cli-jaw 2.2.17 → 2.2.18

package/public/js/features/settings-slack.ts

@@ -1,42 +1,113 @@
 // ── Slack Settings ──
-import { api, apiJson } from '../api.js';
+import { API_BASE, api, apiJson, getAuthToken } from '../api.js';
 import { openSetupGuideIfUnconfigured } from './channel-setup-guide.js';
 import { hasSlackBotTokenPrefix, hasSlackAppTokenPrefix } from './channel-setup-rules.js';
 import { t } from './i18n.js';
+import { refreshTransportStatusRow } from './transport-status-row.js';
 import type { SettingsData } from './settings-types.js';
 
-// ── Guided setup card ──
-// One-time bindings for the Slack setup card in settings: manifest copy,
-// app-page shortcut, and inline token-prefix validation (error below the
-// field, cleared once the value looks right — form-patterns on-blur timing).
+// One-time inline token-prefix validation. Errors appear below each field on
+// blur and clear live once the token prefix is corrected.
 let setupGuideBound = false;
+let slackResetting = false;
+let slackEnvironmentVariables: string[] = [];
+
+type SlackResetResponse = {
+    ok?: boolean;
+    error?: string;
+    environmentVariables?: string[];
+};
+
+async function requestSlackConnectionReset(): Promise<SlackResetResponse | null> {
+    try {
+        const token = await getAuthToken();
+        const response = await fetch(`${API_BASE}/api/settings/slack/reset`, {
+            method: 'POST',
+            headers: token ? { Authorization: `Bearer ${token}` } : {},
+        });
+        return await response.json().catch(() => null) as SlackResetResponse | null;
+    } catch {
+        // The write may have committed even if its response was lost. The
+        // authoritative GET below decides whether the reset actually landed.
+        return null;
+    }
+}
+
+function slackConnectionIsCleared(snapshot: SettingsData | null): boolean {
+    const slack = snapshot?.slack;
+    return !slack?.enabled
+        && !slack?.botToken
+        && !slack?.appToken
+        && !slack?.teamId
+        && !(slack?.channelIds?.length)
+        && !slack?.attachPort;
+}
+
+function slackEnvironmentMessage(): string {
+    return t('settings.slack.resetManagedByEnvironment', {
+        variables: slackEnvironmentVariables.join(', ') || 'SLACK_*',
+    });
+}
 
 export function initSlackSetupGuide(): void {
     if (setupGuideBound) return;
     setupGuideBound = true;
 
-    document.getElementById('slack-copy-manifest')?.addEventListener('click', async (ev) => {
-        const btn = ev.currentTarget as HTMLButtonElement;
-        try {
-            const json = await api<{ yaml?: string }>('/api/slack/manifest');
-            const yaml = json?.yaml || '';
-            if (!yaml) throw new Error('empty manifest');
-            await navigator.clipboard.writeText(yaml);
-            const original = btn.textContent || '';
-            btn.textContent = t('settings.slack.guide.copyManifestDone');
-            setTimeout(() => { btn.textContent = original; }, 2000);
-        } catch {
-            btn.textContent = t('settings.slack.guide.copyManifestFail');
-            setTimeout(() => { btn.textContent = t('settings.slack.guide.copyManifest'); }, 2500);
-        }
+    bindPrefixValidation('slBotToken', 'slack-bot-token-error', hasSlackBotTokenPrefix);
+    bindPrefixValidation('slAppToken', 'slack-app-token-error', hasSlackAppTokenPrefix);
+    document.getElementById('slack-reset-connection')?.addEventListener('click', () => {
+        void resetSlackConnection();
     });
+}
 
-    document.getElementById('slack-open-apps')?.addEventListener('click', () => {
-        window.open('https://api.slack.com/apps?new_app=1', '_blank', 'noopener');
-    });
+export async function resetSlackConnection(): Promise<void> {
+    if (slackResetting) return;
+    if (slackEnvironmentVariables.length > 0) {
+        window.alert(slackEnvironmentMessage());
+        return;
+    }
+    const botToken = document.getElementById('slBotToken') as HTMLInputElement | null;
+    const appToken = document.getElementById('slAppToken') as HTMLInputElement | null;
+    if (!botToken?.value.trim() && !appToken?.value.trim()) {
+        window.alert(t('settings.slack.resetEmpty'));
+        return;
+    }
+    if (!window.confirm(t('settings.slack.resetConfirm'))) return;
 
-    bindPrefixValidation('slBotToken', 'slack-bot-token-error', hasSlackBotTokenPrefix);
-    bindPrefixValidation('slAppToken', 'slack-app-token-error', hasSlackAppTokenPrefix);
+    const resetButton = document.getElementById('slack-reset-connection') as HTMLButtonElement | null;
+    slackResetting = true;
+    if (resetButton) resetButton.disabled = true;
+    try {
+        const result = await requestSlackConnectionReset();
+        const authoritative = await api<SettingsData>('/api/settings');
+        if (authoritative) loadSlackSettings(authoritative);
+        await refreshTransportStatusRow();
+
+        if (result?.error === 'slack_connection_managed_by_environment') {
+            const variables = Array.isArray(result.environmentVariables)
+                ? result.environmentVariables.join(', ')
+                : 'SLACK_*';
+            window.alert(t('settings.slack.resetManagedByEnvironment', { variables }));
+            return;
+        }
+        if (!slackConnectionIsCleared(authoritative)) {
+            window.alert(t('settings.slack.resetFailed'));
+            return;
+        }
+
+        for (const id of ['slBotToken', 'slAppToken', 'slTeamId', 'slChannelIds', 'slAttachPort']) {
+            document.getElementById(id)?.classList.remove('input-error');
+        }
+        for (const id of ['slack-bot-token-error', 'slack-app-token-error']) {
+            const error = document.getElementById(id);
+            if (error) error.style.display = 'none';
+        }
+        document.getElementById('slOff')?.classList.add('active');
+        document.getElementById('slOn')?.classList.remove('active');
+    } finally {
+        slackResetting = false;
+        if (resetButton) resetButton.disabled = slackEnvironmentVariables.length > 0;
+    }
 }
 
