates.length === 0) return [];
-  const lines = ["*Suggested actions*"];
-  for (const candidate of candidates) {
-    lines.push(
-      "",
-      `${candidate.index}. *${markdownToSlackMrkdwn(candidate.intent.summary)}*`,
-      `   Intent: \`${candidate.intent.action}\` (\`${candidate.intent.domain}\`)`,
-      `   Proposal: \`${candidate.proposalId}\``,
-      `   Intent ID: \`${candidate.intent.intentId}\``
-    );
-    lines.push(...renderSuggestedActionDetails(candidate.intent.params, candidate.intent.action));
-    if (candidate.proposalPreconditions?.length) {
-      lines.push("   Preconditions:");
-      for (const precondition of candidate.proposalPreconditions) {
-        lines.push(`   - ${markdownToSlackMrkdwn(precondition)}`);
-      }
-    }
-  }
-  lines.push(
-    "",
-    "Reply with:",
-    "- `approve 1` to record approval",
-    "- `apply 1` or `apply all` to apply supported actions",
-    "- `continue 1` to continue with a follow-up run",
-    "- `reject 1` to reject an action"
-  );
-  return lines;
-}
-function renderSlackFinalResult(result) {
-  const lines = [`Finished with *${result.conclusion}*.`, "", markdownToSlackMrkdwn(result.summary)];
-  if (result.verification?.length) {
-    lines.push("", "*Verification*");
-    for (const check of result.verification) {
-      lines.push(`- \`${check.command}\`: ${check.outcome}`);
-    }
-  }
-  const nextAction = nextActionSummary(result);
-  if (nextAction) {
-    lines.push("", `*Next action*: ${markdownToSlackMrkdwn(nextAction)}`);
-  }
-  const suggestedActions = renderSuggestedActionsMarkdown(result);
-  if (suggestedActions.length > 0) {
-    lines.push("", ...suggestedActions);
-  }
-  return lines.join("\n");
-}
-function createSlackFinalResultBlocks(result) {
-  const blocks = [
-    {
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: `*Finished with ${result.conclusion}.*
-${markdownToSlackMrkdwn(result.summary)}`
-      }
-    }
-  ];
-  if (result.verification?.length) {
-    blocks.push({ type: "divider" });
-    blocks.push({
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: markdownToSlackMrkdwn(["*Verification*", ...result.verification.map((check) => `- \`${check.command}\`: ${check.outcome}`)].join("\n"))
-      }
-    });
-  }
-  const nextAction = nextActionSummary(result);
-  if (nextAction) {
-    blocks.push({
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: `*Next action*: ${markdownToSlackMrkdwn(nextAction)}`
-      }
-    });
-  }
-  const suggestedActions = renderSuggestedActionsMarkdown(result);
-  if (suggestedActions.length > 0) {
-    blocks.push({ type: "divider" });
-    blocks.push({
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: suggestedActions.join("\n")
-      }
-    });
-  }
-  return blocks;
-}
-function createSlackPostMessagePayload(input) {
-  return {
-    channel: input.channelId,
-    text: markdownToSlackMrkdwn(input.text),
-    thread_ts: input.threadTs,
-    ...input.blocks?.length ? { blocks: input.blocks } : {}
-  };
-}
-function createSlackUpdateMessagePayload(input) {
-  return {
-    channel: input.channelId,
-    text: markdownToSlackMrkdwn(input.text),
-    ts: input.messageTs,
-    ...input.blocks?.length ? { blocks: input.blocks } : {}
-  };
-}
-
 // src/socket-mode.ts
 import WebSocket from "ws";
+import { createOpenTagClient as createOpenTagClient3 } from "@opentag/client";
 var SLACK_CONNECTIONS_OPEN_URL = "https://slack.com/api/apps.connections.open";
 var DEFAULT_RECONNECT_DELAY_MS = 1e3;
+var TERMINAL_SLACK_ERROR_CODES = [
+  "invalid_auth",
+  "not_authed",
+  "account_inactive",
+  "token_revoked",
+  "token_expired",
+  "not_allowed_token_type",
+  "no_permission",
+  "missing_scope",
+  "ekm_access_denied"
+];
+function terminalSlackAuthErrorCode(error) {
+  if (!(error instanceof Error)) return null;
+  return TERMINAL_SLACK_ERROR_CODES.find((code) => error.message.includes(code)) ?? null;
+}
 function rawDataToString(data) {
   if (typeof data === "string") return data;
   if (Buffer.isBuffer(data)) return data.toString("utf8");
@@ -614,17 +1614,39 @@ async function handleSocketMessage(input) {
