@opentag/slack 0.3.0 → 0.3.2

package/dist/index.js

@@ -1,5 +1,11 @@
 // src/events.ts
-import { parseThreadActionCommand } from "@opentag/core";
+import {
+  createDoctorSummaryPresentation,
+  createSourceThreadStatusPresentation,
+  parseProjectTargetRef,
+  parseThreadActionCommand,
+  renderOpenTagPresentationPlainText
+} from "@opentag/core";
 
 // src/normalize.ts
 import { commandFromRawText } from "@opentag/core";
@@ -159,8 +165,11 @@ function normalizeSlackAppMention(input) {
       teamId: input.teamId,
       channelId: input.channelId,
       messageTs: input.ts,
+      sourceDeliveryId: input.eventId,
+      slackEventId: input.eventId,
       ...input.appId ? { slackAppId: input.appId } : {},
       ...input.botUserId ? { slackBotUserId: input.botUserId } : {},
+      ...typeof input.signatureVerified === "boolean" ? { webhookSignatureVerified: input.signatureVerified, signatureState: input.signatureVerified ? "verified" : "unverified" } : {},
       ...commandMetadata(command),
       repoProvider: input.binding.repoProvider ?? "github",
       owner: input.binding.owner,
@@ -170,7 +179,9 @@ function normalizeSlackAppMention(input) {
 }
 
 // src/render.ts
-import { suggestedActionCandidatesFromResult } from "@opentag/core";
+import {
+  createFinalSummaryPresentation
+} from "@opentag/core";
 var MAX_SLACK_SUGGESTED_ACTION_CANDIDATES = 20;
 function buildSlackSuggestedActionButtonValue(input) {
   return JSON.stringify(input);
@@ -204,12 +215,16 @@ function markdownToSlackMrkdwn(text2) {
   const converted = escapeSlackText(withoutLinks).replace(/\*\*(.+?)\*\*/g, "*$1*").replace(/__(.+?)__/g, "*$1*");
   return links.reduce((output, link, index) => output.replace(`\0SLACK_LINK_${index}\0`, link), converted);
 }
+function markdownToSlackActionDetail(text2) {
+  return markdownToSlackMrkdwn(text2).replace(/->/g, "->");
+}
 function renderSlackAcknowledgement(runId) {
   void runId;
   return "Working on it.";
 }
 function slackSourceReceiptReactionName(state) {
   if (state === "received") return "eyes";
+  if (state === "running") return "hourglass_flowing_sand";
   return "eyes";
 }
 function createSlackReactionPayload(input) {
@@ -219,54 +234,6 @@ function createSlackReactionPayload(input) {
     name: input.name
   };
 }
-function nextActionSummary(result) {
-  if (!result.nextAction) return void 0;
-  if (typeof result.nextAction === "string") return result.nextAction;
-  return result.nextAction.summary;
-}
-function stringParam(params, key) {
-  const value = params?.[key];
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function stringArrayParam(params, key) {
-  const value = params?.[key];
-  if (!Array.isArray(value)) return [];
-  return value.filter((item) => typeof item === "string" && item.length > 0);
-}
-function renderVerificationParams(params) {
-  const value = params?.["verification"];
-  if (!Array.isArray(value)) return [];
-  return value.map((item) => {
-    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
-    const command = item["command"];
-    const outcome = item["outcome"];
-    return typeof command === "string" && typeof outcome === "string" ? `   - \`${command}\`: ${outcome}` : void 0;
-  }).filter((line) => Boolean(line));
-}
-function renderSuggestedActionDetails(params, action) {
-  if (action !== "create_pull_request") return [];
-  const lines = [];
-  const title = stringParam(params, "title");
-  const head = stringParam(params, "head") ?? stringParam(params, "branch");
-  const base = stringParam(params, "base") ?? stringParam(params, "baseBranch");
-  const changedFiles = stringArrayParam(params, "changedFiles");
-  const risks = stringArrayParam(params, "risks");
-  const verification = renderVerificationParams(params);
-  if (title) lines.push(`   Title: ${markdownToSlackMrkdwn(title)}`);
-  if (head || base) lines.push(`   Branch: \`${head ?? "unknown"}\` -> \`${base ?? "main"}\``);
-  if (changedFiles.length > 0) lines.push(`   Changed files: ${changedFiles.map((file) => `\`${file}\``).join(", ")}`);
-  if (risks.length > 0) {
-    lines.push("   Risks:");
-    for (const risk of risks) {
-      lines.push(`   - ${markdownToSlackMrkdwn(risk)}`);
-    }
-  }
-  if (verification.length > 0) {
-    lines.push("   Verification:");
-    lines.push(...verification);
-  }
-  return lines;
-}
 function truncateSlackText(text2, maxLength) {
   const normalized = text2.replace(/\s+/g, " ").trim();
   if (normalized.length <= maxLength) return normalized;
@@ -286,153 +253,319 @@ function compactSlackSummary(summary) {
 function compactNextAction(nextAction) {
   return truncateSlackText(nextAction, 180);
 }
-function renderSuggestedActionCandidateLines(candidate) {
-  const lines = [`${candidate.index}. *${markdownToSlackMrkdwn(candidate.intent.summary)}*`];
-  const details = renderSuggestedActionDetails(candidate.intent.params, candidate.intent.action).filter((line) => line.trim().startsWith("Branch:") || line.trim().startsWith("Changed files:")).map((line) => line.replace(/^\s+/, ""));
-  lines.push(...details);
-  if (candidate.proposalPreconditions?.length) {
-    lines.push(`Preconditions: ${candidate.proposalPreconditions.length} check(s) in the audit log.`);
+function resultForFinalSummaryPresentation(result) {
+  if (!result.suggestedChanges) return result;
+  const visibleSuggestedChanges = result.suggestedChanges.filter((snapshot) => snapshot.intents.length > 0);
+  if (visibleSuggestedChanges.length === result.suggestedChanges.length) return result;
+  const { suggestedChanges: _suggestedChanges, ...withoutSuggestedChanges } = result;
+  return visibleSuggestedChanges.length > 0 ? { ...withoutSuggestedChanges, suggestedChanges: visibleSuggestedChanges } : withoutSuggestedChanges;
+}
+function slackSection(text2) {
+  return {
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: text2
+    }
+  };
+}
+function slackContext(text2) {
+  return {
+    type: "context",
+    elements: [{ type: "mrkdwn", text: text2 }]
+  };
+}
+function slackCheckStatusLabel(status) {
+  if (status === "ok") return "OK";
+  if (status === "warn") return "WARN";
+  if (status === "fail") return "FAIL";
+  return "UNKNOWN";
+}
+function slackStatusActiveRun(presentation) {
+  if (!presentation.activeRun) return "none";
+  return `${presentation.activeRun.id} (${presentation.activeRun.status})${presentation.activeRun.updatedAt ? `, updated ${presentation.activeRun.updatedAt}` : ""}`;
+}
+function slackStatusQueuedFollowUps(presentation) {
+  const total = presentation.queuedFollowUpsTotal ?? presentation.queuedFollowUps.length;
+  if (total === 0) return "none";
+  const visible = presentation.queuedFollowUps.map((followUp) => {
+    const status = followUp.status ? ` (${followUp.status})` : "";
+    const command = followUp.command ? `: ${markdownToSlackMrkdwn(truncateSlackText(followUp.command, 120))}` : "";
+    return `${followUp.id}${status}${command}`;
+  });
+  const remaining = Math.max(total - visible.length, 0);
+  return `${total}${visible.length ? ` (${visible.join(", ")}${remaining > 0 ? `, +${remaining} more` : ""})` : ""}`;
+}
+function renderPresentationActionLines(action) {
+  const lines = [`${action.index}. *${markdownToSlackMrkdwn(action.title)}*`];
+  lines.push(`Target: ${markdownToSlackMrkdwn(action.targetLabel)}`);
+  if (action.setupReason) {
+    lines.push(`Status: ${markdownToSlackMrkdwn(action.setupReason)}`);
+  }
+  if (action.details?.length) {
+    lines.push(...action.details.map(markdownToSlackActionDetail));
   }
   return lines;
 }
-function renderSuggestedActionsMarkdown(result) {
-  const candidates = suggestedActionCandidatesFromResult(result);
-  if (candidates.length === 0) return [];
