fix(onboarding): clarify Slack and keep AWS setup non-blocking

[justinhelmer]

AWS onboarding now accepts multiple accounts without making the operator wait for CloudFormation, while Slack onboarding explains its value and the public/private channel boundary at the relevant CLI surfaces. This removes the four high-priority friction points observed in Pocket’s onboarding demo.

Why: The demo exposed two trust gaps: Slack gave too little context about its channel behavior, while AWS setup blocked further accounts and could misattribute concurrent completions. Onboarding should preserve momentum without hiding what each connection does.

Where to look

1. AWS pre-submit decision refreshes exact-account state immediately before submission and limits background mode to the interactive picker. ⚠ A stale snapshot can duplicate a stack.
2. Per-account wait registry tracks, reports, and stops independent account pollers without writing over an active prompt. ⚠ Cleanup controls exit latency.
3. Slack channel boundary keeps the post-OAuth note operational: public channels are selectable here; private channels require a Slack invite.
4. Concurrency regressions pin out-of-order completion, exact-once reporting, duplicate rejection, and prompt-safe output.

Feedback wanted: Check the AWS Done/exit semantics and whether the Slack channel guidance is concise without losing the private-channel action.

Risk: 599 changed lines, mostly concurrency tests. A mistake could duplicate AWS setup or leave pollers alive; rollback both commits. Separate Slack/AWS PRs were considered, but one onboarding PR keeps the four demo findings reviewable together.

Verified: Clean-env build/version smoke, 530 tests, typecheck/lint, and black-box PTY Slack plus two-account AWS flows passed. Live provider callbacks and CloudFormation remain human-gated.

Decisions (4)

• Key waits by AWS account ID. Provider-wide polling cannot attribute out-of-order completions or prevent only the duplicate account while allowing another.
• Refresh immediately before submit. Prompt time creates a race window, so the latest exact-account snapshot—not the initial provider baseline—decides whether to submit.
• Keep explicit AWS mode foregrounded. --provider aws retains its 15-minute wait and timeout exit 1; only the interactive picker backgrounds work and returns pending exit 7 on Done.
• Keep Slack copy at its owning surface. The installer owns the pre-consent rationale; this CLI owns the standalone picker hint and post-OAuth public/private channel instructions.

Validation (9 criteria)

Criterion	Proof
Distinct AWS accounts can remain pending concurrently	test/cloud-connect-aws-background.test.ts::tracks concurrent accounts and reports out-of-order completion exactly once
A pending account cannot be submitted twice	test/cloud-connect-aws-background.test.ts::rejects a duplicate submission only while that exact account is pending
A completion during the wizard cannot cause a stale resubmission	test/cloud-connect-aws-background.test.ts::refreshes after a same-account wait completes at the pre-submit boundary
JSON and dry-run produce one result instead of re-entering the picker	test/cloud-connect-aws-background.test.ts::does not re-enter the picker for JSON or dry-run AWS results
Public selection and private invitation are stated before channel selection	test/integration-connect-slack-channels.test.ts passed
The built bundle completes Slack OAuth handoff and channel selection	Black-box PTY captured the fake browser URL, completed three list polls, joined #alerts with the expected body, and exited 0
The built bundle backgrounds two AWS accounts and stops cleanly on Done	Black-box PTY submitted 111111111111 and 222222222222, rendered both pending, printed account-specific recovery, and exited 7
Repository behavior remains green	npm test passed: 530 tests; npm run typecheck; npm run lint; npm run build
Real provider boundaries	Human-gated: no real Slack OAuth callback/channel membership or AWS CloudFormation deployment was exercised

For agents

The two commits are intentionally reviewable by concern: Slack copy first, AWS orchestration second. Generated client files were regenerated for validation but are not part of the diff.

[justinhelmer]

Re-review requested at 29438ee — restored the ownership boundary: the installer owns the pre-consent rationale, while the CLI note now covers public selection and the private-channel invite action. Commit history is clean and validation was rerun.

[coreplane-switchboard]

LGTM: The multi-account AWS orchestration and Slack guidance are sound, with one non-blocking messaging nit.

Note

Approved · head 29438ee · 1 finding: 1 nit

Severity	Finding	Where
nit	F1 Already-connected AWS can end with “Nothing connected”	src/commands/cloud/connect.ts:1112

Full review

F1 (nit, high confidence): When the interactive picker finds the chosen AWS account already connected, this branch reopens the picker without recording any activity. If the user then exits, hasSubmitted() is false and the command prints Nothing connected. immediately after reporting AWS as connected. Track the handled result or return successfully from this path to avoid the contradictory message.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). A repo admin enabled this via the auto-approve workflow.

[justinhelmer]

Review finding F1 (nit) skipped under the default minor severity gate: an already-connected AWS path can still end with the generic ‘Nothing connected’ summary. No minor-or-higher finding opened the round, so the approved head remains unchanged.

[justinhelmer]

Pre-merge E2E receipt at 29438ee: a clean-environment production bundle (519,319 bytes; SHA-256 9dc51c6cc943a4a00562996045e31122e8cd8cd1055b919c93d74d3521d91a1a) ran under a real PTY against a contract fake. Slack captured the browser URL, completed connection polling, rendered the public/private guidance, joined #alerts with the expected request, and exited 0. AWS submitted accounts 111111111111 and 222222222222, returned to the picker after each handoff, rendered both pending, stopped both pollers on Done, printed account-specific recovery commands, and exited 7. Full suite: 530/530. Live Slack callbacks/channel membership and real CloudFormation remain human-gated.

[justinhelmer]

Production receipt — CLI v0.2.41

• Release: https://github.com/coreplanelabs/cli/releases/tag/v0.2.41
• Release run: https://github.com/coreplanelabs/cli/actions/runs/35812245186 — Node 20/22/24, npm/GitHub publish, Homebrew update, and real install smoke all passed.
• npm latest: @coreplane/polylane@0.2.41; npx --yes @coreplane/polylane@0.2.41 --version returned polylane 0.2.41.
• Live https://polylane.com/setup installed v0.2.41 into an isolated HOME and passed SHA-256 verification.
• Installed bundle SHA-256 dc90d815a835ddd24fdabb0272d8cd1f27450ccd395a0f2e6b42cf79e577fdbe exactly matches the GitHub release asset.

Live Slack OAuth/channel membership and real AWS CloudFormation remain deliberately unexercised; their branch-built PTY contract tests passed before release.

[justinhelmer]

Post-release onboarding-lab receipt — UAT

• Ran repo-local lab from nominal main at af72f17b6 with the production public installer and published CLI 0.2.41.
• decline-everything run 26092305001892cb passed: fresh user/workspace, every provider declined once, mandatory retry, real read-only Cloudflare connection, automated validation, and complete teardown.
• The lab reports no outstanding runs after both the successful run and an earlier provider-rate-limited attempt.
• The earlier attempt exposed three independent follow-ups: coreplanelabs/nominal#3674, coreplanelabs/nominal#3675, and coreplanelabs/nominal#3676.

Scope caveat: nominal main still has no AWS lab connector/scenario, so live CloudFormation/IAM/eventual multi-account registration remains uncovered (coreplanelabs/nominal#3677). slack-human -i is also human-gated; this run validated the released Slack consent copy, not real OAuth/channel membership. The pre-release built-bundle PTY contracts remain the evidence for those two CLI paths.