feat(slack): support Enterprise Grid org installs by kevinlin-openai · Pull Request #102372 · openclaw/openclaw

kevinlin-openai · 2026-07-09T02:55:08Z

What Problem This Solves

Slack Enterprise Grid org installations can deliver events for multiple granted workspaces through one bot token. OpenClaw previously compared every event with one startup workspace and used detached clients later, so valid events from other granted workspaces could be rejected or replied to without a durable workspace boundary.

Why This Change Was Made

This adds an explicit enterpriseOrgInstall Slack account mode. Startup validates the org installation with auth.test; each direct message or app_mention uses Bolt's validated enterprise, app, workspace, and listener-owned WebClient; sessions, routes, transcripts, dedupe keys, and Slack caches are workspace-qualified.

Immediate replies reuse the canonical sendMessageSlack delivery engine. The listener path must provide the validated event scope and the exact injected Bolt client; a naked client cannot bypass Enterprise admission. The client and teamId are snapshotted before the in-memory send queue, queue/thread bookkeeping is workspace-qualified, and the listener client is never serialized or persisted.

Enterprise V1 deliberately fails closed for relay delivery, proactive/deferred/queued delivery, runtime bindings, Slack action tools, and Slack-native approvals. Existing workspace installations keep their current startup, client, action, binding, and delivery behavior.

User Impact

Enterprise Grid operators can run one org-installed Slack app across every workspace Slack has granted to that installation, while keeping message authorization and runtime state isolated per workspace. Operators enable the mode explicitly and follow the documented Socket Mode or HTTP org-install workflow.

Evidence

Added startup identity tests for config/token mismatches, canonical Slack IDs, unsupported policy surfaces, and workspace-mode compatibility.
Added two-workspace event-scope tests, wrong-app/wrong-enterprise/missing-team rejection, bot-event rejection, and MPDM policy normalization.
Added listener-client identity and no-network Slack SDK proof that Bolt's team-scoped WebClient automatically injects team_id.
Consolidated Enterprise reply coverage onto sendMessageSlack: exact-client admission, client/scope mismatch rejection, strict target admission, cross-team queue independence, same-team serialization, mutation-resistant capability snapshots, team-qualified thread participation, chunks/receipts, missing-timestamp rejection, and media caption/upload behavior.
Existing canonical sender suites continue to cover DNS retry, unfurl policy, identity fallback, metadata, blocks, media, chunking, reconciliation, and receipts.
Added fail-closed tests for direct sends, actions, native approvals, runtime bindings, live queue admission, queue recovery, and conditional queue transitions.
Current simplification head ab49773e556 passes 196 focused Slack tests, Slack package runtime build, repository QA runtime build, focused formatting/lint, docs MDX validation, and an independent security/isolation review with no remaining findings.
Root extension tsgo remains blocked only by unchanged extensions/qa-lab Crabline diagnostics outside this PR's changed paths; the Slack package runtime build succeeds.
The simplification removes the parallel immediate Enterprise sender and its implementation-specific suite: 9 files changed, 518 insertions, 695 deletions (net -177 lines, net -2 files).

Live Enterprise Grid org-install proof (redacted, 2026-07-08 PDT, exact simplification head ab49773e556):

gateway:   slack Enterprise Grid org-install mode enabled
gateway:   slack socket mode connected
inbound:   app_mention slack:<workspace-redacted>:channel:<redacted>:user:<redacted>
           -> bot:<redacted> (channel, 145 chars)
request:   Reply in this thread with exactly:
           ENTERPRISE_GRID_OK 20260708-233935-PDT
reply:     ENTERPRISE_GRID_OK 20260708-233935-PDT

The request was sent by a human Slack user in a granted Enterprise Grid workspace. The local gateway received it through Socket Mode, preserved the event workspace context, and democlaw posted the exact response in the originating thread. No token, private endpoint, IP address, or internal Slack identifier is included above. This live proof exercised the canonical listener-scoped sendMessageSlack path on the exact current head.

Manual verification:

Validate two workspaces under one enterprise produce distinct scoped clients and session/cache identities.
Validate wrong enterprise, wrong app, missing workspace, mutable-name policy, and unsupported delivery surfaces fail closed.
Validate workspace-install behavior remains covered by regression tests.
Parse and validate least-privilege Enterprise Grid Socket Mode and HTTP manifests.
Run a live Enterprise Grid org-install message/reply smoke test in an operator-owned workspace.

clawsweeper · 2026-07-09T03:00:52Z

Codex review: needs changes before merge. Reviewed July 9, 2026, 2:28 AM ET / 06:28 UTC.