-  const lines = ["*Suggested actions*"];
-  const visibleCandidates = candidates.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
-  for (const candidate of visibleCandidates) {
-    lines.push("", ...renderSuggestedActionCandidateLines(candidate));
+var ACTION_RECEIPT_GROUP_ORDER = [
+  "ready_to_apply",
+  "needs_setup",
+  "needs_approval",
+  "unsupported"
+];
+function actionReceiptGroupTitle(state) {
+  if (state === "ready_to_apply") return "Ready to apply";
+  if (state === "needs_setup") return "Needs setup";
+  if (state === "unsupported") return "Needs attention";
+  return "Needs approval";
+}
+function actionReceiptGroups(actions) {
+  return ACTION_RECEIPT_GROUP_ORDER.flatMap((state) => {
+    const groupedActions = actions.filter((action) => action.state === state);
+    return groupedActions.length > 0 ? [
+      {
+        state,
+        title: actionReceiptGroupTitle(state),
+        actions: groupedActions
+      }
+    ] : [];
+  });
+}
+function renderActionReceiptMarkdownLines(input) {
+  if (input.actions.length === 0) return [];
+  const visibleActions = input.actions.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
+  const groups = actionReceiptGroups(visibleActions);
+  const showGroupHeadings = groups.length > 1;
+  const lines = [`*${input.title}*`, "", "Choose an action in this thread. Details stay in the OpenTag audit log."];
+  for (const group of groups) {
+    if (showGroupHeadings) {
+      lines.push("", `*${group.title}*`);
+    }
+    for (const action of group.actions) {
+      lines.push("", ...renderPresentationActionLines(action));
+    }
   }
-  const remainingCount = candidates.length - visibleCandidates.length;
+  const remainingCount = input.actions.length - visibleActions.length;
   if (remainingCount > 0) {
-    lines.push("", `Showing first ${visibleCandidates.length} of ${candidates.length} actions. Reply with an action number for the rest.`);
+    lines.push("", `Showing first ${visibleActions.length} of ${input.actions.length} actions. Reply with an action number for the rest.`);
   }
-  lines.push("", "Use the buttons below, or reply `apply 1`, `approve 1`, or `reject 1`.");
+  lines.push("", "Use the buttons below, or reply with the matching command.");
   return lines;
 }
-function createSuggestedActionButtons(candidate) {
-  return [
-    {
-      type: "button",
-      text: { type: "plain_text", text: `Apply ${candidate.index}`, emoji: true },
-      action_id: `opentag:apply:${candidate.index}`,
-      value: buildSlackSuggestedActionButtonValue({
-        version: 1,
-        command: `apply ${candidate.index}`,
-        proposalId: candidate.proposalId,
-        intentId: candidate.intent.intentId
-      }),
-      style: "primary"
-    },
-    {
-      type: "button",
-      text: { type: "plain_text", text: "Approve", emoji: true },
-      action_id: `opentag:approve:${candidate.index}`,
-      value: buildSlackSuggestedActionButtonValue({
-        version: 1,
-        command: `approve ${candidate.index}`,
-        proposalId: candidate.proposalId,
-        intentId: candidate.intent.intentId
-      })
-    },
-    {
-      type: "button",
-      text: { type: "plain_text", text: "Reject", emoji: true },
-      action_id: `opentag:reject:${candidate.index}`,
-      value: buildSlackSuggestedActionButtonValue({
-        version: 1,
-        command: `reject ${candidate.index}`,
-        proposalId: candidate.proposalId,
-        intentId: candidate.intent.intentId
-      }),
-      style: "danger"
+function renderSuggestedActionsMarkdown(presentation) {
+  const actions = presentation.actions ?? [];
+  if (actions.length === 0 || !presentation.actionReceiptTitle) return [];
+  return renderActionReceiptMarkdownLines({ title: presentation.actionReceiptTitle, actions });
+}
+function createSuggestedActionButton(action, decision) {
+  const index = action.index;
+  const labels = {
+    apply: `Apply ${index}`,
+    approve: "Approve only",
+    continue: "Continue",
+    reject: "Reject"
+  };
+  return {
+    type: "button",
+    text: { type: "plain_text", text: labels[decision], emoji: true },
+    action_id: `opentag:${decision}:${index}`,
+    value: buildSlackSuggestedActionButtonValue({
+      version: 1,
+      command: `${decision} ${index}`,
+      proposalId: action.proposalId,
+      intentId: action.intentId
+    }),
+    ...decision === "apply" ? { style: "primary" } : {},
+    ...decision === "reject" ? { style: "danger" } : {}
+  };
+}
+function actionHasInteractiveIdentity(action) {
+  return Boolean(action.proposalId && action.intentId);
+}
+function createSuggestedActionButtons(action) {
+  if (!actionHasInteractiveIdentity(action)) return [];
+  return action.visibleDecisions.map((decision) => createSuggestedActionButton(action, decision));
+}
+function createSlackActionReceiptBlockSet(input) {
+  const blocks = [];
+  if (input.includeDivider) blocks.push({ type: "divider" });
+  blocks.push(
+    slackSection(`*${markdownToSlackMrkdwn(input.title)}*
+
+Choose an action in this thread. Details stay in the OpenTag audit log.`)
+  );
+  const visibleActions = input.actions.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
+  const groups = actionReceiptGroups(visibleActions);
+  const showGroupHeadings = groups.length > 1;
+  for (const group of groups) {
+    if (showGroupHeadings) {
+      blocks.push(slackSection(`*${markdownToSlackMrkdwn(group.title)}*`));
     }
-  ];
+    for (const action of group.actions) {
+      blocks.push(slackSection(renderPresentationActionLines(action).join("\n")));
+      const buttons = createSuggestedActionButtons(action);
+      if (buttons.length === 0) continue;
+      blocks.push({
+        type: "actions",
+        block_id: `opentag_actions_${action.index}`,
+        elements: buttons
+      });
+    }
+  }
+  const remainingCount = input.actions.length - visibleActions.length;
+  if (remainingCount > 0) {
+    blocks.push(slackSection(`Showing first ${visibleActions.length} of ${input.actions.length} actions. Reply with an action number for the rest.`));
+  }
+  if (input.auditRunId) {
+    blocks.push(slackContext(markdownToSlackMrkdwn(`Audit: \`opentag status --run ${input.auditRunId}\``)));
+  }
+  return blocks;
+}
+function renderSlackActionReceiptPresentation(presentation) {
+  const lines = renderActionReceiptMarkdownLines({ title: presentation.title, actions: presentation.actions });
+  if (presentation.auditRunId) {
+    lines.push("", markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``));
+  }
+  return lines.join("\n");
+}
+function createSlackActionReceiptBlocks(presentation) {
+  return createSlackActionReceiptBlockSet({
+    title: presentation.title,
+    actions: presentation.actions,
+    ...presentation.auditRunId ? { auditRunId: presentation.auditRunId } : {}
+  });
+}
+function renderSlackFinalResult(result, options = {}) {
+  return renderSlackFinalSummaryPresentation(
+    createFinalSummaryPresentation({
+      result: resultForFinalSummaryPresentation(result),
+      ...options.receiptContext ? { receiptContext: options.receiptContext } : {},
+      ...options.auditRunId ? { auditRunId: options.auditRunId } : {}
+    })
+  );
 }
-function renderSlackFinalResult(result) {
-  const lines = [`*Finished: ${result.conclusion}.*`, markdownToSlackMrkdwn(compactSlackSummary(result.summary))];
-  if (result.verification?.length) {
+function renderSlackFinalSummaryPresentation(presentation) {
+  const lines = [`*Finished: ${presentation.outcome}.*`, markdownToSlackMrkdwn(compactSlackSummary(presentation.summary))];
+  if (presentation.verification?.length) {
     lines.push(
