chore(slack): add verbose debug logging across message handling flow

[tlgimenes]

Summary

• Add verbose console.log statements across all strategic points in the Slack MCP message handling pipeline for production debugging
• Covers 9 files across the full request lifecycle: webhook → event routing → event handling → context building → LLM call → Decopilot API → Slack response
• Logs include timing measurements, message previews, config details, routing decisions, and error context

How to Test

1. Deploy to a staging environment with a configured Slack connection
2. Send a message to the bot (DM, @mention, or thread reply)
3. Check server logs — you should see a full trace like:
   • [Router] → [Webhook] → [EventHandler] → [ContextBuilder] → [LLMHandler] → [LLM] → [MeshChat] → [Slack]
4. Verify timing info (e.g., "LLM call completed in 2345ms") appears correctly
5. Verify sensitive data (tokens, signing secrets) is NOT logged — only config metadata

Screenshots

N/A

Migration Notes

N/A — no behavioral changes, only added logging.

🤖 Generated with Claude Code

---

Summary by cubic

Adds verbose, metadata-only debug logging across the Slack MCP message flow to trace issues end-to-end, with consistent timing/status logs for Decopilot/MeshChat/OpenRouter/Slack APIs. No behavior changes.

• Refactors

  • Instrumented webhook routing, router, event/context/LLM handlers, shared/mesh-chat (client/generate), Slack client, and OpenRouter embedding tools with start/end markers, trace IDs, and streaming chunk counts.
  • Logs record only metadata (lengths, counts, IDs, timing) instead of raw content; prevents leaking user text, LLM responses, or tokens.
  • Captures timings/status for Slack API (post/update/history/replies), Decopilot/MeshChat requests, context fetch, and LLM calls; clearer ignore/routing logs and per-connection response config decisions; applied oxfmt formatting and minor cleanup in openrouter/server/utils.ts.

• Bug Fixes

  • Made streaming callback async to match StreamCallback type.
  • Removed unused OpenRouterClient import in openrouter/server/tools/embeddings/list-models.ts.
  • Cast Slack event fields in debug logs (e.g., files, channel_type) to avoid TypeScript errors.
  • Cast OpenRouter embeddings result to any for metadata-only logging where types don’t expose needed fields.

^{Written for commit 241d583. Summary will update on new commits.}

[cubic-dev-ai]

9 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="slack-mcp/server/lib/slack-client.ts">

<violation number="1" location="slack-mcp/server/lib/slack-client.ts:235">
P1: Avoid logging message text previews. This leaks user conversation content into production logs; log only metadata (length/ids) or gate content logging behind a non-production debug flag.</violation>
</file>

<file name="slack-mcp/server/slack/handlers/context-builder.ts">

<violation number="1" location="slack-mcp/server/slack/handlers/context-builder.ts:153">
P1: Do not log raw message content from Slack history; this can leak user data into production logs. Log only metadata (index/role/length) or gate content logging behind a strict debug flag.</violation>
</file>

<file name="slack-mcp/server/lib/llm.ts">

<violation number="1" location="slack-mcp/server/lib/llm.ts:64">
P1: Avoid logging raw LLM response text; this can leak sensitive user or business data into production logs.</violation>
</file>

<file name="shared/mesh-chat/client.ts">

<violation number="1" location="shared/mesh-chat/client.ts:109">
P1: Avoid logging raw Decopilot error bodies; this can leak sensitive request/response content into production logs.</violation>
</file>

<file name="slack-mcp/server/router.ts">

<violation number="1" location="slack-mcp/server/router.ts:354">
P1: Avoid logging raw Slack message text; it can expose user content in production logs. Log metadata (length/type) instead.</violation>
</file>

<file name="slack-mcp/server/slack/handlers/llm-handler.ts">

<violation number="1" location="slack-mcp/server/slack/handlers/llm-handler.ts:158">
P1: Avoid logging raw LLM response text in production; this can leak sensitive user/content data into logs.</violation>
</file>

<file name="shared/mesh-chat/generate.ts">

<violation number="1" location="shared/mesh-chat/generate.ts:130">
P1: Avoid logging raw response content previews in production paths. This can leak user/LLM sensitive data into logs.</violation>
</file>

<file name="slack-mcp/server/slack/handlers/eventHandler.ts">

<violation number="1" location="slack-mcp/server/slack/handlers/eventHandler.ts:514">
P1: Avoid logging raw user message text; log metadata (length/flags) instead to prevent sensitive data leakage in production logs.</violation>

<violation number="2" location="slack-mcp/server/slack/handlers/eventHandler.ts:601">
P1: Do not log LLM prompt content previews; this can leak conversation and attachment data to logs.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

3 issues found across 13 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="shared/mesh-chat/generate.ts">

<violation number="1" location="shared/mesh-chat/generate.ts:120">
P1: Do not log raw `config` and `apiMessages`; it can leak the Mesh auth token and full user message/media contents to logs.</violation>
</file>

<file name="openrouter/server/tools/embeddings/generate.ts">

<violation number="1" location="openrouter/server/tools/embeddings/generate.ts:53">
P1: Do not log raw embedding input payloads; this can expose user content in production logs.</violation>

<violation number="2" location="openrouter/server/tools/embeddings/generate.ts:61">
P2: Avoid logging the full embeddings result object; log only lightweight metadata.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}