fix(verify): make Slack delivery work in the cloud sandbox

[khaliqgant]

Why

Deploying the nightly schedule (#1392) surfaced two defects that only appear in the cloud sandbox, so no local run — including my own stub-server verification — would have caught them.

1. The sandbox's token variable has a different name

packages/core/src/bootstrap/launcher.ts in ../cloud injects:

CLOUD_API_URL, CLOUD_API_ACCESS_TOKEN, CLOUD_API_REFRESH_TOKEN, …

but @relayflows/slack-primitive reads only CLOUD_API_TOKEN:

const cloudApiToken = nonEmpty(config.cloudApiToken) ?? nonEmpty(env.CLOUD_API_TOKEN) ?? '';

So every scheduled run would have failed Slack delivery with auth_token_missing. @relayflows/github-primitive already knows about this and falls back RELAY_CLOUD_API_TOKEN → CLOUD_API_ACCESS_TOKEN → WORKSPACE_TOKEN; the Slack primitive simply doesn't. The workflow now bridges it with the same precedence.

2. The variables were never exported

ENV_DEFAULTS assigned the cloud variables but didn't export them. The Slack post runs in a node child process, which therefore saw only the original process env — so the fallback in (1) would have had no effect even once added.

This one is worth calling out: my earlier verification of the Slack path against a stub server passed only because that test set CLOUD_API_TOKEN directly. It would not have worked in the sandbox. A green signal that didn't prove the thing it appeared to prove — the exact failure mode this whole workflow exists to catch, reproduced in my own test.

Verification

Stub server, all three paths:

Env	Result
CLOUD_API_ACCESS_TOKEN only (sandbox shape)	SLACK_POSTED · stub saw Bearer access-tok
CLOUD_API_TOKEN only (no regression)	SLACK_POSTED · stub saw Bearer direct-tok
Neither	SLACK_ERROR auth_token_missing + payload echoed, still loud

Both workflows Validation: PASS, all step bodies pass sh -n, prettier clean.

Deployment note

The live schedule 29fe661b currently runs the #1392 content, which has this gap — tonight's 03:00 UTC run will produce its verdict and the relay-native #relay-health report normally, but Slack delivery will print SLACK_UNDELIVERED with the payload in the run log rather than posting to C0AEKNLDNKW. I'll re-deploy the schedule from main once this merges.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c68bf034-74c1-4ae1-90d7-68c7cfb7a8b5

📥 Commits

Reviewing files that changed from the base of the PR and between 8ee70db and 692a852.

📒 Files selected for processing (2)

• workflows/audit-feature-manifest.ts
• workflows/verify-features.ts

---

📝 Walkthrough

Walkthrough

Both feature workflows now populate missing cloud API tokens from fallback environment variables and explicitly export the cloud API URL and token for Slack delivery child processes.

Changes

Slack credential environment bridge

Layer / File(s)	Summary
Bridge and export cloud credentials workflows/audit-feature-manifest.ts, workflows/verify-features.ts	Each workflow falls back from CLOUD_API_TOKEN to RELAY_CLOUD_API_TOKEN and then CLOUD_API_ACCESS_TOKEN, and exports CLOUD_API_URL and CLOUD_API_TOKEN for downstream Slack delivery scripts.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: willwashburn

Poem

A rabbit hops through shell-lit air,
Bridging tokens with careful care.
Cloud URLs bloom, exports take flight,
Slack’s child process sees them right.
“Hop, hop!” says Bun, “credentials bright!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: fixing Slack delivery in the cloud sandbox.
Description check	✅ Passed	The description is detailed and covers the problem, verification, and deployment notes, though it does not follow the template headings exactly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/verify-cloud-token-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}