Summary
Adds opt-in Slack enterpriseOrgInstall support with event-scoped Enterprise Grid admission, listener-client immediate replies, fail-closed detached Slack surfaces, plugin SDK hooks, docs, and tests.

PR surface: Source +1149, Tests +1643, Docs +279, Generated 0. Total +3071 across 72 files.

Reproducibility: not applicable. as a feature PR. Source inspection shows current main's single-workspace Slack guard, and the PR body includes redacted live org-install output for the new flow.

Review metrics: 2 noteworthy metrics.

Config/API Surfaces: 1 Slack config option added; 2 plugin SDK hooks added. These are compatibility-sensitive public/operator contracts that need maintainer acceptance before merge.
Exact-Head Lint Blockers: 4 errors in 2 changed Slack files. Required CI is failing on patch-local lint errors that must be fixed before merge.

Stored data model
Persistent data-model change detected: persistent cache schema: extensions/slack/src/monitor/thread.ts, persistent cache schema: extensions/slack/src/send.enterprise.test.ts, serialized state: extensions/slack/src/monitor/thread.ts, serialized state: src/infra/delivery-queue-sqlite.ts, unknown-data-model-change: src/config/bundled-channel-config-metadata.generated.ts, vector/embedding metadata: extensions/slack/src/post-message-payload.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #102371
Summary: This PR is the candidate implementation for the linked Slack Enterprise Grid feature issue.

Members:

canonical: [Feature]: Support Slack Enterprise Grid org installs #102371 - The PR body closes the issue, and the issue describes the same Enterprise Grid org-install support and constraints.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Fix the four oxlint errors in extensions/slack/src/send.ts and extensions/slack/src/send.enterprise.test.ts.
[P2] Rerun exact-head CI after the lint fix.
Get maintainer acceptance of the new Slack config mode and plugin SDK hooks.

Risk before merge

[P1] Exact-head CI currently fails patch-local lint in two changed Slack files, so the PR is not merge-ready.
[P1] The PR adds one Slack config mode and two plugin SDK hooks, creating a long-term compatibility contract for users and plugin authors.
[P1] Enterprise V1 intentionally fails closed for relay, deferred/proactive/queued delivery, action tools, runtime bindings, and Slack-native approvals on enterprise accounts, so operators enabling it lose those Slack surfaces until durable workspace scope exists.

Maintainer options:

Fix Lint, Then Accept V1 Contract (recommended)
Maintainers can accept the compatibility risk after exact-head lint is green and the new opt-in config plus SDK hooks are treated as the V1 contract.
Narrow Hooks Before Merge
Revise the patch so Enterprise gating stays Slack-local or uses a smaller SDK seam before third-party plugins can depend on it.
Pause For Broader Design
Pause or close the PR if the fail-closed V1 scope is not worth adding before durable cross-workspace delivery is designed.

Next step before merge

[P2] A narrow automated repair can fix the exact lint blockers, but merge still needs maintainer acceptance of the config/API scope.

Maintainer decision needed

Question: Should OpenClaw accept this opt-in Slack Enterprise Grid org-install mode and the two supporting plugin SDK hooks now, with unsupported detached Slack surfaces failing closed?
Rationale: The PR changes Slack authorization/delivery semantics, adds operator config, and expands plugin-facing API, so automation cannot own the product and compatibility decision.
Likely owner: vincentkoc — The current-main Slack startup/admission and outbound surfaces most affected by the product/API choice point to this owner signal in local history.
Options:
- Accept Enterprise V1 As Scoped (recommended): After the lint blockers are fixed and exact-head CI is green, land the documented opt-in mode with listener-scoped immediate replies and fail-closed detached paths.
- Narrow The Public Hooks First: Keep the Slack behavior but revise or internalize the generic SDK hooks if maintainers do not want those third-party plugin contracts yet.
- Defer Org-Install Support: Pause or close the PR if maintainers want Enterprise Grid support to wait for a broader durable cross-workspace outbound design.

Security
Cleared: No concrete security or supply-chain regression was found; the diff adds no dependencies or workflows and tightens Slack workspace authorization, while the auth boundary still needs maintainer acceptance.