 function bindPrefixValidation(inputId: string, errorId: string, valid: (v: string) => boolean): void {
@@ -57,6 +128,10 @@ function bindPrefixValidation(inputId: string, errorId: string, valid: (v: strin
 }
 
 export async function saveSlackSettings(): Promise<void> {
+    if (slackEnvironmentVariables.length > 0) {
+        window.alert(slackEnvironmentMessage());
+        return;
+    }
     const botToken = (document.getElementById('slBotToken') as HTMLInputElement)?.value.trim() || '';
     const appToken = (document.getElementById('slAppToken') as HTMLInputElement)?.value.trim() || '';
     const teamId = (document.getElementById('slTeamId') as HTMLInputElement)?.value.trim() || '';
@@ -69,6 +144,10 @@ export async function saveSlackSettings(): Promise<void> {
 }
 
 export async function setSlack(enabled: boolean): Promise<void> {
+    if (slackEnvironmentVariables.length > 0) {
+        window.alert(slackEnvironmentMessage());
+        return;
+    }
     document.getElementById('slOn')?.classList.toggle('active', enabled);
     document.getElementById('slOff')?.classList.toggle('active', !enabled);
     await apiJson('/api/settings', 'PUT', { slack: { enabled } });
@@ -102,18 +181,37 @@ export async function setSlackReplyInThread(enabled: boolean): Promise<void> {
 export function loadSlackSettings(s: SettingsData): void {
     if (!s.slack) return;
     const sc = s.slack;
+    slackEnvironmentVariables = Array.isArray(s.slackEnvironmentVariables)
+        ? s.slackEnvironmentVariables
+        : [];
+    const environmentManaged = slackEnvironmentVariables.length > 0;
+    const notice = document.getElementById('slack-environment-managed');
+    if (notice) {
+        notice.style.display = environmentManaged ? '' : 'none';
+        notice.textContent = environmentManaged
+            ? t('settings.slack.managedByEnvironment', { variables: slackEnvironmentVariables.join(', ') })
+            : '';
+    }
+    for (const id of ['slBotToken', 'slAppToken', 'slTeamId', 'slChannelIds', 'slAttachPort']) {
+        const input = document.getElementById(id) as HTMLInputElement | null;
+        if (input) input.disabled = environmentManaged;
+    }
+    for (const id of ['slOff', 'slOn', 'slack-reset-connection', 'slack-onboarding-trigger']) {
+        const button = document.getElementById(id) as HTMLButtonElement | null;
+        if (button) button.disabled = environmentManaged;
+    }
     document.getElementById('slOn')?.classList.toggle('active', !!sc.enabled);
     document.getElementById('slOff')?.classList.toggle('active', !sc.enabled);
     const botToken = document.getElementById('slBotToken') as HTMLInputElement | null;
-    if (sc.botToken && botToken) botToken.value = sc.botToken;
+    if (botToken) botToken.value = environmentManaged ? '' : sc.botToken || '';
     const appToken = document.getElementById('slAppToken') as HTMLInputElement | null;
-    if (sc.appToken && appToken) appToken.value = sc.appToken;
+    if (appToken) appToken.value = environmentManaged ? '' : sc.appToken || '';
     const teamId = document.getElementById('slTeamId') as HTMLInputElement | null;
-    if (sc.teamId && teamId) teamId.value = sc.teamId;
+    if (teamId) teamId.value = environmentManaged ? '' : sc.teamId || '';
     const channelIds = document.getElementById('slChannelIds') as HTMLInputElement | null;
-    if (sc.channelIds?.length && channelIds) channelIds.value = sc.channelIds.join(', ');
+    if (channelIds) channelIds.value = environmentManaged ? '' : sc.channelIds?.join(', ') || '';
     const attachPort = document.getElementById('slAttachPort') as HTMLInputElement | null;
-    if (attachPort) attachPort.value = sc.attachPort || '';
+    if (attachPort) attachPort.value = environmentManaged ? '' : sc.attachPort || '';
     const fwdOn = sc.forwardAll !== false;
     document.getElementById('slForwardOn')?.classList.toggle('active', fwdOn);
     document.getElementById('slForwardOff')?.classList.toggle('active', !fwdOn);