-      `Verified: ${result.verification.slice(0, 3).map((check) => `\`${markdownToSlackMrkdwn(check.command)}\` ${markdownToSlackMrkdwn(check.outcome)}`).join(", ")}`
+      `Verified: ${presentation.verification.slice(0, 3).map((check) => `\`${markdownToSlackMrkdwn(check.command)}\` ${markdownToSlackMrkdwn(check.outcome)}`).join(", ")}`
     );
   }
-  const nextAction = nextActionSummary(result);
-  if (nextAction && !result.suggestedChanges?.length) {
-    lines.push(`Next: ${markdownToSlackMrkdwn(compactNextAction(nextAction))}`);
+  const suggestedActions = renderSuggestedActionsMarkdown(presentation);
+  if (presentation.nextActions?.length && suggestedActions.length === 0) {
+    lines.push(`Next: ${markdownToSlackMrkdwn(compactNextAction(presentation.nextActions[0] ?? ""))}`);
   }
-  const suggestedActions = renderSuggestedActionsMarkdown(result);
   if (suggestedActions.length > 0) {
     lines.push("", ...suggestedActions);
   }
+  if (presentation.auditRunId) {
+    lines.push("", markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``));
+  }
   return lines.join("\n");
 }
-function createSlackFinalResultBlocks(result) {
+function createSlackFinalResultBlocks(result, options = {}) {
+  return createSlackFinalSummaryBlocks(
+    createFinalSummaryPresentation({
+      result: resultForFinalSummaryPresentation(result),
+      ...options.receiptContext ? { receiptContext: options.receiptContext } : {},
+      ...options.auditRunId ? { auditRunId: options.auditRunId } : {}
+    })
+  );
+}
+function createSlackFinalSummaryBlocks(presentation) {
   const blocks = [
     {
       type: "section",
       text: {
         type: "mrkdwn",
-        text: `*Finished: ${result.conclusion}.*
-${markdownToSlackMrkdwn(compactSlackSummary(result.summary))}`
+        text: `*Finished: ${presentation.outcome}.*
+${markdownToSlackMrkdwn(compactSlackSummary(presentation.summary))}`
       }
     }
   ];
-  if (result.verification?.length) {
+  if (presentation.verification?.length) {
     blocks.push({
       type: "section",
       text: {
         type: "mrkdwn",
         text: `Verified: ${markdownToSlackMrkdwn(
-          result.verification.slice(0, 3).map((check) => `\`${check.command}\` ${check.outcome}`).join(", ")
+          presentation.verification.slice(0, 3).map((check) => `\`${check.command}\` ${check.outcome}`).join(", ")
         )}`
       }
     });
   }
-  const nextAction = nextActionSummary(result);
-  const suggestedActionCandidates = suggestedActionCandidatesFromResult(result);
-  if (nextAction && suggestedActionCandidates.length === 0) {
+  const actions = presentation.actions ?? [];
+  if (presentation.nextActions?.length && actions.length === 0) {
     blocks.push({
       type: "section",
       text: {
         type: "mrkdwn",
-        text: `Next: ${markdownToSlackMrkdwn(compactNextAction(nextAction))}`
+        text: `Next: ${markdownToSlackMrkdwn(compactNextAction(presentation.nextActions[0] ?? ""))}`
       }
     });
   }
-  if (suggestedActionCandidates.length > 0) {
-    blocks.push({ type: "divider" });
+  if (actions.length > 0 && presentation.actionReceiptTitle) {
+    blocks.push(...createSlackActionReceiptBlockSet({ title: presentation.actionReceiptTitle, actions, includeDivider: true }));
+  }
+  if (presentation.auditRunId) {
     blocks.push({
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: "*Suggested actions*\nChoose an action in this thread. Details stay in the OpenTag audit log."
-      }
-    });
-    const visibleCandidates = suggestedActionCandidates.slice(0, MAX_SLACK_SUGGESTED_ACTION_CANDIDATES);
-    for (const candidate of visibleCandidates) {
-      blocks.push({
-        type: "section",
-        text: {
-          type: "mrkdwn",
-          text: renderSuggestedActionCandidateLines(candidate).join("\n")
-        }
-      });
-      blocks.push({
-        type: "actions",
-        block_id: `opentag_actions_${candidate.index}`,
-        elements: createSuggestedActionButtons(candidate)
-      });
-    }
-    const remainingCount = suggestedActionCandidates.length - visibleCandidates.length;
-    if (remainingCount > 0) {
-      blocks.push({
-        type: "section",
-        text: {
+      type: "context",
+      elements: [
+        {
           type: "mrkdwn",
-          text: `Showing first ${visibleCandidates.length} of ${suggestedActionCandidates.length} actions. Reply with an action number for the rest.`
+          text: markdownToSlackMrkdwn(`Audit: \`opentag status --run ${presentation.auditRunId}\``)
         }
-      });
-    }
+      ]
+    });
+  }
+  return blocks;
+}
+function createSlackDoctorSummaryBlocks(presentation) {
+  const blocks = [slackSection(`*${markdownToSlackMrkdwn(presentation.title)}*`)];
+  if (presentation.checks.length === 0) {
+    blocks.push(slackContext("No readiness checks were reported."));
+    return blocks;
+  }
+  for (const check of presentation.checks.slice(0, 10)) {
+    blocks.push(
+      slackSection(
+        `*${slackCheckStatusLabel(check.status)} ${markdownToSlackMrkdwn(check.name)}*${check.message ? `
+${markdownToSlackMrkdwn(check.message)}` : ""}`
+      )
+    );
+  }
+  if (presentation.checks.length > 10) {
+    blocks.push(slackContext(`Showing first 10 of ${presentation.checks.length} readiness checks. Use \`opentag doctor\` locally for full detail.`));
+  }
+  return blocks;
+}
+function createSlackSourceThreadStatusBlocks(presentation) {
+  const blocks = [
+    slackSection(`*${markdownToSlackMrkdwn(presentation.title)}*`),
+    slackContext(
+      [
+        presentation.sourceContainer ? `Source: \`${presentation.sourceContainer}\`` : void 0,
+        `Project Target: \`${presentation.projectTarget ?? "not bound"}\``
+      ].filter((line) => Boolean(line)).join(" | ")
+    ),
+    slackSection(
+      [
+        `*Active run:* ${markdownToSlackMrkdwn(slackStatusActiveRun(presentation))}`,
+        presentation.currentCommand ? `*Command:* ${markdownToSlackMrkdwn(presentation.currentCommand)}` : void 0,
+        `*Queued follow-ups:* ${markdownToSlackMrkdwn(slackStatusQueuedFollowUps(presentation))}`,
+        `*Next action:* ${markdownToSlackMrkdwn(presentation.nextAction)}`
+      ].filter((line) => Boolean(line)).join("\n")
+    )
+  ];
+  if (presentation.stopHint || presentation.detailHint) {
+    blocks.push(
+      slackContext(
+        [
+          presentation.stopHint ? `Stop/timeout: ${presentation.stopHint}` : void 0,
+          presentation.detailHint ? `Details: ${presentation.detailHint}` : void 0
+        ].filter((line) => Boolean(line)).map(markdownToSlackMrkdwn).join(" | ")
+      )
+    );
   }
   return blocks;
 }
@@ -460,6 +593,131 @@ function json(body, status = 200) {
 function text(body, status = 200) {
   return { kind: "text", status, body };
 }
+var HELP_TEXT = [
+  "OpenTag commands:",
+  "- @mention the app with `/bind <owner>/<repo>` or `/bind <provider>:<owner>/<repo>` to connect this Slack channel to a Project Target.",
+  "- @mention the app with `/status` to see the Project Target, active run, queued follow-ups, and next safe action.",
+  "- @mention the app with `/doctor` to see a redacted readiness summary for this Slack channel.",
+  "- @mention the app with `/stop [run_id]` to request cancellation for the active channel run or a specific run; OpenTag will not treat stop as successful completion.",
+  "- @mention the app with `/unbind confirm` to disconnect this Slack channel from its Project Target; this does not delete local checkout config.",
+  "- Reply in a source thread with `apply 1`, `approve 1`, `reject 1`, or `continue 1` when OpenTag posts source-thread actions.",
+  "Project Targets never use absolute local paths. Keep local checkout paths in runner config and allowlists."
