[boxliteai]

Warning

This changes the bot's own trust boundary — src/controller.mjs, src/deploy.mjs, src/session.mjs, src/slack-channel.mjs, src/slack-events.mjs, src/slack-reply.mjs, src/slack.mjs, src/state.mjs, src/tools.mjs. Review it closely: once merged, an admin's /deploy puts it live.

Slack turns can compose reusable channel, history, thread, posting, reaction and permalink tools, then continue subscribed conversations without another mention. Agent View provides channel context, processing status and Stop cancellation. Interaction-scoped public search is exposed only when Slack grants it.

Add creator-owned interval, one-time and channel-watch tasks persisted on the controller. Recheck access before each background run, retain run audits, and pause failed or interrupted work instead of replaying uncertain effects. Keep personal service logins DM-only. Validate Slack tool arguments and channel access, cache duplicate writes and revoke tool access on Stop.

Document installation, supported capabilities, limits and the end-to-end flow. Existing Slack installations must apply the updated manifest and reinstall for the added scopes and events.

Validation: npm test, including simulated Slack-event-to-MCP integration, authorization, cancellation, scheduler and restart coverage; git diff --check. The live-model test is skipped by default. Live Slack deployment has not been exercised.

---

Requested from Slack. Written by an AI agent (Codex, in an isolated BoxLite microVM) — please review it like any outside contribution.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}