package/public/js/features/settings-types.ts

@@ -63,11 +63,19 @@ export interface CliStatusInfo {
     authenticated: boolean | null;
     path: string | null;
     source: string;
-    probeState: 'checking' | 'fresh' | 'stale';
+    probeState: 'checking' | 'fresh' | 'stale' | 'failing';
     reason?: string;
+    /** Underlying probe error, present only while `failing`. */
+    probeError?: string;
+    probeFailures?: number;
+    nextRetryAt?: number;
 }
-export function describeCliProbe(info: CliStatusInfo): 'checking' | 'capability-failed' | 'stale' | 'ready' | 'unavailable' {
+export function describeCliProbe(info: CliStatusInfo): 'checking' | 'probe-failing' | 'capability-failed' | 'stale' | 'ready' | 'unavailable' {
     if (info.probeState === 'checking') return 'checking';
+    // Ahead of every other branch: while probes keep failing we know nothing
+    // current about the runtime, so a preserved snapshot must not be rendered
+    // as ready or merely stale (#277).
+    if (info.probeState === 'failing') return 'probe-failing';
     if (info.binaryInstalled === true && info.capabilityReady === false) return 'capability-failed';
     if (info.probeState === 'stale') return 'stale';
     return info.available === true && info.capabilityReady !== false ? 'ready' : 'unavailable';
@@ -82,6 +90,7 @@ export interface SettingsData {
     telegram?: TelegramConfig;
     discord?: DiscordConfig;
     slack?: SlackConfig;
+    slackEnvironmentVariables?: string[];
     channel?: 'telegram' | 'discord' | 'slack';
     fallbackOrder?: string[];
     memory?: { cli?: string };

package/public/locales/en.json

@@ -545,7 +545,7 @@
     "help.slack.link.portal": "Open the Slack app dashboard",
     "help.slack.link.docs": "Socket Mode documentation",
     "help.slack.example.1": "@cli-jaw run the tests for this repo",
-    "help.slack.howTo.1": "Click \"Copy manifest\" in the guide card below, then create the app at api.slack.com/apps → Create an App → From an app manifest.",
+    "help.slack.howTo.1": "Click \"Copy manifest\" in the guide card below, then create the app at api.slack.com/apps → Create New App → From a manifest.",
     "help.slack.howTo.2": "Enable Socket Mode and generate an app-level token (xapp-) with connections:write.",
     "help.slack.howTo.3": "Install to the workspace to obtain the bot token (xoxb-).",
     "help.slack.howTo.4": "Paste each token into its own field below — do not swap them.",
@@ -854,10 +854,6 @@
     "bgtask.title": "Background",
     "tg.elicitationExpired": "Selection expired. Please reply with text.",
     "settings.slack.guide.step1Title": "Create the Slack app",
-    "settings.slack.guide.step1Desc": "Create an App → From an app manifest → pick workspace → paste. For an existing app, add files:read.",
-    "settings.slack.guide.copyManifest": "Copy manifest",
-    "settings.slack.guide.copyManifestDone": "Copied — paste the files:read manifest into Slack",
-    "settings.slack.guide.copyManifestFail": "Copy failed — use jaw slack manifest",
     "settings.slack.guide.openApps": "Open apps page",
     "settings.slack.guide.step2Title": "Paste the bot token",
     "settings.slack.guide.step3Title": "App-level token for inbound (optional)",
@@ -865,6 +861,12 @@
     "settings.slack.guide.botTokenError": "Must be a bot token starting with xoxb- — swapped with the app token?",
     "settings.slack.guide.appTokenError": "Must be an app-level token starting with xapp- — swapped with the bot token?",
     "settings.slack.advanced": "Advanced settings",
+    "settings.slack.resetConnection": "Reset connection",
+    "settings.slack.resetConfirm": "The Slack app connection will be reset. Continue?",
+    "settings.slack.resetEmpty": "No Slack app is connected.",
+    "settings.slack.resetFailed": "Could not reset the Slack app connection. Try again.",
+    "settings.slack.resetManagedByEnvironment": "This Slack connection is managed by environment variables ({variables}). Remove them and restart cli-jaw before resetting the connection.",
+    "settings.slack.managedByEnvironment": "Connection settings are read-only because they are managed by environment variables: {variables}. Remove them and restart cli-jaw to edit here.",
     "settings.slack.attachPort": "Attach instance port",
     "settings.channel.notAttachInstanceHint": "Another instance owns this Slack connection (check the attach instance port)",
     "settings.slack.guide.step2Desc": "App settings → OAuth & Permissions → confirm files:read → Reinstall to Workspace → copy Bot User OAuth Token",
@@ -893,9 +895,15 @@
     "onboarding.title.slack": "Connect Slack",
     "onboarding.guide.telegram": "Open @BotFather in Telegram, send /newbot, pick a name and username, and copy the bot token it returns. Paste it below and press Validate.",
     "onboarding.guide.discord": "At discord.com/developers/applications choose New Application, then Bot, then Reset Token. Enable MESSAGE CONTENT INTENT under Privileged Gateway Intents. Get the server ID by enabling Developer Mode in Discord, then right-click the server and copy its ID.",
-    "onboarding.guide.slack": "At api.slack.com/apps use Create an App, From an app manifest. Then get the bot token (xoxb-) from OAuth & Permissions, Install to Workspace, and the app-level token (xapp-, connections:write) from Basic Information, App-Level Tokens.",
-    "onboarding.slackExistingApp": "For an existing app, add files:read under OAuth & Permissions, then choose Reinstall to Workspace.",
-    "onboarding.warning.missingCapabilities": "Optional capability {capabilities} is missing, so inbound attachments are disabled. Add it and reinstall the app. Text messages still work.",
+    "onboarding.guide.slack": "At api.slack.com/apps, choose Create New App → From a manifest, paste the copied manifest into the JSON tab, select the workspace where you want to add the app, and create it.",
+    "onboarding.slackAppName": "App name",
+    "onboarding.slackAppNameHint": "Used for both the app and bot. Enter up to 35 lowercase letters, numbers, hyphens, underscores, or dots.",
+    "onboarding.slackGenerateManifest": "Generate manifest",
+    "onboarding.slackManifestGenerating": "Generating...",
+    "onboarding.slackManifestReady": "Copied",
+    "onboarding.slackManifestError": "Could not generate or copy the manifest. Try again.",
+    "onboarding.slackAppNameError": "Use 1–35 lowercase letters, numbers, hyphens, underscores, or dots.",
+    "onboarding.warning.missingCapabilities": "Optional scopes {capabilities} are missing, so the features they cover are turned off. Add them and reinstall the app. Text messages still work.",
     "onboarding.token.botToken": "Bot token",
     "onboarding.token.appToken": "App-level token",
     "onboarding.token.guildId": "Server ID",
@@ -920,6 +928,7 @@
     "onboarding.validateHint": "Press Validate to check the real connection. It must pass before saving.",
     "onboarding.saveHint": "Validation passed. Saving applies the settings and connects the channel right away.",
     "onboarding.error.validation_required": "Validation has to pass first.",
+    "onboarding.error.slack_setup_required": "Generate the manifest and open the issuing page before continuing.",
     "onboarding.openIssuer": "Open the issuing page",
     "onboarding.error.missing_scopes": "The token works, but the app is missing OAuth scopes. Add the ones below under OAuth & Permissions, then reinstall the app.",
     "onboarding.hint.telegram.botToken": "The value @BotFather returned after /newbot.",