+].join("\n");
+var BIND_USAGE = "Usage: @mention the app with `/bind <owner>/<repo>` \u2014 e.g. `/bind amplifthq/opentag` or `/bind github:amplifthq/opentag`. Project Targets never use absolute local paths.";
+var UNBIND_USAGE = "Usage: @mention the app with `/unbind confirm` to disconnect this Slack channel from its Project Target. This does not remove local checkout config, repository bindings, or allowlists.";
+var UNBOUND_HINT = "This Slack channel is not connected to a Project Target. @mention the app with `/bind <owner>/<repo>` before starting runs, or update local OpenTag channel bindings.";
+var STOP_UNAVAILABLE_TEXT = [
+  "Run cancellation from this Slack ingress is not configured.",
+  "OpenTag will not treat a stop request as a successful completion. Use `opentag status --run <run_id>` for audit detail, or `opentag service stop` if you need to stop the local background service."
+].join("\n");
+var BINDING_AUTH_DENIED_TEXT = "Only an authorized Slack binding manager can change this channel's Project Target. Ask an admin to run the command or update local OpenTag channel bindings.";
+function normalizeSelfServiceReply(reply) {
+  return typeof reply === "string" ? { text: reply } : reply;
+}
+function parseSelfServiceCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed) return null;
+  if (/^\/help(\s|$)/.test(trimmed)) return "help";
+  if (/^\/status(\s|$)/.test(trimmed)) return "status";
+  if (/^\/doctor(\s|$)/.test(trimmed)) return "doctor";
+  return null;
+}
+function parseStopCommand(command) {
+  const match = command?.trim().match(/^\/stop(?:\s+(\S+))?\s*$/);
+  if (!match) return null;
+  return match[1] ? { runId: match[1] } : {};
+}
+function parseBindCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed || !/^\/bind(\s|$)/.test(trimmed)) return null;
+  const match = trimmed.match(/^\/bind\s+(\S+)\s*$/);
+  if (!match) return { ok: false };
+  try {
+    const ref = parseProjectTargetRef(match[1]);
+    return { ok: true, repoProvider: ref.provider, owner: ref.owner, repo: ref.repo };
+  } catch {
+    return { ok: false };
+  }
+}
+function parseUnbindCommand(command) {
+  const trimmed = command?.trim();
+  if (!trimmed || !/^\/unbind(\s|$)/.test(trimmed)) return null;
+  return /^\/unbind\s+confirm\s*$/.test(trimmed) ? { ok: true } : { ok: false };
+}
+async function canManageSlackBinding(input, context) {
+  if (input.canManageBinding) return input.canManageBinding(context);
+  return false;
+}
+function formatStopResultText(result) {
+  if (result.outcome === "cancelled") {
+    return [
+      `Cancellation requested for run ${result.runId}.`,
+      "- OpenTag will not treat this stop request as a successful completion.",
+      "- The local executor may need a moment to observe the cancellation; further nonessential completion writes are suppressed."
+    ].join("\n");
+  }
+  if (result.outcome === "already_terminal") {
+    return `Run ${result.runId} is already finished. OpenTag will not change its final result.`;
+  }
+  return result.runId ? `Run ${result.runId} was not found or is no longer cancelable.` : "No active run was found for this Slack channel and Project Target.";
+}
+function formatProjectTarget(binding) {
+  return `${binding.repoProvider ?? "github"}:${binding.owner}/${binding.repo}`;
+}
+function statusPresentation(input) {
+  if (!input.binding) {
+    return createSourceThreadStatusPresentation({
+      title: "OpenTag status:",
+      sourceContainer: `slack:${input.teamId}/${input.channelId}`,
+      bindingState: "unbound",
+      nextAction: "bind this Slack channel to a Project Target before starting runs.",
+      detailHint: "active run and queued follow-up status are unavailable until this channel is bound."
+    });
+  }
+  return createSourceThreadStatusPresentation({
+    title: "OpenTag status:",
+    sourceContainer: `slack:${input.teamId}/${input.channelId}`,
+    projectTarget: formatProjectTarget(input.binding),
+    bindingState: "bound",
+    nextAction: "mention the app with a task, send a follow-up in the source thread, or use `opentag status --run <run_id>` locally.",
+    stopHint: "cancellation is explicit and is not reported as successful completion; timeout policy is recorded in audit/status.",
+    detailHint: "at most one run is active per Project Target + source thread; same-thread requests queue behind it."
+  });
+}
+function statusReply(input) {
+  const presentation = statusPresentation(input);
+  return {
+    text: renderOpenTagPresentationPlainText(presentation),
+    blocks: createSlackSourceThreadStatusBlocks(presentation)
+  };
+}
+function doctorPresentation(input) {
+  return createDoctorSummaryPresentation({
+    title: "OpenTag doctor (redacted):",
+    checks: [
+      { status: "ok", name: "Source container", message: `slack:${input.teamId}/${input.channelId}` },
+      {
+        status: input.binding ? "ok" : "warn",
+        name: "Project Target",
+        message: input.binding ? formatProjectTarget(input.binding) : "not bound"
+      },
+      { status: "ok", name: "Secrets", message: "redacted. Use env/file/keychain SecretRef config and never paste tokens into Slack." },
+      {
+        status: "warn",
+        name: "Runtime readiness",
+        message: "check `opentag service status` locally; launchd running is not the same as connector ready."
