feat(chat): add slack bridge with account linking and compose stack

[alexinthesky]

Summary

Adds a Slack ↔ Ask O11y path: users DM the bot setup to get a one-time Grafana link (account linking), and @mention the bot in channels to run the same detached agent flow as the web UI. A Bolt + Socket Mode worker (slack-bridge/) talks to new plugin HTTP routes; docker-compose-full can run the bridge locally with automated Grafana service-account token creation.

What changed

Backend (Go plugin)

• Slack bridge API under /api/slack-bridge/* (pending nonce, lookup, agent run + SSE) and /api/slack-link/confirm for browser confirmation, with HMAC-signed short-lived bridge tokens and shared executeDetachedAgentRun for agent execution.
• Redis / in-memory store for pending links and Slack↔Grafana bindings (slacklink_store.go).
• OpenAPI and tests updated for the new endpoints.
• slackBridgeSecret read from secure JSON; compose passes SLACK_BRIDGE_SECRET into Grafana so provisioning can match the bridge.

Slack bridge (Node / Bolt)

• New slack-bridge/ package: Socket Mode + Assistant handler for Agents UI and classic DM setup, app_mention for channel Q&A, calls to Grafana with Bearer SA token + bridge headers.
• Dockerfile and clearer error paths (401 vs plugin/secret), token validation at startup.
• @slack/web-api for auth.test preflight.

Frontend

• ?slack_link= handling on Home with slackLink.ts service calling confirm API.

Dev / ops

• scripts/server-full.sh (via npm run server:full): provisioning swap, optional npm run build, SLACK_BRIDGE_SECRET generation, compose up without slack-bridge first, SA token script + /api/user check, then --force-recreate slack-bridge.
• scripts/create-slack-bridge-grafana-token.sh with --write-env; scripts/lib/upsert-env.sh shared upsert; scripts/verify-slack-bridge-tokens.sh.
• npm run server:full:clean for stale Docker networks.
• docker-compose-full.yaml: slack-bridge service; GRAFANA_TOKEN from GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_TOKEN.
• .env.example, eslint ignore for slack-bridge/node_modules, CLAUDE.md updates.

Provisioning (this branch)

• Plugin layout under provisioning/plugins/ follows multi-org full.yaml + app.yaml_ (as used by the full stack script).

Why

• Product: Meet users in Slack for onboarding (setup) and channel questions without duplicating agent logic client-side.
• Reliability: Starting slack-bridge only after a valid Grafana SA token exists avoids 401 / invalid API key on /pending from an empty or stale env.
• Operability: One-command full stack + token automation and server:full:clean reduce Docker/network friction.

Notes for reviewers

• Slack app config (Messages tab vs Agents, scopes, events) is documented in slack-bridge/README.md.
• Commit messages on the branch may not all pass commitlint; consider squashing with conventional messages before merge if CI enforces per-commit rules.

---

Note

High Risk
Adds new externally callable Slack-bridge endpoints plus HMAC/secret-based authentication and user↔Slack identity binding, which is security-sensitive and impacts how agent runs are authorized. Also introduces a new runnable service and compose/workflow automation that could break local/prod deployments if misconfigured.

Overview
Enables a new Slack bridge integration: users can DM setup to generate a one-time linking nonce and then run Ask O11y agent conversations via Slack @mentions, reusing the same detached agent execution path as the web UI.

On the backend, adds /api/slack-bridge/* and /api/slack-link/* routes (pending nonce, lookup, confirm/unlink/status, Slack-authenticated agent run + SSE) protected by a shared slackBridgeSecret, short-lived HMAC-signed X-Slack-Bridge-Token, and per-user rate limiting; includes Redis/in-memory storage for link state and updates openapi.json + tests.

Adds a new slack-bridge/ Node service (Bolt Socket Mode) with a Docker image and GHCR publishing workflow, plus updates to docker-compose-full.yaml, provisioning (slackBridgeSecret), frontend Home URL handling + slackLink service, and new helper scripts to bootstrap the full stack and manage required .env values and Grafana service-account tokens.

^{Written by Cursor Bugbot for commit e465baf. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}