package/public/locales/ja.json

@@ -534,7 +534,7 @@
     "help.slack.link.portal": "Open the Slack app dashboard",
     "help.slack.link.docs": "Socket Mode documentation",
     "help.slack.example.1": "@cli-jaw run the tests for this repo",
-    "help.slack.howTo.1": "下のガイドカードの「マニフェストをコピー」を押し、api.slack.com/apps → Create an App → From an app manifest に貼り付けてアプリを作成します。",
+    "help.slack.howTo.1": "下のガイドカードの「マニフェストをコピー」を押し、api.slack.com/apps → Create New App → From a manifest に貼り付けてアプリを作成します。",
     "help.slack.howTo.2": "Enable Socket Mode and generate an app-level token (xapp-) with connections:write.",
     "help.slack.howTo.3": "Install to the workspace to obtain the bot token (xoxb-).",
     "help.slack.howTo.4": "Paste each token into its own field below — do not swap them.",
@@ -843,10 +843,6 @@
     "bgtask.title": "バックグラウンド",
     "tg.elicitationExpired": "選択セッションの有効期限が切れました。テキストで返信してください。",
     "settings.slack.guide.step1Title": "Slack アプリを作成",
-    "settings.slack.guide.step1Desc": "Create an App → From an app manifest → ワークスペース選択 → 貼り付け。既存アプリには files:read を追加します。",
-    "settings.slack.guide.copyManifest": "マニフェストをコピー",
-    "settings.slack.guide.copyManifestDone": "コピーしました — files:read を含むマニフェストを Slack に貼り付けてください",
-    "settings.slack.guide.copyManifestFail": "コピー失敗 — jaw slack manifest を使用",
     "settings.slack.guide.openApps": "アプリページを開く",
     "settings.slack.guide.step2Title": "ボットトークンを貼り付け",
     "settings.slack.guide.step3Title": "受信用アプリトークン（任意）",
@@ -854,6 +850,12 @@
     "settings.slack.guide.botTokenError": "xoxb- で始まるボットトークンが必要です — アプリトークンと入れ替わっていませんか？",
     "settings.slack.guide.appTokenError": "xapp- で始まるアプリレベルトークンが必要です — ボットトークンと入れ替わっていませんか？",
     "settings.slack.advanced": "詳細設定",
+    "settings.slack.resetConnection": "接続をリセット",
+    "settings.slack.resetConfirm": "Slack アプリの接続がリセットされます。続行しますか？",
+    "settings.slack.resetEmpty": "接続されている Slack アプリはありません。",
+    "settings.slack.resetFailed": "Slack アプリの接続をリセットできませんでした。もう一度お試しください。",
+    "settings.slack.resetManagedByEnvironment": "この Slack 接続は環境変数（{variables}）で管理されています。環境変数を削除して cli-jaw を再起動してから、接続をリセットしてください。",
+    "settings.slack.managedByEnvironment": "接続設定は環境変数（{variables}）で管理されているため読み取り専用です。ここで編集するには環境変数を削除し、cli-jaw を再起動してください。",
     "settings.slack.attachPort": "接続インスタンスのポート",
     "settings.channel.notAttachInstanceHint": "別のインスタンスがこの Slack 接続を所有しています（接続インスタンスのポートを確認）",
     "settings.slack.guide.step2Desc": "アプリ設定 → OAuth & Permissions → files:read を確認 → Reinstall to Workspace → Bot User OAuth Token をコピー",
@@ -882,9 +884,15 @@
     "onboarding.title.slack": "Slack に接続",
     "onboarding.guide.telegram": "Open @BotFather in Telegram, send /newbot, pick a name and username, and copy the bot token it returns. Paste it below and press Validate.",
     "onboarding.guide.discord": "At discord.com/developers/applications choose New Application, then Bot, then Reset Token. Enable MESSAGE CONTENT INTENT under Privileged Gateway Intents. Get the server ID by enabling Developer Mode in Discord, then right-click the server and copy its ID.",
-    "onboarding.guide.slack": "At api.slack.com/apps use Create an App, From an app manifest. Then get the bot token (xoxb-) from OAuth & Permissions, Install to Workspace, and the app-level token (xapp-, connections:write) from Basic Information, App-Level Tokens.",
-    "onboarding.slackExistingApp": "既存アプリでは OAuth & Permissions に files:read を追加し、Reinstall to Workspace を実行してください。",
-    "onboarding.warning.missingCapabilities": "任意機能の権限 {capabilities} がないため、添付ファイル受信は無効です。権限を追加してアプリを再インストールしてください。テキストは引き続き利用できます。",
+    "onboarding.guide.slack": "api.slack.com/apps で Create New App → From a manifest を選び、JSON タブにコピーしたマニフェストを貼り付け、アプリを追加するワークスペースを選択して作成してください。",
+    "onboarding.slackAppName": "アプリ名",
+    "onboarding.slackAppNameHint": "アプリとボットの両方に使用します。英小文字、数字、-、_、. のみで35文字以内にしてください。",
+    "onboarding.slackGenerateManifest": "マニフェストを生成",
+    "onboarding.slackManifestGenerating": "生成中...",
+    "onboarding.slackManifestReady": "コピーしました",
+    "onboarding.slackManifestError": "マニフェストを生成またはコピーできませんでした。もう一度お試しください。",
+    "onboarding.slackAppNameError": "英小文字、数字、-、_、. のみで1〜35文字入力してください。",
+    "onboarding.warning.missingCapabilities": "任意の権限 {capabilities} がないため、その機能のみ無効です。権限を追加してアプリを再インストールしてください。テキストは引き続き利用できます。",
     "onboarding.token.botToken": "ボットトークン",
     "onboarding.token.appToken": "アプリレベルトークン",
     "onboarding.token.guildId": "サーバー ID",
@@ -909,6 +917,7 @@
     "onboarding.validateHint": "「検証」を押して実際の接続を確認してください。通過しないと保存に進めません。",
     "onboarding.saveHint": "検証に成功しました。保存すると設定に反映され、チャンネルがすぐ接続されます。",
     "onboarding.error.validation_required": "先に検証を通す必要があります。",
+    "onboarding.error.slack_setup_required": "マニフェストを生成し、発行ページを開いてから次へ進んでください。",
     "onboarding.openIssuer": "発行ページを開く",
     "onboarding.error.missing_scopes": "トークンは有効ですが、アプリの権限（スコープ）が不足しています。OAuth & Permissions で以下を追加し、アプリを再インストールしてください。",
     "onboarding.hint.telegram.botToken": "@BotFather が /newbot の後に返した値です。",