+      },
+      { status: "ok", name: "Source-thread output", message: "concise final replies by default; detailed process stays in audit/status." }
+    ]
+  });
+}
+function doctorReply(input) {
+  const presentation = doctorPresentation(input);
+  return {
+    text: renderOpenTagPresentationPlainText(presentation),
+    blocks: createSlackDoctorSummaryBlocks(presentation)
+  };
+}
 function createSlackEventProcessor(input) {
   async function processBlockActions(payload, slackApp) {
     const action = payload.actions?.find((candidate) => {
@@ -528,7 +786,7 @@ function createSlackEventProcessor(input) {
     return json({ ok: true });
   }
   return {
-    async process(payload, slackApp) {
+    async process(payload, slackApp, verification = {}) {
       if (payload.type === "block_actions") {
         return processBlockActions(payload, slackApp);
       }
@@ -545,6 +803,177 @@ function createSlackEventProcessor(input) {
         return json({ error: "invalid_event_payload" }, 400);
       }
       const rawThreadActionText = payload.event.type === "app_mention" ? stripSlackAppMention(payload.event.text, payload.authorizations?.[0]?.user_id) : payload.event.text.trim();
+      const bindRequest = payload.event.type === "app_mention" ? parseBindCommand(rawThreadActionText) : null;
+      if (bindRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: "bind" });
+        }
+        if (!input.bindChannel) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: "Slack channel binding from source threads is not configured. Re-run `opentag setup` or update local OpenTag channel bindings."
+          });
+          return json({ ok: true, selfService: "bind", unavailable: true });
+        }
+        if (!bindRequest.ok) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BIND_USAGE
+          });
+          return json({ ok: true, selfService: "bind", usage: true });
+        }
+        const authorized = await canManageSlackBinding(input, {
+          action: "bind",
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          eventId: payload.event_id,
+          ...payload.api_app_id ? { appId: payload.api_app_id } : {}
+        });
+        if (!authorized) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BINDING_AUTH_DENIED_TEXT
+          });
+          return json({ ok: true, selfService: "bind", unauthorized: true });
+        }
+        await input.bindChannel({
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          repoProvider: bindRequest.repoProvider,
+          owner: bindRequest.owner,
+          repo: bindRequest.repo
+        });
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: `Connected this Slack channel to Project Target ${bindRequest.repoProvider}:${bindRequest.owner}/${bindRequest.repo}. @mention the app with a task to start a run.`
+        });
+        return json({ ok: true, selfService: "bind" });
+      }
+      const unbindRequest = payload.event.type === "app_mention" ? parseUnbindCommand(rawThreadActionText) : null;
+      if (unbindRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: "unbind" });
+        }
+        if (!input.unbindChannel) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: "Slack channel unbinding is not enabled in this build. Re-run `opentag setup` or update local OpenTag channel bindings."
+          });
+          return json({ ok: true, selfService: "unbind", unavailable: true });
+        }
+        if (!unbindRequest.ok) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: UNBIND_USAGE
+          });
+          return json({ ok: true, selfService: "unbind", usage: true });
+        }
+        const authorized = await canManageSlackBinding(input, {
+          action: "unbind",
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          eventId: payload.event_id,
+          ...payload.api_app_id ? { appId: payload.api_app_id } : {}
+        });
+        if (!authorized) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: BINDING_AUTH_DENIED_TEXT
+          });
+          return json({ ok: true, selfService: "unbind", unauthorized: true });
+        }
+        const binding2 = await input.resolveChannelBinding({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        if (!binding2) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: UNBOUND_HINT
+          });
+          return json({ ok: true, selfService: "unbind", ignored: "unbound_channel" });
+        }
+        await input.unbindChannel({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: `Disconnected this Slack channel from Project Target ${formatProjectTarget(binding2)}. Re-run \`opentag setup\` or update local OpenTag channel bindings to connect a new target.`
+        });
+        return json({ ok: true, selfService: "unbind" });
+      }
+      const stopRequest = payload.event.type === "app_mention" ? parseStopCommand(rawThreadActionText) : null;
+      if (stopRequest) {
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.stopRun) {
+          if (input.reply) {
+            await input.reply({
+              channelId: payload.event.channel,
+              threadTs,
+              text: STOP_UNAVAILABLE_TEXT
+            });
+          }
+          return json({ ok: true, selfService: "stop", unavailable: true });
+        }
+        const result = await input.stopRun({
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          ...stopRequest.runId ? { runId: stopRequest.runId } : {},
+          requestedBy: `slack:${payload.event.user}`
+        });
+        if (input.reply) {
+          await input.reply({
+            channelId: payload.event.channel,
+            threadTs,
+            text: formatStopResultText(result)
+          });
+        }
+        return json({ ok: true, selfService: "stop", outcome: result.outcome, ...result.runId ? { runId: result.runId } : {} });
+      }
+      const selfServiceCommand = payload.event.type === "app_mention" ? parseSelfServiceCommand(rawThreadActionText) : null;
+      if (selfServiceCommand) {
+        const binding2 = selfServiceCommand === "help" ? null : await input.resolveChannelBinding({
+          teamId: payload.team_id,
+          channelId: payload.event.channel
+        });
+        const threadTs = payload.event.thread_ts ?? payload.event.ts;
+        if (!input.reply) {
+          return json({ ok: true, ignored: "self_service_reply_unavailable", command: selfServiceCommand });
+        }
+        const context = {
+          teamId: payload.team_id,
+          channelId: payload.event.channel,
+          threadTs,
+          userId: payload.event.user,
+          binding: binding2
+        };
+        const reply = selfServiceCommand === "help" ? { text: HELP_TEXT } : normalizeSelfServiceReply(
+          selfServiceCommand === "status" ? input.status ? await input.status(context) : statusReply(context) : input.doctor ? await input.doctor(context) : doctorReply(context)
+        );
+        await input.reply({
+          channelId: payload.event.channel,
+          threadTs,
+          text: reply.text,
+          ...reply.blocks?.length ? { blocks: reply.blocks } : {}
+        });
+        return json({ ok: true, selfService: selfServiceCommand });
+      }
       if (payload.event.type === "message" && (!rawThreadActionText || !parseThreadActionCommand(rawThreadActionText))) {
         return json({ ok: true });
       }
@@ -578,8 +1007,11 @@ function createSlackEventProcessor(input) {
             teamId: payload.team_id,
             channelId: payload.event.channel,
             messageTs: payload.event.ts,
+            sourceDeliveryId: payload.event_id,
+            slackEventId: payload.event_id,
             ...payload.api_app_id ? { slackAppId: payload.api_app_id } : {},
             ...payload.authorizations?.[0]?.user_id ? { slackBotUserId: payload.authorizations[0].user_id } : {},
+            ...typeof verification.signatureVerified === "boolean" ? { webhookSignatureVerified: verification.signatureVerified, signatureState: verification.signatureVerified ? "verified" : "unverified" } : {},
