fix(qa): restore Slack transport under isolated installs

[vincentkoc]

Fixes #137245

What Problem This Solves

Fixes an issue where maintainers running the source-only private QA Slack transport would see it fail before credential acquisition after an isolated pnpm install.

Why This Change Was Made

The private QA build emits its Slack consumer under the root dist graph while deliberately externalizing @slack/web-api. The root package now declares the same pinned SDK version as the Slack plugin, so Node can resolve that external dependency under pnpm's isolated linker without changing plugin ownership or bundling topology.

User Impact

Slack QA and RTT qualification can start the live transport again after an isolated frozen install.

Evidence

• Reproduction: https://github.com/openclaw/openclaw-rtt/actions/runs/33742750602 failed 3/3 attempts before any Slack API call with Cannot find package '@slack/web-api'.
• Full Testbox gate: https://github.com/openclaw/openclaw/actions/runs/33747001332
  • isolated frozen install passed
  • focused regression passed: 24/24
  • check:changed passed, including typecheck, lint, dependency, SDK, boundary, and import-cycle gates
  • private QA build passed
  • root-dist resolver reported SLACK_WEB_API_RESOLVED=8.0.0
• Exact rebased candidate: https://github.com/openclaw/openclaw/actions/runs/33751530615
  • isolated frozen install passed
  • focused regression passed: 24/24
  • private QA build passed
  • root-dist resolver reported SLACK_WEB_API_RESOLVED=8.0.0
• git diff --check passed.
• Fresh branch autoreview found no accepted or actionable findings through P2.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[github-actions]

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• package.json
• pnpm-lock.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.
• Treat pnpm-lock.yaml and package-lock.json diffs as dependency security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

[github-actions]

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin, a member of @openclaw/openclaw-secops, or an OpenClaw organization member with Maintain or Admin repository access.

• Current SHA: 14d08f717994ed41b3f6092f5738c88a585c63a5
• Trusted actor: @vincentkoc
• Trusted role: pull request author; openclaw-secops

Security review is still recommended before merge when the dependency graph change is intentional.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 3, 2026, 8:15 AM ET / 12:15 UTC.

ClawSweeper review

What this changes

The PR adds the existing pinned Slack Web API package to the root dependency graph and tests that private QA’s root distribution can resolve it after an isolated pnpm install.

Regression provenance

Possible regression — probable (reproduction; reviewed change). No predecessor PR is attributed.

Merge readiness

✅ Ready for maintainer review

No blocking correctness findings. This active member-authored PR repairs a current-main isolated-install failure at the root build boundary; current main still lacks the root dependency declaration, so the PR remains necessary.

Priority: P2
Reviewed head: 14d08f717994ed41b3f6092f5738c88a585c63a5

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused root-resolution repair with a credible pre-fix failure, an appropriate boundary test, and no supported correctness or supply-chain concern.
Proof confidence	🐚 platinum hermit (4/6)	Not applicable: The author is a repository member, so the external-contributor proof gate does not apply; the PR body nevertheless records an isolated frozen-install, root-dist resolver result for the rebased candidate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a repository member, so the external-contributor proof gate does not apply; the PR body nevertheless records an isolated frozen-install, root-dist resolver result for the rebased candidate.
Evidence reviewed	6 items	Root-built QA call chain: The Slack QA adapter imports the Slack plugin public API; that API exports the client factory, whose implementation imports the external Slack SDK. Externalization contract: The unified root build explicitly leaves @slack/web-api external rather than bundling it. Isolated-install cause remains on main: The workspace uses pnpm's isolated linker, while fetched current main does not declare @slack/web-api in the root package manifest.
Findings	None	None.
Security	None	None.

How this fits together

Private QA compiles its QA Lab transport code into the root distribution, where it imports the Slack plugin’s public client API. That client retains the Slack SDK as an external Node dependency, which must resolve from the root distribution before credential acquisition and the QA scenario begin.

flowchart LR
  A[Isolated pnpm install] --> B[Private QA build]
  B --> C[Root distribution]
  C --> D[QA Lab Slack adapter]
  D --> E[Slack plugin client API]
  E --> F[External Slack SDK]
  F --> G[Credential and transport scenario]

Loading

Before merge

None.

Agent review details

Security

None.

PR surface

Tests +23, Config +1, Other +3. Total +27 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	1	23	0	+23
Docs	0	0	0	0
Config	1	1	0	+1
Generated	0	0	0	0
Other	1	3	0	+3
Total	3	27	0	+27

Review metrics

Metric	Value	Why it matters
Production versus test delta	production +1 manifest declaration, tests +23, lockfile +3	The production change is limited to making an already-pinned dependency directly resolvable from the root QA runtime; no runtime code or new package artifact is added.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #137245
Summary: This PR is the active candidate repair for the linked isolated-install private-QA Slack resolver defect.

Members:

• canonical: Private Slack QA leaks plugin dependencies into root dist #137245 - The linked issue describes the same root-dist failure and provides the matching isolated-install reproduction.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Retain the root declaration at the plugin’s existing pinned version and the root-dist resolver regression test, while keeping the Slack plugin as the owner of its SDK usage.

Do we have a high-confidence way to reproduce the issue?

Yes. The current source proves the root-built QA adapter reaches an externalized Slack SDK, and the linked issue supplies a concrete isolated-install build/run failure before any credential or Slack API call.

Is this the best way to solve the issue?

Yes. Declaring the existing exact plugin SDK version at the root is the narrow owner-boundary repair; bundling the SDK would contradict the explicit externalization contract and moving ownership from the Slack plugin would be broader and less maintainable.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e0dad1fc1333.

Labels

Label justifications:

• P2: This restores the private Slack QA and RTT qualification path, without changing ordinary Slack message delivery.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository member, so the external-contributor proof gate does not apply; the PR body nevertheless records an isolated frozen-install, root-dist resolver result for the rebased candidate.

Evidence

What I checked:

• Root-built QA call chain: The Slack QA adapter imports the Slack plugin public API; that API exports the client factory, whose implementation imports the external Slack SDK. (extensions/qa-lab/src/live-transports/slack/adapter.runtime.ts:4, 14d08f717994)
• Externalization contract: The unified root build explicitly leaves @slack/web-api external rather than bundling it. (tsdown.config.ts:312, 14d08f717994)
• Isolated-install cause remains on main: The workspace uses pnpm's isolated linker, while fetched current main does not declare @slack/web-api in the root package manifest. (pnpm-workspace.yaml:35, e0dad1fc1333)
• Focused regression guard: The added test synchronizes the root declaration with the Slack plugin version and resolves the SDK from a root-dist module location; its first assertion fails on the PR parent because the declaration is absent. (test/scripts/tsdown-runtime-config.test.ts:374, 14d08f717994)
• Supply-chain delta: The lockfile already pins @slack/web-api@8.0.0 with the same integrity record; this PR adds only the root importer edge and introduces no new resolved package. (pnpm-lock.yaml:402, 14d08f717994)
• Relevant history: The isolated-linker migration is recorded in commit 4675e3d; recent QA build dependency work includes cf95cb7. (pnpm-workspace.yaml:36, 4675e3d6dcab)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-03T12:02:02.921Z sha 7f0aeaf :: needs maintainer review before merge. :: none