fix(slack): bound interactive API requests

[izadoesdev]

Interactive Slack requests can currently wait indefinitely for HTTP responses, retry failed writes for roughly 30 minutes, or pause every request on the client while waiting through Retry-After. Give interactive Bolt clients a five-second HTTP timeout, disable automatic write retries, and return rate-limit errors immediately. Socket Mode connection setup and OAuth retain their native retry behavior through separate installer client options.

This bounds individual HTTP requests; it does not cancel an already-issued request immediately or establish a hard end-to-end run deadline. No schema, OAuth scope, manifest, or user setup changes.

Validation: 61 Slack tests passed, including real localhost HTTP regressions for stalled requests, failed-write replay, and rate-limit queue blocking. Root lint and all 33 typecheck tasks passed. Pre-push tests passed across 29 tasks (28 cached). Independently reviewed.

Based on current staging; no dependencies. Overlaps #822 in apps/slack/src/index.ts and complements #819's cancellation handling. Native SDK behavior was verified against the installed 7.17.0 implementation and Slack's retry guidance.

---

Summary by cubic

Bounding interactive Slack API requests so they time out after five seconds, stop retrying failed writes, and return rate-limit errors immediately. Socket Mode and OAuth keep their native retry behavior via separate installer client options.

• Adds a SLACK_WEB_CLIENT_OPTIONS config with timeout, no retries, and rejectRateLimitedCalls.
• Applies these options to interactive clients only, leaving installer (Socket Mode/OAuth) unchanged.
• Does not cancel in-flight requests or enforce an end-to-end deadline.
• No schema, OAuth scope, manifest, or user setup changes.
• Validated with 61 Slack tests, including localhost regressions for stalled, failed, and rate-limited requests.

^{Written for commit a3a6881. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
databuddy-status	Ready	Preview	Sep 17, 2026 10:09am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
dashboard	Skipped		Sep 17, 2026 10:09am UTC
documentation	Skipped		Sep 17, 2026 10:09am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 01885c35-ca85-4b22-960f-bc8d062125b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were identified.

Summary

This PR bounds Slack App WebClient requests while preserving native installer behavior.

• Applies a five-second timeout to interactive Slack API calls.
• Disables automatic retries to prevent uncertain writes from being replayed.
• Rejects rate-limited calls immediately rather than blocking the shared client through Retry-After.
• Adds localhost HTTP regression tests covering stalled requests, failed writes, and rate-limit handling.

_{Reviews (1) · Last reviewed commit: "fix(slack): bound interactive API reques..."}