             repoProvider: binding.repoProvider ?? "github",
             owner: binding.owner,
             repo: binding.repo
@@ -603,7 +1035,8 @@ function createSlackEventProcessor(input) {
         ...payload.api_app_id ? { appId: payload.api_app_id } : {},
         ...payload.event.thread_ts ? { threadTs: payload.event.thread_ts } : {},
         ...payload.authorizations?.[0]?.user_id ? { botUserId: payload.authorizations[0].user_id } : {},
-        ...slackApp.callbackUri ? { callbackUri: slackApp.callbackUri } : {}
+        ...slackApp.callbackUri ? { callbackUri: slackApp.callbackUri } : {},
+        ...typeof verification.signatureVerified === "boolean" ? { signatureVerified: verification.signatureVerified } : {}
       });
       if (!event) {
         return json({ ok: true, ignored: "empty_command" });
@@ -617,17 +1050,128 @@ function createSlackEventProcessor(input) {
 // src/ingress.ts
 import { createHmac, timingSafeEqual } from "crypto";
 import { serve } from "@hono/node-server";
+import { createOpenTagClient as createOpenTagClient2 } from "@opentag/client";
+import { DEFAULT_MAX_REQUEST_BODY_BYTES, RequestBodyTooLargeError, readRequestTextWithLimit } from "@opentag/core";
 import { Hono } from "hono";
 
 // src/dispatcher-events.ts
 import { randomUUID } from "crypto";
 import { createOpenTagClient } from "@opentag/client";
+import { createDoctorSummaryPresentation as createDoctorSummaryPresentation2, createSourceThreadStatusPresentation as createSourceThreadStatusPresentation2, renderOpenTagPresentationPlainText as renderOpenTagPresentationPlainText2 } from "@opentag/core";
+function formatProjectTarget2(input) {
+  return `${input.repoProvider ?? "github"}:${input.owner}/${input.repo}`;
+}
+function queuedFollowUpsSummary(status) {
+  if (status.queuedFollowUps.length === 0) return "none.";
+  const visible = status.queuedFollowUps.slice(0, 3).map((followUp) => followUp.id);
+  const suffix = status.queuedFollowUps.length > visible.length ? `, +${status.queuedFollowUps.length - visible.length} more` : "";
+  return `${status.queuedFollowUps.length} (${visible.join(", ")}${suffix}).`;
+}
+function formatDurationMs(ms) {
+  if (ms % 6e4 === 0) return `${ms / 6e4} minute(s)`;
+  if (ms % 1e3 === 0) return `${ms / 1e3} second(s)`;
+  return `${ms}ms`;
+}
+function runTimeoutPolicy(input) {
+  const hardTimeoutMs = input.status?.runTimeoutPolicy?.hardTimeoutMs ?? input.runTimeoutMs;
+  return hardTimeoutMs ? `hard timeout after ${formatDurationMs(hardTimeoutMs)}` : "disabled";
+}
+function slackRuntimeStatusReply(status, input = {}) {
+  const presentation = createSourceThreadStatusPresentation2({
+    title: "OpenTag status:",
+    sourceContainer: `${status.binding.provider}:${status.binding.accountId}/${status.binding.conversationId}`,
+    projectTarget: formatProjectTarget2(status.binding),
+    bindingState: "bound",
+    ...status.activeRun ? {
+      activeRun: {
+        id: status.activeRun.id,
+        status: status.activeRun.status,
+        updatedAt: status.activeRun.updatedAt
+      }
+    } : {},
+    ...status.activeEvent?.command.rawText ? { currentCommand: status.activeEvent.command.rawText } : {},
+    queuedFollowUps: status.queuedFollowUps.slice(0, 3).map((followUp) => ({
+      id: followUp.id,
+      status: followUp.status,
+      command: followUp.event.command.rawText
+    })),
+    queuedFollowUpsTotal: status.queuedFollowUps.length,
+    nextAction: status.activeRun ? "wait for the final reply, send a follow-up to queue more context, or use `opentag status --run <run_id>` locally." : "@mention the app with a task to start a run.",
+    stopHint: `cancellation is explicit and is not reported as successful completion; timeout policy: ${runTimeoutPolicy({ ...input, status })}.`,
+    detailHint: "use `opentag status --run <run_id>` locally for audit events and executor detail."
+  });
+  return {
+    text: renderOpenTagPresentationPlainText2(presentation),
+    blocks: createSlackSourceThreadStatusBlocks(presentation)
+  };
+}
+function slackRuntimeDoctorReply(input) {
+  const presentation = createDoctorSummaryPresentation2({
+    title: "OpenTag doctor (redacted):",
+    checks: [
+      { status: "ok", name: "Source container", message: `slack:${input.teamId}/${input.channelId}` },
+      { status: "ok", name: "Project Target", message: formatProjectTarget2(input.status.binding) },
+      { status: "ok", name: "Dispatcher", message: "reachable for this source container." },
+      {
+        status: "ok",
+        name: "Active run",
+        message: input.status.activeRun ? `${input.status.activeRun.id} (${input.status.activeRun.status}), updated ${input.status.activeRun.updatedAt}.` : "none."
+      },
+      { status: "ok", name: "Queued follow-ups", message: queuedFollowUpsSummary(input.status) },
+      { status: "ok", name: "Timeout policy", message: runTimeoutPolicy({ ...input, status: input.status }) },
+      {
+        status: "ok",
+        name: "Runtime readiness",
+        message: "source-container status is reachable; run `opentag service status` locally to confirm controller, connector, executor, and heartbeat health."
+      },
+      { status: "ok", name: "Secrets", message: "redacted. Use env/file/keychain SecretRef config and never paste tokens into Slack." }
+    ]
+  });
+  return {
+    text: renderOpenTagPresentationPlainText2(presentation),
+    blocks: createSlackDoctorSummaryBlocks(presentation)
+  };
+}
+function statusUnavailable(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  return [
+    "OpenTag status:",
+    input.binding ? `Project Target: ${formatProjectTarget2(input.binding)}` : "Project Target: not bound.",
+    "Runtime status: unavailable from dispatcher.",
+    `Reason: ${message}`,
+    "Next action: check `opentag service status` and `opentag status` locally."
+  ].join("\n");
+}
+function doctorUnavailable(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  return [
+    "OpenTag doctor (redacted):",
+    `Source container: slack:${input.teamId}/${input.channelId}`,
+    input.binding ? `Project Target: ${formatProjectTarget2(input.binding)}` : "Project Target: not bound.",
+    "Dispatcher: source-container status unavailable.",
+    `Reason: ${message}`,
+    "Runtime readiness: run `opentag service status` and `opentag status --channel slack:<team>/<channel>` locally.",
+    "Secrets: redacted; do not share local config or app tokens in Slack."
+  ].join("\n");
+}
+function mapStopError(input) {
+  const message = input.error instanceof Error ? input.error.message : String(input.error);
+  if (message.includes("run_already_terminal")) {
+    return { outcome: "already_terminal", runId: input.runId ?? "active run" };
+  }
+  if (message.includes("run_not_found") || message.includes("active_run_not_found") || message.includes("channel_binding_not_found")) {
+    return input.runId ? { outcome: "not_found", runId: input.runId } : { outcome: "not_found" };
+  }
+  return null;
+}
 function createSlackDispatcherEventProcessorInput(config) {
+  const fetchImpl = config.fetchImpl ?? fetch;
   const dispatcherClient = createOpenTagClient({
     dispatcherUrl: config.dispatcherUrl,
-    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {}
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {},
+    fetchImpl
   });
-  return {
+  const processorInput = {
     async resolveChannelBinding(input) {
       try {
         const { binding } = await dispatcherClient.getChannelBinding({
@@ -654,11 +1198,112 @@ function createSlackDispatcherEventProcessorInput(config) {
       const created = await dispatcherClient.createRun({ runId, event });
       return created.outcome === "run_created" ? { runId: created.run.id } : { runId };
     },
+    async bindChannel(input) {
+      await dispatcherClient.bindChannel({
+        provider: "slack",
+        accountId: input.teamId,
+        conversationId: input.channelId,