package/public/locales/ko.json

@@ -545,7 +545,7 @@
     "help.slack.link.portal": "Slack 앱 관리 페이지 열기",
     "help.slack.link.docs": "Socket Mode 문서",
     "help.slack.example.1": "@cli-jaw 이 저장소 테스트 돌려줘",
-    "help.slack.howTo.1": "아래 가이드 카드의 \"매니페스트 복사\"를 눌러 api.slack.com/apps → Create an App → From an app manifest에 붙여넣어 앱을 만듭니다.",
+    "help.slack.howTo.1": "아래 가이드 카드의 \"매니페스트 복사\"를 눌러 api.slack.com/apps → Create New App → From a manifest에 붙여넣어 앱을 만듭니다.",
     "help.slack.howTo.2": "Socket Mode를 켜고 connections:write 범위의 app-level 토큰(xapp-)을 발급합니다.",
     "help.slack.howTo.3": "워크스페이스에 설치해 봇 토큰(xoxb-)을 받습니다.",
     "help.slack.howTo.4": "두 토큰을 아래 입력란에 각각 붙여넣습니다 — 서로 바꿔 넣지 않도록 주의하세요.",
@@ -854,10 +854,6 @@
     "bgtask.title": "백그라운드",
     "tg.elicitationExpired": "선택 세션이 만료되었습니다. 텍스트로 답해주세요.",
     "settings.slack.guide.step1Title": "Slack 앱 만들기",
-    "settings.slack.guide.step1Desc": "Create an App → From an app manifest → 워크스페이스 선택 → 붙여넣기. 기존 앱은 files:read를 추가하세요.",
-    "settings.slack.guide.copyManifest": "매니페스트 복사",
-    "settings.slack.guide.copyManifestDone": "복사됨 — files:read 포함 매니페스트를 Slack에 붙여넣으세요",
-    "settings.slack.guide.copyManifestFail": "복사 실패 — jaw slack manifest 사용",
     "settings.slack.guide.openApps": "앱 페이지 열기",
     "settings.slack.guide.step2Title": "봇 토큰 붙여넣기",
     "settings.slack.guide.step3Title": "수신용 앱 토큰 (선택)",
@@ -865,6 +861,12 @@
     "settings.slack.guide.botTokenError": "xoxb-로 시작하는 봇 토큰이어야 합니다 — 앱 토큰과 바꿔 넣지 않았나요?",
     "settings.slack.guide.appTokenError": "xapp-로 시작하는 앱 레벨 토큰이어야 합니다 — 봇 토큰과 바꿔 넣지 않았나요?",
     "settings.slack.advanced": "고급 설정",
+    "settings.slack.resetConnection": "연결 초기화",
+    "settings.slack.resetConfirm": "Slack 앱 연결이 초기화됩니다. 계속하시겠습니까?",
+    "settings.slack.resetEmpty": "연결된 Slack 앱이 없습니다.",
+    "settings.slack.resetFailed": "Slack 앱 연결을 초기화하지 못했습니다. 다시 시도해주세요.",
+    "settings.slack.resetManagedByEnvironment": "이 Slack 연결은 환경변수({variables})로 관리되고 있습니다. 해당 환경변수를 제거하고 cli-jaw를 재시작한 후 연결을 초기화하세요.",
+    "settings.slack.managedByEnvironment": "연결 설정은 환경변수({variables})로 관리되어 읽기 전용입니다. 여기서 수정하려면 환경변수를 제거하고 cli-jaw를 재시작하세요.",
     "settings.slack.attachPort": "연결 인스턴스 포트",
     "settings.channel.notAttachInstanceHint": "다른 인스턴스가 이 Slack 연결을 소유하고 있습니다 (연결 인스턴스 포트 확인)",
     "settings.slack.guide.step2Desc": "앱 설정 → OAuth & Permissions → files:read 확인 → Reinstall to Workspace → Bot User OAuth Token 복사",
