Slack onboarding: app manifest + guided setup wizard

[bborn]

Summary

Follow-up to the merged Slack module (#33). Bruno flagged that the Slack onboarding I documented was painful — a ~10-step manual checklist (toggle Socket Mode, add 4 scopes, subscribe to 2 events, hunt for member IDs, hand-edit config.env, re-run setup). This cuts it to: paste a manifest, copy two tokens, run one command, /invite the bot.

What's here

• modules/slack/manifest.yaml — a Slack app manifest. Create New App → From an app manifest → paste pre-configures Socket Mode, the bot scopes (chat:write, app_mentions:read, im:history, channels:read), and the app_mention / message.im event subscriptions in one shot. (Tokens still have to be minted by hand — Slack won't let a manifest do that.)
• ./setup.sh slack <gm> wizard — prompts for the bot + app tokens, verifies the bot token (auth.test), resolves the operator's Slack user id from their email (users.lookupByEmail) or takes a member id, writes the SLACK_* block into that GM's config.env, and installs the bridge on the right target (local / server / exe.dev). Blank app token ⇒ outbound-only. Idempotent — re-run to rotate a token, replaces in place.
• Refactors the local install into setup_slack_local() (shared by the local-server path and the wizard).
• README: manifest + wizard flow up front; the manual path kept as a <details> fallback.

Onboarding, before → after

Before	After
Toggle Socket Mode; add 4 scopes; subscribe to 2 events; install; find your member ID; paste 6 SLACK_* lines into config.env; ./setup.sh server	Paste manifest.yaml; generate 2 tokens; ./setup.sh slack <gm> (answer 2 prompts); /invite @taskyou

Testing

• bash -n setup.sh clean.
• manifest.yaml validated as YAML (scopes / events / socket_mode_enabled: true).
• Wizard run in a sandbox (local mode, fake tokens): writes the SLACK_* block, installs the bridge + .env, member-id passthrough, fake-token auth.test warns gracefully (non-fatal).
• Re-run / update: second run with a different token replaces in place — exactly one SLACK_* block, new token wins (caught + fixed a bug where sourced config shadowed the prompt so updates were impossible).
• QA harness (qa/run-qa.sh) → 26/0 (the setup_slack_local refactor doesn't regress the existing local/server/channel flow).

Not exercised here (needs real creds): the live auth.test / users.lookupByEmail success path and a real Slack install. The wizard's non-network logic and failure handling are covered above; WIZ_<VAR> env overrides make it scriptable/testable.

🤖 Generated with Claude Code