+        repoProvider: input.repoProvider,
+        owner: input.owner,
+        repo: input.repo
+      });
+    },
     async submitThreadAction(action) {
       await dispatcherClient.submitThreadAction(action);
     },
+    async unbindChannel(input) {
+      await dispatcherClient.unbindChannel({
+        provider: "slack",
+        accountId: input.teamId,
+        conversationId: input.channelId
+      });
+    },
+    canManageBinding(input) {
+      return Boolean(config.bindingAdminUserIds?.includes(input.userId));
+    },
+    async stopRun(input) {
+      try {
+        const result = input.runId ? await dispatcherClient.cancelRun({
+          runId: input.runId,
+          reason: "Stop requested from Slack.",
+          requestedBy: input.requestedBy
+        }) : await dispatcherClient.cancelActiveChannelRun({
+          provider: "slack",
+          accountId: input.teamId,
+          conversationId: input.channelId,
+          reason: "Stop requested from Slack.",
+          requestedBy: input.requestedBy
+        });
+        return { outcome: "cancelled", runId: result.run.id };
+      } catch (error) {
+        const mapped = mapStopError({ error, ...input.runId ? { runId: input.runId } : {} });
+        if (mapped) return mapped;
+        throw error;
+      }
+    },
+    async status(input) {
+      if (!input.binding) return statusUnavailable({ error: "channel not bound" });
+      try {
+        return slackRuntimeStatusReply(
+          await dispatcherClient.getChannelRuntimeStatus({
+            provider: "slack",
+            accountId: input.teamId,
+            conversationId: input.channelId
+          }),
+          { ...config.runTimeoutMs ? { runTimeoutMs: config.runTimeoutMs } : {} }
+        );
+      } catch (error) {
+        return statusUnavailable({ binding: input.binding, error });
+      }
+    },
+    async doctor(input) {
+      if (!input.binding) {
+        return doctorUnavailable({ teamId: input.teamId, channelId: input.channelId, error: "channel not bound" });
+      }
+      try {
+        return slackRuntimeDoctorReply({
+          teamId: input.teamId,
+          channelId: input.channelId,
+          status: await dispatcherClient.getChannelRuntimeStatus({
+            provider: "slack",
+            accountId: input.teamId,
+            conversationId: input.channelId
+          }),
+          ...config.runTimeoutMs ? { runTimeoutMs: config.runTimeoutMs } : {}
+        });
+      } catch (error) {
+        return doctorUnavailable({ teamId: input.teamId, channelId: input.channelId, binding: input.binding, error });
+      }
+    },
     now: () => (/* @__PURE__ */ new Date()).toISOString()
   };
+  if (config.botToken) {
+    processorInput.reply = async (input) => {
+      const response = await fetchImpl(config.callbackUri ?? "https://slack.com/api/chat.postMessage", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${config.botToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(
+          createSlackPostMessagePayload({
+            channelId: input.channelId,
+            threadTs: input.threadTs,
+            text: input.text,
+            ...input.blocks?.length ? { blocks: input.blocks } : {}
+          })
+        )
+      });
+      if (!response.ok) {
+        throw new Error(`deliver Slack self-service reply failed: ${response.status} ${await response.text()}`);
+      }
+      const body = await response.json().catch(() => ({}));
+      if (body.ok === false) {
+        throw new Error(`deliver Slack self-service reply failed: ${body.error ?? "unknown_error"}`);
+      }
+    };
+  }
+  return processorInput;
 }
 
 // src/ingress.ts
@@ -680,9 +1325,94 @@ function verifySlackTimestamp(input) {
   const ageSeconds = Math.abs(Math.floor(input.nowMs / 1e3) - timestampSeconds);
   return ageSeconds <= toleranceSeconds;
 }
+async function recordSlackSignatureFailure(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.signature_failed",
+      severity: "warn",
+      subject: "slack:POST /slack/events",
+      payload: {
+        provider: "slack",
+        endpoint: "POST /slack/events",
+        reason: input.reason,
+        hasSignature: input.hasSignature,
+        hasTimestamp: input.hasTimestamp,
+        ...input.apiAppId ? { apiAppId: input.apiAppId } : {}
+      }
+    });
+  } catch {
+  }
+}
+async function recordSlackRequestBodyRejected(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.request_body_rejected",
+      severity: "warn",
+      subject: "slack:POST /slack/events",
+      payload: {
+        provider: "slack",
+        endpoint: "POST /slack/events",
+        reason: input.reason,
+        ...input.maxBytes !== void 0 ? { maxBytes: input.maxBytes } : {},
+        contentLength: input.contentLength,
+        ...input.apiAppId ? { apiAppId: input.apiAppId } : {}
+      }
+    });
+  } catch {
+  }
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasOptionalStringProperties(value, keys) {
+  return keys.every((key) => value[key] === void 0 || typeof value[key] === "string");
+}
+function isSlackEventEnvelope(value) {
+  if (value.type !== "url_verification" && value.type !== "event_callback") return false;
+  if (!hasOptionalStringProperties(value, ["token", "challenge", "team_id", "api_app_id", "event_id"])) return false;
+  if (value.event_time !== void 0 && typeof value.event_time !== "number") return false;
+  if (value.authorizations !== void 0) {
+    if (!Array.isArray(value.authorizations)) return false;
+    if (!value.authorizations.every(
+      (authorization) => isRecord(authorization) && (authorization.user_id === void 0 || typeof authorization.user_id === "string")
+    )) {
+      return false;
+    }
+  }
+  if (value.event !== void 0) {
+    if (!isRecord(value.event) || typeof value.event.type !== "string") return false;
+    if (!hasOptionalStringProperties(value.event, ["user", "text", "ts", "thread_ts", "channel", "subtype", "bot_id"])) {
+      return false;
+    }
+  }
+  return true;
+}
+function isSlackInteractivePayload(value) {
+  if (value.type !== "block_actions") return false;
+  if (!hasOptionalStringProperties(value, ["api_app_id", "trigger_id"])) return false;
+  if (value.team !== void 0 && (!isRecord(value.team) || !hasOptionalStringProperties(value.team, ["id", "domain"]))) return false;
+  if (value.user !== void 0 && (!isRecord(value.user) || !hasOptionalStringProperties(value.user, ["id", "username", "name"]))) return false;
+  if (value.channel !== void 0 && (!isRecord(value.channel) || !hasOptionalStringProperties(value.channel, ["id", "name"]))) return false;
+  if (value.message !== void 0 && (!isRecord(value.message) || !hasOptionalStringProperties(value.message, ["ts", "thread_ts"]))) return false;
+  if (value.container !== void 0 && (!isRecord(value.container) || !hasOptionalStringProperties(value.container, ["type", "channel_id", "message_ts", "thread_ts"]))) {
+    return false;
+  }
+  if (value.actions !== void 0) {
+    if (!Array.isArray(value.actions)) return false;
+    return value.actions.every(
+      (action) => isRecord(action) && hasOptionalStringProperties(action, ["type", "action_id", "block_id", "value", "action_ts"])
+    );
+  }
+  return true;
+}
+function isSlackIngressPayload(value) {
+  if (!isRecord(value) || typeof value.type !== "string") return false;
+  return isSlackEventEnvelope(value) || isSlackInteractivePayload(value);
+}
 function createSlackEventsApp(input) {
   const app = new Hono();
   const processor = createSlackEventProcessor(input);
+  const maxRequestBodyBytes = input.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES;
   function parseSlackPayload(rawBody, contentType) {
     try {
       if (contentType?.includes("application/x-www-form-urlencoded") || rawBody.startsWith("payload=")) {
@@ -714,16 +1444,56 @@ function createSlackEventsApp(input) {
     const timestamp = c.req.header("x-slack-request-timestamp");
     const signature = c.req.header("x-slack-signature");
