Conversation
Add Slack as a secondary channel using Socket Mode (WebSocket, no public URL). Mirrors the Discord pattern: workspace-level shared context, JID-based routing, image attachments, share_request tool integration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
This PR adds a skill while also modifying source code. A skill PR should not change source files—the skill should contain instructions for Claude to follow. See If you're fixing a bug or simplifying code, please submit that as a separate PR. See CONTRIBUTING.md for details. |
CI Failure AnalysisThe CI check is failing because this PR violates the repository's contribution guidelines by mixing two types of changes:
According to CONTRIBUTING.md, skill PRs should only contain instructions for Claude to follow, not modify source files. SolutionThis PR should be split into two separate PRs: PR 1: Slack Channel Implementation
PR 2: Slack Setup Skill
I'll work on creating these split PRs now. |
|
Closing in favor of split PRs per CONTRIBUTING.md:
This ensures compliance with the guideline that skill PRs should not modify source files. |
…omment Database improvements from stability audit: 1. **Transaction Support for deleteTask (MEDIUM)** - Wrap DELETE operations in explicit transaction - Ensures both child and parent deletions succeed atomically - Prevents partial deletion leaving orphaned task_run_logs 2. **SQL Injection Safety Documentation (HIGH)** - Add security comment to updateTask explaining safety assumptions - Document that field names are hardcoded (not user-controlled) - Warn future maintainers about SQL injection risks if logic changes Impact: - Prevents database corruption from partial task deletions - Documents security assumptions for future code reviewers - Hardens codebase against accidental SQL injection introduction Related: - Audit report: nanoclaw-stability-audit-2026-02-14.md - Issues #3, #12 from stability audit Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix: stability quick wins from 2026-02-14 audit
Implements three critical stability fixes identified in the audit:
1. **Unhandled Promise Rejection Handler (CRITICAL)**
- Add process.on('unhandledRejection') to prevent crashes
- Logs rejections instead of exiting to maintain service uptime
- Prevents complete service outage from uncaught promise errors
2. **WhatsApp Event Listener Memory Leak (CRITICAL)**
- Store event handlers and remove them before reconnection
- Prevents exponential handler accumulation on reconnects
- Fixes memory leak leading to eventual OOM crashes
3. **Group Folder Path Traversal (MEDIUM)**
- Validate folder names with regex (alphanumeric + _ -)
- Verify resolved paths stay within groups directory
- Prevents malicious group registration from writing to arbitrary paths
Impact:
- Prevents process crashes from unhandled rejections
- Fixes production memory leak in WhatsApp channel
- Hardens security against path traversal attacks
Related:
- Audit report: nanoclaw-stability-audit-2026-02-14.md
- Issues #1, #4, #16 from stability audit
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix: add transaction support to deleteTask and SQL injection safety comment
Database improvements from stability audit:
1. **Transaction Support for deleteTask (MEDIUM)**
- Wrap DELETE operations in explicit transaction
- Ensures both child and parent deletions succeed atomically
- Prevents partial deletion leaving orphaned task_run_logs
2. **SQL Injection Safety Documentation (HIGH)**
- Add security comment to updateTask explaining safety assumptions
- Document that field names are hardcoded (not user-controlled)
- Warn future maintainers about SQL injection risks if logic changes
Impact:
- Prevents database corruption from partial task deletions
- Documents security assumptions for future code reviewers
- Hardens codebase against accidental SQL injection introduction
Related:
- Audit report: nanoclaw-stability-audit-2026-02-14.md
- Issues #3, #12 from stability audit
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---------
Co-authored-by: NanoClaw Agent <nanoclaw@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Summary
SlackChannelimplementation using@slack/boltSocket Mode (WebSocket, no public URL needed)share_requesttool, JID-based routing (slack:{channelId}/slack:dm:{channelId}).claude/skills/add-slack/SKILL.mdwith prerequisites, OAuth scopes, event subscriptions, and troubleshootingFiles changed
src/channels/slack.ts,.claude/skills/add-slack/SKILL.mdpackage.json,src/config.ts,src/types.ts,src/db.ts,src/index.ts,src/ipc.ts,src/container-runner.ts,src/task-scheduler.ts,container/agent-runner/src/index.ts,container/agent-runner/src/ipc-mcp-stdio.tsTest plan
bun run buildcompiles cleanlySLACK_BOT_TOKEN+SLACK_APP_TOKENto.env, restart — verify "Slack bot connected via Socket Mode" in logs@BotName helloin a Slack channel — verify message stored in DBservers/{workspace-slug}/CLAUDE.mdexistsshare_requestfrom Slack agent — verify it appears in WhatsAppsend_messageto Slack channel — verify deliverycontainer builder stop && container builder rm && container builder start && ./container/build.sh🤖 Generated with Claude Code