     return;
   }
   input.socket.send(JSON.stringify({ envelope_id: envelope.envelope_id }));
-  if (envelope.type !== "events_api" || !envelope.payload) {
+  if (!envelope.payload) {
     return;
   }
   if (input.slackApp.appId && envelope.payload.api_app_id && envelope.payload.api_app_id !== input.slackApp.appId) {
     return;
   }
+  if (envelope.type !== "events_api" && envelope.payload.type !== "block_actions") {
+    return;
+  }
   await input.processor.process(envelope.payload, input.slackApp);
 }
 function wait(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function recordSlackSocketTokenMisuse(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.token_misuse",
+      severity: "warn",
+      subject: "slack:app_token",
+      payload: {
+        provider: "slack",
+        endpoint: "apps.connections.open",
+        reason: input.reason,
+        tokenKind: "app_token",
+        mode: "socket_mode",
+        agentId: input.slackApp.agentId,
+        ...input.slackApp.appId ? { appId: input.slackApp.appId } : {}
+      }
+    });
+  } catch {
+  }
+}
 function startSlackSocketModeApp(input, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const createWebSocket = dependencies.createWebSocket ?? ((url) => new WebSocket(url));
@@ -671,8 +1693,26 @@ function startSlackSocketModeApp(input, dependencies = {}) {
   }
   const startPromise = (async () => {
     while (!closed) {
-      const socketUrl = await openSlackSocketUrl({ appToken: input.appToken, fetchImpl });
-      await runOneConnection(socketUrl);
+      try {
+        const socketUrl = await openSlackSocketUrl({ appToken: input.appToken, fetchImpl });
+        await runOneConnection(socketUrl);
+      } catch (error) {
+        const terminalErrorCode = terminalSlackAuthErrorCode(error);
+        if (terminalErrorCode) {
+          if (!closed) {
+            logError("[slack] terminal Socket Mode auth/config error, aborting:", error);
+            await recordSlackSocketTokenMisuse({
+              recordControlPlaneEvent: input.recordControlPlaneEvent,
+              slackApp: input.slackApp,
+              reason: terminalErrorCode
+            });
+          }
+          throw error;
+        }
+        if (!closed) {
+          logError("[slack] failed to open Socket Mode connection, retrying:", error);
+        }
+      }
       if (!closed) {
         await wait(reconnectDelayMs);
       }
@@ -688,6 +1728,11 @@ function startSlackSocketModeApp(input, dependencies = {}) {
   };
 }
 function startSlackSocketModeIngress(config, dependencies = {}) {
+  const dispatcherClient = createOpenTagClient3({
+    dispatcherUrl: config.dispatcherUrl,
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {},
+    fetchImpl: config.fetchImpl ?? fetch
+  });
   return startSlackSocketModeApp(
     {
       appToken: config.appToken,
@@ -696,24 +1741,37 @@ function startSlackSocketModeIngress(config, dependencies = {}) {
         ...config.appId ? { appId: config.appId } : {},
         ...config.callbackUri ? { callbackUri: config.callbackUri } : {}
       },
+      async recordControlPlaneEvent(event) {
+        await dispatcherClient.recordControlPlaneEvent(event);
+      },
       ...createSlackDispatcherEventProcessorInput(config)
     },
     dependencies
   );
 }
 export {
+  buildSlackSuggestedActionButtonValue,
   computeSlackSignature,
+  createSlackActionReceiptBlocks,
+  createSlackDoctorSummaryBlocks,
   createSlackEventProcessor,
   createSlackEventsApp,
   createSlackFinalResultBlocks,
+  createSlackFinalSummaryBlocks,
   createSlackPostMessagePayload,
+  createSlackReactionPayload,
+  createSlackSourceThreadStatusBlocks,
   createSlackUpdateMessagePayload,
   encodeSlackThreadKey,
   markdownToSlackMrkdwn,
   normalizeSlackAppMention,
+  parseSlackSuggestedActionButtonValue,
   parseSlackThreadKey,
   renderSlackAcknowledgement,
+  renderSlackActionReceiptPresentation,
   renderSlackFinalResult,
+  renderSlackFinalSummaryPresentation,
+  slackSourceReceiptReactionName,
   startSlackIngress,
   startSlackSocketModeApp,
   startSlackSocketModeIngress,