@@ -893,9 +895,15 @@
     "onboarding.title.slack": "Slack 연결",
     "onboarding.guide.telegram": "텔레그램에서 @BotFather 를 열고 /newbot 을 보낸 뒤, 이름과 username을 정하면 봇 토큰이 나옵니다. 그 토큰을 아래에 붙여넣고 검증을 누르세요.",
     "onboarding.guide.discord": "discord.com/developers/applications 에서 New Application → Bot → Reset Token 으로 토큰을 만들고, Privileged Gateway Intents 의 MESSAGE CONTENT INTENT 를 켜세요. 서버 ID는 Discord 설정에서 개발자 모드를 켠 뒤 서버 우클릭 → ID 복사로 얻습니다.",
-    "onboarding.guide.slack": "api.slack.com/apps 에서 Create an App → From an app manifest 로 앱을 만든 뒤, OAuth & Permissions → Install to Workspace 에서 봇 토큰(xoxb-), Basic Information → App-Level Tokens 에서 앱 토큰(xapp-, connections:write)을 발급받으세요.",
-    "onboarding.slackExistingApp": "기존 앱은 OAuth & Permissions에서 files:read를 추가한 뒤 Reinstall to Workspace를 실행하세요.",
-    "onboarding.warning.missingCapabilities": "선택 기능 권한({capabilities})이 없어 첨부파일 수신은 꺼져 있습니다. 권한을 추가하고 앱을 재설치하세요. 텍스트 메시지는 계속 사용할 수 있습니다.",
+    "onboarding.guide.slack": "api.slack.com/apps에서 Create New App → From a manifest의 JSON 탭에 복사된 매니페스트를 붙여넣고, 추가하려는 워크스페이스를 선택하여 앱을 생성해 주세요.",
+    "onboarding.slackAppName": "앱 이름",
+    "onboarding.slackAppNameHint": "앱과 봇에 함께 사용할 이름입니다. 영문 소문자, 숫자, -, _, .만 35자 이내로 입력하세요.",
+    "onboarding.slackGenerateManifest": "매니페스트 생성",
+    "onboarding.slackManifestGenerating": "생성 중...",
+    "onboarding.slackManifestReady": "복사되었습니다",
+    "onboarding.slackManifestError": "매니페스트를 생성하거나 복사하지 못했어요. 다시 시도해주세요.",
+    "onboarding.slackAppNameError": "영문 소문자, 숫자, -, _, .만 사용해 1~35자로 입력하세요.",
+    "onboarding.warning.missingCapabilities": "선택 권한({capabilities})이 없어 해당 기능만 꺼져 있습니다. 권한을 추가하고 앱을 재설치하세요. 텍스트 메시지는 계속 사용할 수 있습니다.",
     "onboarding.token.botToken": "봇 토큰",
     "onboarding.token.appToken": "앱 레벨 토큰",
     "onboarding.token.guildId": "서버 ID",
@@ -920,6 +928,7 @@
     "onboarding.validateHint": "검증을 눌러 실제 연결을 확인하세요. 통과해야 저장으로 넘어갑니다.",
     "onboarding.saveHint": "검증을 통과했습니다. 저장을 누르면 설정에 반영되고 채널이 바로 연결됩니다.",
     "onboarding.error.validation_required": "먼저 검증을 통과해야 합니다.",
+    "onboarding.error.slack_setup_required": "매니페스트를 생성하고 발급 페이지를 연 뒤 다음 단계로 진행하세요.",
     "onboarding.openIssuer": "발급 페이지 열기",
     "onboarding.error.missing_scopes": "토큰은 유효하지만 앱에 권한(스코프)이 부족합니다. OAuth & Permissions에서 아래 항목을 추가하고 앱을 재설치하세요.",
     "onboarding.hint.telegram.botToken": "@BotFather가 /newbot 후 알려준 값입니다.",

