feat(slack): launch v2 triggers and backfill custom bots

[TheodoreSpeaks]

Summary

• launch Slack v2 with custom-bot triggers and gate native OAuth behind the existing extended-scopes environment setting
• backfill legacy Slack credentials while preserving existing webhook URLs through credential-based fan-out
• add bounded, idempotent migration behavior and focused webhook coverage

Type of Change

• Feature

Testing

• 245 focused Vitest tests
• Sim and DB type-checks
• full lint and 29 repository audits
• local migration dry run

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 23, 2026 12:58am

[cursor]

PR Summary

High Risk
Touches Slack webhook authentication, credential storage, and a live data migration that rewrites bot secrets and routing. Failures here can drop or duplicate event delivery.

Overview
Releases slack_v2 as the default Slack block and trigger. The legacy block stays executable but hidden. Custom bots are generally available; the native Sim Slack app trigger is gated by SLACK_EXTENDED_SCOPES / NEXT_PUBLIC_SLACK_EXTENDED_SCOPES. Action-only bots may omit a signing secret; event ingest still requires one.

Migrates pasted bot tokens into reusable slack-custom-bot credentials via a dry-run-then-live script. Legacy webhook URLs are preserved: migrated rows are marked ingressMode: legacy_custom_bot and fan out by credential routing key instead of duplicating secrets. Path lookup now authenticates those aliases through the custom-bot ingress path, with bounded fan-out and fail-fast on partial markers.

Webhook lookup also caps targets per path/routing key. Docs and integration availability now treat Slack as slack_v2 with the redesigned event trigger.

^{Reviewed by Cursor Bugbot for commit 5f2a0bb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR releases Slack v2 with custom-bot triggers, gates native OAuth capabilities behind extended-scope configuration, and adds a bounded backfill for legacy Slack credentials while preserving webhook URLs.

• Routes custom-bot deliveries through credential-based fan-out and propagates dispatch failures when no target acknowledges the request.
• Treats intentionally filtered Slack deliveries as successful acknowledgements to avoid unnecessary provider retries.
• Adds Slack v2 block, trigger, integration-availability, documentation, migration, and regression-test coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts	The custom-bot route now evaluates typed fan-out results, returns a failure when every target fails, and acknowledges queued, filtered, or empty-target deliveries.
apps/sim/app/api/webhooks/trigger/[path]/route.ts	The generic path route authenticates migrated Slack credential aliases, replaces their direct dispatch with credential fan-out, and correctly includes filtered legacy results in acknowledgement selection.
apps/sim/lib/webhooks/slack-custom-ingress.ts	Centralizes credential-backed Slack signature verification and routing-key fan-out for both dedicated and migrated legacy ingress.
packages/db/scripts/migrate-slack-custom-bots.ts	Adds a bounded, dry-run-gated, transactional and idempotent operator backfill that creates reusable custom-bot credentials and links legacy triggers without changing webhook paths.
apps/sim/blocks/blocks/slack.ts	Releases Slack v2, hides the legacy block from discovery, and conditionally removes native-app operations and tools when extended scopes are disabled.

Sequence Diagram

sequenceDiagram
  participant Slack
  participant Ingress as Slack webhook ingress
  participant Credential as Custom-bot credential
  participant Targets as Credential-routed webhooks
  participant Queue as Webhook execution queue
  Slack->>Ingress: Signed event
  Ingress->>Credential: Load signing secret
  Credential-->>Ingress: Verify signature
  Ingress->>Targets: Resolve and fan out by credential ID
  loop Each active target
    Targets->>Queue: Preprocess and enqueue
    Queue-->>Targets: queued / filtered / failed
  end
  alt At least one queued or intentionally filtered
    Ingress-->>Slack: HTTP 200
  else Every target failed
    Ingress-->>Slack: First failure response
  end

Loading

_{Reviews (4): Last reviewed commit: "fix(slack): acknowledge filtered webhook..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8c78e18. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 12513cb. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5f2a0bb. Configure here.}

[cursor]

Reaction identity skip when teamId set

High Severity

Reaction deploys only call fetchSlackTeamId when the credential has no teamId. If teamId is present but botUserId is missing, providerConfig.bot_user_id is never set. Reaction self-detection then treats the app’s own reactions as foreign events, so the default self-drop does not apply and workflows that react can loop.

 

^{Reviewed by Cursor Bugbot for commit 5f2a0bb. Configure here.}