fix(slack): align setup checks with runtime

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx

@@ -196,7 +196,7 @@ Webhook triggers receive callbacks from the provider and must be able to verify
 | `SLACK_SIGNING_SECRET` | Verifying Slack event and slash-command signatures |
 | `SLACK_EXTENDED_SCOPES` / `NEXT_PUBLIC_SLACK_EXTENDED_SCOPES` | Enabling the native Sim-app trigger and its broader Slack scope set; set both to the same value |
 
-When enabling the native Sim Slack trigger, configure all three variables together. Slack OAuth actions can use `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` without enabling the native trigger or supplying a signing secret.
+When enabling the native Sim Slack trigger, configure all three variables together. Enable the extended-scope flags only after Slack approves the app for `assistant:write`, `app_mentions:read`, and `im:history`; otherwise Slack rejects OAuth authorization. Slack OAuth actions can use `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` without enabling the native trigger or supplying a signing secret.
 
 Your deployment must also be reachable from the provider's servers for webhook triggers to fire — a Sim instance on a private network can use polling triggers but not webhook triggers. Polling triggers additionally require the scheduler; see [Background Jobs](/platform/self-hosting/background-jobs).
 

packages/sim-setup/src/checks.test.ts

@@ -46,6 +46,25 @@ describe('setup coherence checks', () => {
     })
   })
 
+  it('treats a whitespace-only Slack signing secret as missing', async () => {
+    const findings = await runChecks(
+      rootContext({
+        SLACK_EXTENDED_SCOPES: 'true',
+        NEXT_PUBLIC_SLACK_EXTENDED_SCOPES: 'true',
+        SLACK_SIGNING_SECRET: '   ',
+      }),
+      ['coherence']
+    )
+
+    expect(findings).toContainEqual({
+      group: 'coherence',
+      status: 'fail',
+      message:
+        'SLACK_EXTENDED_SCOPES is on but SLACK_SIGNING_SECRET is not set — native Slack triggers will fail at runtime',
+      fix: 'set SLACK_SIGNING_SECRET or remove SLACK_EXTENDED_SCOPES and NEXT_PUBLIC_SLACK_EXTENDED_SCOPES',
+    })
+  })
+
   it('does not require a signing secret for outbound-only Slack OAuth', async () => {
     const findings = await runChecks(
       rootContext({

packages/sim-setup/src/checks.ts

@@ -482,7 +482,7 @@ function checkCoherence(ctx: CheckContext): Finding[] {
   ]
   for (const rule of featureRules) {
     if (!isTruthy(sim.vars.get(rule.flag))) continue
-    const missing = rule.needs.filter((key) => !sim.vars.get(key))
+    const missing = rule.needs.filter((key) => !sim.vars.get(key)?.trim())
     if (missing.length > 0) {
       findings.push({
         group: 'coherence',