     if (!timestamp || !signature) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "missing_signature_headers",
+        hasSignature: Boolean(signature),
+        hasTimestamp: Boolean(timestamp)
+      });
       return c.json({ error: "missing_signature_headers" }, 401);
     }
     if (!verifySlackTimestamp({ timestamp, nowMs: input.clock?.() ?? Date.now() })) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "stale_signature_timestamp",
+        hasSignature: true,
+        hasTimestamp: true
+      });
       return c.json({ error: "stale_signature_timestamp" }, 401);
     }
-    const rawBody = await c.req.text();
+    let rawBody;
+    try {
+      rawBody = await readRequestTextWithLimit(c.req.raw, { maxBytes: maxRequestBodyBytes });
+    } catch (error) {
+      if (error instanceof RequestBodyTooLargeError) {
+        await recordSlackRequestBodyRejected({
+          recordControlPlaneEvent: input.recordControlPlaneEvent,
+          reason: "request_body_too_large",
+          maxBytes: error.maxBytes,
+          contentLength: c.req.raw.headers.get("content-length")
+        });
+        return c.json({ error: "request_body_too_large", maxBytes: error.maxBytes }, 413);
+      }
+      throw error;
+    }
     const payload = parseSlackPayload(rawBody, c.req.header("content-type"));
     if (!payload) {
+      await recordSlackRequestBodyRejected({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "invalid_json_body",
+        contentLength: c.req.raw.headers.get("content-length")
+      });
       return c.json({ error: "invalid_json" }, 400);
     }
+    if (!isSlackIngressPayload(payload)) {
+      await recordSlackRequestBodyRejected({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: "invalid_request_body",
+        contentLength: c.req.raw.headers.get("content-length"),
+        ...isRecord(payload) && typeof payload.api_app_id === "string" ? { apiAppId: payload.api_app_id } : {}
+      });
+      return c.json({ error: "invalid_request_body" }, 400);
+    }
     const resolvedSlackApp = resolveSlackApp({
       rawBody,
       signature,
@@ -731,9 +1501,16 @@ function createSlackEventsApp(input) {
       ...payload.api_app_id ? { apiAppId: payload.api_app_id } : {}
     });
     if ("error" in resolvedSlackApp) {
+      await recordSlackSignatureFailure({
+        recordControlPlaneEvent: input.recordControlPlaneEvent,
+        reason: resolvedSlackApp.error,
+        hasSignature: true,
+        hasTimestamp: true,
+        ...payload.api_app_id ? { apiAppId: payload.api_app_id } : {}
+      });
       return c.json({ error: resolvedSlackApp.error }, 401);
     }
-    const result = await processor.process(payload, resolvedSlackApp.slackApp);
+    const result = await processor.process(payload, resolvedSlackApp.slackApp, { signatureVerified: true });
     if (result.kind === "text") {
       return c.text(result.body, result.status);
     }
@@ -743,6 +1520,10 @@ function createSlackEventsApp(input) {
 }
 function startSlackIngress(config) {
   const port = config.port ?? 3040;
+  const dispatcherClient = createOpenTagClient2({
+    dispatcherUrl: config.dispatcherUrl,
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {}
+  });
   const server = serve({
     fetch: createSlackEventsApp({
       slackApps: [
@@ -753,6 +1534,10 @@ function startSlackIngress(config) {
           ...config.callbackUri ? { callbackUri: config.callbackUri } : {}
         }
       ],
+      ...config.maxRequestBodyBytes ? { maxRequestBodyBytes: config.maxRequestBodyBytes } : {},
+      async recordControlPlaneEvent(event) {
+        await dispatcherClient.recordControlPlaneEvent(event);
+      },
       ...createSlackDispatcherEventProcessorInput(config)
     }).fetch,
     port
@@ -776,6 +1561,7 @@ function startSlackIngress(config) {
 
 // src/socket-mode.ts
 import WebSocket from "ws";
+import { createOpenTagClient as createOpenTagClient3 } from "@opentag/client";
 var SLACK_CONNECTIONS_OPEN_URL = "https://slack.com/api/apps.connections.open";
 var DEFAULT_RECONNECT_DELAY_MS = 1e3;
 var TERMINAL_SLACK_ERROR_CODES = [
@@ -789,9 +1575,9 @@ var TERMINAL_SLACK_ERROR_CODES = [
   "missing_scope",
   "ekm_access_denied"
 ];
-function isTerminalSlackAuthError(error) {
-  if (!(error instanceof Error)) return false;
-  return TERMINAL_SLACK_ERROR_CODES.some((code) => error.message.includes(code));
+function terminalSlackAuthErrorCode(error) {
+  if (!(error instanceof Error)) return null;
+  return TERMINAL_SLACK_ERROR_CODES.find((code) => error.message.includes(code)) ?? null;
 }
 function rawDataToString(data) {
   if (typeof data === "string") return data;
@@ -842,6 +1628,25 @@ async function handleSocketMessage(input) {
 function wait(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function recordSlackSocketTokenMisuse(input) {
+  try {
+    await input.recordControlPlaneEvent?.({
+      type: "security.token_misuse",
+      severity: "warn",
+      subject: "slack:app_token",
+      payload: {
+        provider: "slack",
+        endpoint: "apps.connections.open",
+        reason: input.reason,
+        tokenKind: "app_token",
+        mode: "socket_mode",
+        agentId: input.slackApp.agentId,
+        ...input.slackApp.appId ? { appId: input.slackApp.appId } : {}
+      }
+    });
+  } catch {
+  }
+}
 function startSlackSocketModeApp(input, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const createWebSocket = dependencies.createWebSocket ?? ((url) => new WebSocket(url));
@@ -892,9 +1697,15 @@ function startSlackSocketModeApp(input, dependencies = {}) {
         const socketUrl = await openSlackSocketUrl({ appToken: input.appToken, fetchImpl });
         await runOneConnection(socketUrl);
       } catch (error) {
-        if (isTerminalSlackAuthError(error)) {
+        const terminalErrorCode = terminalSlackAuthErrorCode(error);
+        if (terminalErrorCode) {
           if (!closed) {
             logError("[slack] terminal Socket Mode auth/config error, aborting:", error);
+            await recordSlackSocketTokenMisuse({
+              recordControlPlaneEvent: input.recordControlPlaneEvent,
+              slackApp: input.slackApp,
+              reason: terminalErrorCode
+            });
           }
           throw error;
         }
@@ -917,6 +1728,11 @@ function startSlackSocketModeApp(input, dependencies = {}) {
   };
 }
 function startSlackSocketModeIngress(config, dependencies = {}) {
+  const dispatcherClient = createOpenTagClient3({
+    dispatcherUrl: config.dispatcherUrl,
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {},
+    fetchImpl: config.fetchImpl ?? fetch
+  });
   return startSlackSocketModeApp(
     {
       appToken: config.appToken,
@@ -925,6 +1741,9 @@ function startSlackSocketModeIngress(config, dependencies = {}) {
         ...config.appId ? { appId: config.appId } : {},
         ...config.callbackUri ? { callbackUri: config.callbackUri } : {}
       },
+      async recordControlPlaneEvent(event) {
+        await dispatcherClient.recordControlPlaneEvent(event);
+      },
       ...createSlackDispatcherEventProcessorInput(config)
     },
     dependencies
@@ -933,11 +1752,15 @@ function startSlackSocketModeIngress(config, dependencies = {}) {
 export {
   buildSlackSuggestedActionButtonValue,
   computeSlackSignature,
+  createSlackActionReceiptBlocks,
+  createSlackDoctorSummaryBlocks,
   createSlackEventProcessor,
   createSlackEventsApp,
   createSlackFinalResultBlocks,
+  createSlackFinalSummaryBlocks,
   createSlackPostMessagePayload,
   createSlackReactionPayload,
+  createSlackSourceThreadStatusBlocks,
   createSlackUpdateMessagePayload,
   encodeSlackThreadKey,
   markdownToSlackMrkdwn,
@@ -945,7 +1768,9 @@ export {
   parseSlackSuggestedActionButtonValue,
   parseSlackThreadKey,
   renderSlackAcknowledgement,
+  renderSlackActionReceiptPresentation,
   renderSlackFinalResult,
+  renderSlackFinalSummaryPresentation,
   slackSourceReceiptReactionName,
   startSlackIngress,
   startSlackSocketModeApp,