Review findings

[P2] Fix the lint-blocking Enterprise scope guard — extensions/slack/src/send.ts:349
[P2] Fix the delayed send mock implementations — extensions/slack/src/send.enterprise.test.ts:185-216

Review details

Best possible solution:

Fix the lint blockers, then merge only if maintainers accept the documented opt-in Enterprise V1 scope and public hook contract.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a feature PR. Source inspection shows current main's single-workspace Slack guard, and the PR body includes redacted live org-install output for the new flow.

Is this the best way to solve the issue?

Mostly yes after the lint fix and maintainer approval. Using Bolt's listener-scoped WebClient while failing closed for detached paths is the clean V1 boundary for the stated Enterprise Grid problem.

Full review comments:

[P2] Fix the lint-blocking Enterprise scope guard — extensions/slack/src/send.ts:349
Exact-head CI fails oxlint on this changed condition because it compares a boolean to true. This PR cannot merge while check-lint and the bundled extension lint shard fail here; use a negated boolean guard or another lint-clean check.
Confidence: 0.96
[P2] Fix the delayed send mock implementations — extensions/slack/src/send.enterprise.test.ts:185-216
Exact-head CI still flags these mock callbacks as returning Promises where a void callback is expected at lines 185, 191, and 216. Rewrite the delayed mocks with lint-clean promise gates so the required lint jobs pass.
Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6620aba25ad9.

Label changes

Label justifications:

P2: This is a bounded but important Slack Enterprise Grid enhancement, not a broad runtime outage or emergency.
merge-risk: 🚨 compatibility: The PR adds a new Slack config mode and public plugin SDK hooks whose long-term contract must be accepted before users or plugins depend on them.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body includes redacted live Enterprise Grid org-install output showing auth, inbound app_mention, and exact reply, plus current-head focused regression proof for the sender simplification.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes redacted live Enterprise Grid org-install output showing auth, inbound app_mention, and exact reply, plus current-head focused regression proof for the sender simplification.

Evidence reviewed

PR surface:

Source +1149, Tests +1643, Docs +279, Generated 0. Total +3071 across 72 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	43	1709	560	+1149
Tests	22	1649	6	+1643
Docs	5	280	1	+279
Config	0	0	0	0
Generated	2	10	10	0
Other	0	0	0	0
Total	72	3648	577	+3071

Acceptance criteria:

[P1] gh pr checks 102372 --repo openclaw/openclaw --watch=false.
[P1] pnpm lint --threads=8.
[P1] pnpm test extensions/slack/src/send.enterprise.test.ts.

What I checked:

Repository policy applied: Root and scoped AGENTS.md files were read; Slack config additions, plugin SDK hooks, provider routing, and fail-closed delivery paths are compatibility-sensitive review surfaces. (AGENTS.md:31, 6620aba25ad9)
Current main keeps single-workspace Slack admission: Current main still drops Slack events whose incoming team differs from the startup team id, so main does not already solve the Enterprise Grid request. (extensions/slack/src/monitor/context.ts:574, 6620aba25ad9)
PR validates listener Enterprise scope: The PR validates api_app_id, Enterprise id, team id, Enterprise-install flag, and the exact listener-owned WebClient before accepting Enterprise events. (extensions/slack/src/monitor/event-scope.ts:32, 030bece2c0b1)
Config and SDK contract surface added: The PR adds one Slack account config option and two plugin-facing hooks, making the change a compatibility-sensitive feature rather than a strict bug fix. (src/config/types.slack.ts:164, 030bece2c0b1)
Detached delivery fails closed: Slack's durable final adapter rejects deferred delivery for Enterprise org-install accounts, and core checks that admission before live queue/send work. (extensions/slack/src/channel.ts:597, 030bece2c0b1)
Exact-head lint blockers remain: check-lint and check-additional-extension-bundled fail with one boolean-literal comparison error in send.ts and three no-misused-promises errors in send.enterprise.test.ts. (extensions/slack/src/send.ts:349, 030bece2c0b1)

