Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 12:00 PM ET / 16:00 UTC.

Summary
The PR updates Slack read-like action authorization to resolve Slack channel IDs through Slack before applying existing name allowlists, and its branch also contains duplicate extended-stable release commits whose non-Slack file contents already match current main.

PR surface: Source +49, Tests +973, Docs +108, Config +93, Other +499. Total +1722 across 20 files.

Reproducibility: yes. Current main source denies a Slack channel-ID read when the allowlist is keyed only by channel name, and the contributor supplied redacted live Slack proof showing the failure and the after-fix allowed/denied outcomes.

Review metrics: 2 noteworthy metrics.

• Protected Slack reads: 4 read-like action paths gated. readMessages, reactions, downloadFile, and listPins now share the same pre-read authorization fallback.
• Current-main duplicate content: 14 non-Slack files match current main blobs. The workflow/docs/script files inflate PR stats but do not add a net content delta against current main.

Stored data model
Persistent data-model change detected: migration/backfill/repair: docs/ci.md, serialized state: scripts/openclaw-npm-publish.sh, serialized state: test/scripts/openclaw-npm-publish.test.ts, vector/embedding metadata: test/scripts/openclaw-npm-publish.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] This PR intentionally changes a Slack authorization boundary: opted-in name matching can now authorize a channel-ID read after a same-token conversations.info lookup, so maintainers should explicitly accept that trust model before landing.

Maintainer options:

1. Land with boundary acceptance (recommended)
   Maintainers can land the current PR if they accept Slack conversations.info as the same-token name source for the existing dangerouslyAllowNameMatching path.
2. Require narrower boundary proof
   If maintainers want a lower-risk merge, ask for additional live or mocked proof across every read-like action before landing.

Next step before merge

• No automated repair is needed; the remaining action is a maintainer land or hold decision for a Slack read-authorization security boundary change.

Security
Cleared: No concrete security or supply-chain defect was found; the remaining concern is maintainer acceptance of the intended Slack authorization-boundary change.

Not sure if this is acceptable proof, but in the past month, I had multiple OpenClaws on different machines collaborate with one another via a shared whitelisted Slack channel.

Recently (as in the past ~3-5 days), after I upgraded to 2026.6.8, the ability for me to have bot-to-bot conversations went away.

My use case was Bot A does dev work on a repo; Bot B does deployment of a said PR to servers C it has access to. A does not have access to C, but can do so indirectly through B.

Example of it working from the past month:

Example of it NOT working:

Example of it working again after this patch:
I'm having a bit of difficulty patching the source, reinstalling OpenClaw from source, and then generating this proof... As it's 6am now and I haven't slept, I'll have to try to resume this later.

@clawsweeper re-review.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Redacted local runtime behavior proof

I installed and ran this branch from source on a local OpenClaw gateway, then exercised the Slack message.read path against a live Slack account. The real workspace/channel/user identifiers are intentionally replaced below with fabricated fixtures.

Build under test:

OpenClaw 2026.6.8 (ee83402)
branch: fix/slack-read-allowlist-channel-name-public

Relevant redacted config shape:

{
  channels: {
    slack: {
      groupPolicy: "allowlist",
      dangerouslyAllowNameMatching: true,
      channels: {
        "#allowed-channel": { enabled: true }
      }
    }
  }
}

Allowed-channel read by Slack channel ID:

action: message.read
target: channel:C0123456789
threadId: 1234567890.123456

result: ok=true
result.messages.length: 1
result.hasMore: true

This verifies the patched runtime can accept a Slack read where the action target is a Slack channel ID, while the allowlist entry is a channel name resolved at runtime.

Denied-channel read by Slack channel ID:

action: message.read
target: channel:C9876543210

result.status: error
result.error: Slack read target channel is not allowed.

This verifies non-matching channel-ID reads still fail closed.

Additional regression coverage on the same head:

pnpm vitest run extensions/slack/src/action-runtime.test.ts extensions/slack/src/channel-type.test.ts
# 2 files / 74 tests passed

pnpm test:extension slack
# 101 files / 1334 tests passed

pnpm tsgo:extensions
# passed

Follow-up on the three failing checks from run 27871463802:

• build-artifacts: failed in core-support-boundary due extension-test-boundary.test.ts catching extensions/feishu/src/media.test.ts on a repo helper bridge.
• check-additional-boundaries-bcd: same lint:plugins:no-extension-test-core-imports boundary failure.
• checks-node-core-tooling: stale tooling process-cleanup failure (process still alive).

I rebased this PR onto current main, which already contains the boundary and child-process cleanup fixes, and force-pushed with lease:

• previous head: ee834023a27bd88d5ce71b5c3c271c90b2038804
• new head: 7e1596f9f303396d768aaa492a6c040fef5ebfe5

Local verification on the rebased head:

• pnpm run lint:plugins:no-extension-test-core-imports
• node scripts/run-vitest.mjs run --config test/vitest/vitest.tooling.config.ts src/scripts/test-projects.test.ts test/scripts/openclaw-cross-os-release-checks.test.ts --reporter=verbose
• node scripts/test-projects.mjs extensions/slack/src/action-runtime.test.ts extensions/slack/src/channel-type.test.ts

The PR check rollup is now clean on the new head.

Addressed the current status: waiting on author blocker from ClawSweeper.

Change in e3cd608f8a0:

• Removed the currentChannelName threading shortcut from the Slack action context and generic threading tool context.
• ChannelThreadingContext.Channel is no longer copied into Slack read authorization; read-like actions now use the trusted conversations.info lookup for channel-ID → room-name resolution when name matching is enabled.
• Added regression coverage for the core-shaped context path where Channel: "slack" must not authorize a #slack allowlist entry.

Verification:

• node scripts/run-vitest.mjs extensions/slack/src/action-runtime.test.ts extensions/slack/src/threading-tool-context.test.ts extensions/slack/src/channel-type.test.ts extensions/slack/src/message-action-dispatch.test.ts
• pnpm test:extension slack
• pnpm tsgo:extensions
• git diff --check

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Maintainer pass complete on final head 9dbff450b45bd4eae81a859e543df2597854e81a.

What changed during review:

• Replaced the shared cached channel-type lookup with a lazy Slack actions-runtime lookup.
• Used the same bot/user credential for conversations.info and the protected read.
• Preserved explicit channel-ID deny precedence and ignored generic Channel: "slack" context as authorization data.
• Added fail-closed coverage for lookup errors, different targets, wildcard fallback, transient failures, and user-token reads.

Proof:

• node scripts/run-vitest.mjs extensions/slack/src/action-runtime.test.ts extensions/slack/src/actions.read.test.ts extensions/slack/src/threading-tool-context.test.ts extensions/slack/src/channel-type.test.ts extensions/slack/src/message-action-dispatch.test.ts --run — 135 tests passed.
• Fresh autoreview after fixes — clean, no accepted/actionable findings (patch is correct, confidence 0.96).
• Testbox tbx_01kwpvwqzx81eqn3ck8kny9yqj, Actions 28710832081, exit 0 — focused tests, full build, extension/test types, lint, guards, and cycle checks.
• Exact-head hosted CI 28711001736 — green.
• Contributor live Slack proof remains valid for the conversations.info name-authorization behavior; the final credential/cache refinements have exact mocked-network and Testbox coverage but were not repeated against a live workspace.

Review artifacts validate READY with zero findings. Ready to land.

Merged via squash.

• Prepared head SHA: d195f15fdeab09654610008433aaea94058b09b9
• Landed commit: 6169e5ddaeb4d1d82f107c1f14f7121ba9a5c943