package/public/locales/zh.json

@@ -534,7 +534,7 @@
     "help.slack.link.portal": "Open the Slack app dashboard",
     "help.slack.link.docs": "Socket Mode documentation",
     "help.slack.example.1": "@cli-jaw run the tests for this repo",
-    "help.slack.howTo.1": "点击下方指南卡中的“复制清单”，然后在 api.slack.com/apps → Create an App → From an app manifest 粘贴以创建应用。",
+    "help.slack.howTo.1": "点击下方指南卡中的“复制清单”，然后在 api.slack.com/apps → Create New App → From a manifest 粘贴以创建应用。",
     "help.slack.howTo.2": "Enable Socket Mode and generate an app-level token (xapp-) with connections:write.",
     "help.slack.howTo.3": "Install to the workspace to obtain the bot token (xoxb-).",
     "help.slack.howTo.4": "Paste each token into its own field below — do not swap them.",
@@ -843,10 +843,6 @@
     "bgtask.title": "后台任务",
     "tg.elicitationExpired": "选择会话已过期，请用文字回复。",
     "settings.slack.guide.step1Title": "创建 Slack 应用",
-    "settings.slack.guide.step1Desc": "Create an App → From an app manifest → 选择工作区 → 粘贴。现有应用需添加 files:read。",
-    "settings.slack.guide.copyManifest": "复制清单",
-    "settings.slack.guide.copyManifestDone": "已复制 — 请将含 files:read 的 manifest 粘贴到 Slack",
-    "settings.slack.guide.copyManifestFail": "复制失败 — 请使用 jaw slack manifest",
     "settings.slack.guide.openApps": "打开应用页面",
     "settings.slack.guide.step2Title": "粘贴机器人令牌",
     "settings.slack.guide.step3Title": "接收用应用令牌（可选）",
@@ -854,6 +850,12 @@
     "settings.slack.guide.botTokenError": "需要以 xoxb- 开头的机器人令牌 — 是否与应用令牌填反了？",
     "settings.slack.guide.appTokenError": "需要以 xapp- 开头的应用级令牌 — 是否与机器人令牌填反了？",
     "settings.slack.advanced": "高级设置",
+    "settings.slack.resetConnection": "重置连接",
+    "settings.slack.resetConfirm": "Slack 应用连接将被重置。是否继续？",
+    "settings.slack.resetEmpty": "当前没有已连接的 Slack 应用。",
+    "settings.slack.resetFailed": "无法重置 Slack 应用连接，请重试。",
+    "settings.slack.resetManagedByEnvironment": "此 Slack 连接由环境变量（{variables}）管理。请删除这些环境变量并重启 cli-jaw，然后再重置连接。",
+    "settings.slack.managedByEnvironment": "连接设置由环境变量（{variables}）管理，因此为只读。若要在此编辑，请删除这些变量并重启 cli-jaw。",
     "settings.slack.attachPort": "连接实例端口",
     "settings.channel.notAttachInstanceHint": "另一个实例拥有此 Slack 连接（请检查连接实例端口）",
     "settings.slack.guide.step2Desc": "应用设置 → OAuth & Permissions → 确认 files:read → Reinstall to Workspace → 复制 Bot User OAuth Token",
@@ -882,9 +884,15 @@
     "onboarding.title.slack": "连接 Slack",
     "onboarding.guide.telegram": "Open @BotFather in Telegram, send /newbot, pick a name and username, and copy the bot token it returns. Paste it below and press Validate.",
     "onboarding.guide.discord": "At discord.com/developers/applications choose New Application, then Bot, then Reset Token. Enable MESSAGE CONTENT INTENT under Privileged Gateway Intents. Get the server ID by enabling Developer Mode in Discord, then right-click the server and copy its ID.",
-    "onboarding.guide.slack": "At api.slack.com/apps use Create an App, From an app manifest. Then get the bot token (xoxb-) from OAuth & Permissions, Install to Workspace, and the app-level token (xapp-, connections:write) from Basic Information, App-Level Tokens.",
-    "onboarding.slackExistingApp": "对于现有应用，请在 OAuth & Permissions 中添加 files:read，然后选择 Reinstall to Workspace。",
-    "onboarding.warning.missingCapabilities": "缺少可选权限 {capabilities}，因此无法接收附件。请添加权限并重新安装应用。文本消息仍可使用。",
+    "onboarding.guide.slack": "在 api.slack.com/apps 中选择 Create New App → From a manifest，将复制的清单粘贴到 JSON 标签页，选择要添加应用的工作区，然后创建应用。",
+    "onboarding.slackAppName": "应用名称",
+    "onboarding.slackAppNameHint": "该名称同时用于应用和机器人。请使用小写英文字母、数字、-、_、.，最多35个字符。",
+    "onboarding.slackGenerateManifest": "生成清单",
+    "onboarding.slackManifestGenerating": "正在生成...",
+    "onboarding.slackManifestReady": "已复制",
+    "onboarding.slackManifestError": "无法生成或复制清单，请重试。",
+    "onboarding.slackAppNameError": "请使用小写英文字母、数字、-、_、.，输入1到35个字符。",
+    "onboarding.warning.missingCapabilities": "缺少可选权限 {capabilities}，相应功能已关闭。请添加权限并重新安装应用。文本消息仍可使用。",
     "onboarding.token.botToken": "机器人令牌",
     "onboarding.token.appToken": "应用级令牌",
     "onboarding.token.guildId": "服务器 ID",
@@ -909,6 +917,7 @@
     "onboarding.validateHint": "点击验证以检查实际连接。通过后才能保存。",
     "onboarding.saveHint": "验证通过。保存后将写入设置并立即连接该渠道。",
     "onboarding.error.validation_required": "需要先通过验证。",
+    "onboarding.error.slack_setup_required": "请先生成清单并打开发放页面，然后再继续。",
     "onboarding.openIssuer": "打开签发页面",
     "onboarding.error.missing_scopes": "令牌有效，但应用缺少 OAuth 权限（scope）。请在 OAuth & Permissions 中添加下列项并重新安装应用。",
     "onboarding.hint.telegram.botToken": "@BotFather 在 /newbot 之后返回的值。",

package/public/manager/src/settings/pages/AdvancedExport.tsx

@@ -42,6 +42,7 @@ export function stripServerOwnedSettingsFields(settings: Record<string, unknown>
         settingsSchemaVersion: _schema,
         runtimeDefaultMigration: _migration,
         multiSessionDefaultMigration: _sessionMigration,
+        slackEnvironmentVariables: _slackEnvironmentVariables,
         ...userOwned
     } = settings;
     return userOwned;

package/public/manager/src/settings/pages/Agent.tsx

@@ -57,7 +57,8 @@ type AgentSnapshot = AgentSettingsSnapshot & {
 type CliStatusInfo = {
     available: boolean | null;
     capabilityReady: boolean | null;
-    probeState: 'checking' | 'fresh' | 'stale';
+    probeState: 'checking' | 'fresh' | 'stale' | 'failing';
+    probeError?: string;
 };
 
 export function conflictSettingsFromError(error: unknown): AgentSnapshot | null {
@@ -333,6 +334,14 @@ export default function Agent({ port, client, dirty, registerSave }: SettingsPag
             {cliStatus[draft.cli]?.probeState === 'checking' ? (
                 <div className="settings-inline-notice" role="status" aria-live="polite">상태 확인 중</div>
             ) : null}
+            {cliStatus[draft.cli]?.probeState === 'failing' ? (
+                // Without this the panel stays silent while every probe errors,
+                // which is the state #277 reported as an endless "stale".
+                <div className="settings-inline-notice" role="alert">
+                    상태 확인 실패 (재시도 중)
+                    {cliStatus[draft.cli]?.probeError ? `: ${cliStatus[draft.cli]!.probeError}` : ''}
+                </div>
+            ) : null}
             <RuntimeHeader
                 cli={draft.cli}
                 cliOptions={cliOptions.length > 0 ? cliOptions : [draft.cli || 'claude']}

package/public/manager/src/settings/pages/ChannelsSlack.tsx

@@ -42,6 +42,7 @@ type SlackBlock = {
 type SlackSnapshot = {
     channel?: ActiveChannel;
     slack?: SlackBlock;
+    slackEnvironmentVariables?: string[];
     [key: string]: unknown;
 };
 
@@ -117,6 +118,10 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
     }, [state]);
 
     const originalChannel = state.kind === 'ready' ? state.data.channel : undefined;
+    const environmentVariables = state.kind === 'ready' && Array.isArray(state.data.slackEnvironmentVariables)
+        ? state.data.slackEnvironmentVariables
+        : [];
+    const environmentManaged = environmentVariables.length > 0;
 
     const onSave = useCallback(async () => {
         const bundle = dirty.saveBundle();
@@ -157,7 +162,9 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
     // Surface the outbound-only state on THIS page rather than changing the
     // shared status chips, which are frozen for cross-channel changes.
     const outboundOnly = Boolean(original.enabled) && Boolean(original.botToken) && !original.appToken;
-    const slackHint = outboundOnly
+    const slackHint = environmentManaged
+        ? `Connection settings are read-only because they are managed by environment variables: ${environmentVariables.join(', ')}.`
+        : outboundOnly
         ? 'Currently OUTBOUND-ONLY: the app-level token (xapp-) is missing, so no inbound Slack events can arrive.'
         : 'Slack needs TWO tokens: a bot token (xoxb-) for the Web API and an app-level token (xapp-) for Socket Mode.';
 
@@ -189,6 +196,7 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
                     id="sl-enabled"
                     label="Slack enabled"
                     value={enabled}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setEnabled(next);
                         setEntry('slack.enabled', {
@@ -204,6 +212,7 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
                     value={botToken}
                     placeholder={maskOf(original.botToken)}
                     error={botTokenError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setBotToken(next);
                         if (next.length === 0) {
@@ -223,6 +232,7 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
                     value={appToken}
                     placeholder={maskOf(original.appToken)}
                     error={appTokenError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setAppToken(next);
                         if (next.length === 0) {
@@ -241,6 +251,7 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
                     label="Team ID"
                     value={teamId}
                     placeholder="T01234567 (optional)"
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setTeamId(next);
                         setEntry('slack.teamId', {
@@ -256,6 +267,7 @@ export default function ChannelsSlack({ port, client, dirty, registerSave }: Set
                     value={channelIds}
                     placeholder="C01234567"
                     error={channelIdsError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setChannelIds(next);
                         setEntry('slack.channelIds', {

package/scripts/atomic-build.sh

@@ -18,10 +18,17 @@ cp -R src/prompt/templates/. "$STAGING/src/prompt/templates/"
 cp -R prompts/. "$STAGING/prompts/"
 cp -R src/browser/adaptive-fetch/vendor/. "$STAGING/src/browser/adaptive-fetch/vendor/"
 
-# jawcode TUI bundle + Bun shim + native addon (macOS only)
+# bun-shim.mjs is a COMMITTED source asset, unlike the jawcode bundles below
+# which are generated and gitignored. jawcode-render.ts imports the shim
+# unconditionally, so gating its copy on a generated artifact made every clean
+# build (CI, release, any fresh checkout) publish a dist that cannot load its
+# own renderer — `jaw chat --raw` then died with ERR_MODULE_NOT_FOUND (#275).
+mkdir -p "$STAGING/src/lib/tui"
+cp src/lib/tui/bun-shim.mjs "$STAGING/src/lib/tui/"
+
+# jawcode TUI bundle + native addon (macOS only)
 if [ -f src/lib/tui/jawcode-tui-bundle.mjs ]; then
-    mkdir -p "$STAGING/src/lib/tui" "$STAGING/src/lib/native"
-    cp src/lib/tui/bun-shim.mjs "$STAGING/src/lib/tui/"
+    mkdir -p "$STAGING/src/lib/native"
     cp src/lib/tui/jawcode-tui-bundle.mjs "$STAGING/src/lib/tui/"
     [ -f src/lib/tui/jawcode-interactive-bundle.mjs ] && cp src/lib/tui/jawcode-interactive-bundle.mjs "$STAGING/src/lib/tui/"
     NATIVE_TAG="$(node -p '`${process.platform}-${process.arch}`')"