Likely related people:

vincentkoc: Current-main blame for the Slack team-mismatch guard, Slack startup token path, and outbound substrate points to Vincent Koc in the available grafted history. (role: recent area contributor; confidence: medium; commits: e8c1780999a3; files: extensions/slack/src/monitor/context.ts, extensions/slack/src/monitor/provider.ts, src/infra/outbound/deliver.ts)
kevinlin-openai: Authored this Enterprise Grid branch and has prior merged Slack plugin work touching Slack actions and send.ts. (role: adjacent Slack contributor and candidate implementation owner; confidence: medium; commits: 030bece2c0b1, 432d5f863cfd; files: extensions/slack/src/send.ts, extensions/slack/src/action-runtime.ts, extensions/slack/src/monitor/event-scope.ts)
Peter Steinberger: Shortlog and recent history show substantial work on the same Slack send, monitor, and outbound paths. (role: heavy adjacent contributor; confidence: medium; commits: 6b525023d4, df525b90f2, c88a3d5152; files: extensions/slack/src/send.ts, extensions/slack/src/monitor/provider.ts, src/channels/message/types.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

reviewed 2026-07-09T03:22:24.463Z sha c188ba2 :: needs real behavior proof before merge. :: [P2] Document or internalize the new plugin hooks
reviewed 2026-07-09T05:59:58.259Z sha 392c410 :: needs maintainer review before merge. :: none
reviewed 2026-07-09T06:21:06.142Z sha 030bece :: found issues before merge. :: [P2] Fix the lint-blocking Enterprise scope guard | [P2] Fix the delayed send mock implementations

kevinlin-openai · 2026-07-09T05:45:27Z

@clawsweeper re-review

Live Enterprise Grid proof is now included in the PR body, and the public plugin hooks are documented and covered by focused SDK contract tests on head 2194d77d1d7.

clawsweeper · 2026-07-09T05:45:30Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

kevinlin-openai · 2026-07-09T05:48:55Z

@clawsweeper re-review

Rebased onto current main. Live Enterprise Grid proof remains in the PR body, and the public plugin hook docs plus SDK contract tests are on head 392c410686f.

clawsweeper · 2026-07-09T05:48:57Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

* feat(slack): support Enterprise Grid org installs * docs: refresh generated docs map * fix(slack): satisfy enterprise routing CI * fix(slack): accept org auth without app id * docs(plugin-sdk): document channel policy hooks * fix(slack): reuse canonical sender for enterprise replies * test(slack): fix enterprise sender lint --------- Co-authored-by: Kevin Lin <[email protected]>

…xtends openclaw#95390) Slack channel and thread sessions rebuilt wake prompt context only from the in-memory channel-history window, which never contains the bot's own replies and is empty after a gateway restart. Merge a bounded window (limit 10) of the session's canonical transcript into the inbound history, deduped against the channel window by timestamp+text, mirroring the Telegram direct-chat fix from openclaw#95390 (openclaw#95378). Enterprise Grid org installs (openclaw#102372) qualify the room session key and the channel-history key with the event workspace; the transcript read consumes the handler's own routing-provided sessionKey/storePath, so it follows that scoping automatically. A Grid-shaped room-wake test covers the org-install path. Co-Authored-By: Claude Fable 5 <[email protected]>

openclaw-barnacle Bot added docs Improvements or additions to documentation channel: slack Channel integration: slack gateway Gateway runtime size: XL maintainer Maintainer-authored PR labels Jul 9, 2026

clawsweeper Bot mentioned this pull request Jul 9, 2026

[Feature]: Support Slack Enterprise Grid org installs #102371

Closed

kevinslin added 5 commits July 8, 2026 22:46

feat(slack): support Enterprise Grid org installs

15178ad

docs: refresh generated docs map

b6a4569

fix(slack): satisfy enterprise routing CI

b0ab6ad

fix(slack): accept org auth without app id

66a0fff

docs(plugin-sdk): document channel policy hooks

392c410

kevinslin force-pushed the dev/kevinlin/slack-enterprise-org-routing branch from 2194d77 to 392c410 Compare July 9, 2026 05:48

fix(slack): reuse canonical sender for enterprise replies

030bece

test(slack): fix enterprise sender lint

ab49773

kevinlin-openai merged commit 245b91b into openclaw:main Jul 9, 2026
106 checks passed

kevinslin deleted the dev/kevinlin/slack-enterprise-org-routing branch July 9, 2026 06:54

joetam mentioned this pull request Jul 9, 2026

fix(slack): include canonical session transcript in prompt context (extends #95390) #102594

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(slack): support Enterprise Grid org installs#102372

feat(slack): support Enterprise Grid org installs#102372
kevinlin-openai merged 7 commits into
openclaw:mainfrom
kevinslin:dev/kevinlin/slack-enterprise-org-routing

kevinlin-openai commented Jul 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

kevinlin-openai commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

kevinlin-openai commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

kevinlin-openai commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinlin-openai commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinlin-openai commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kevinlin-openai commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading