Slack Integration: Delegate Coding Tasks from Chat

A Slack slash command is a custom trigger that runs code when typed in Slack. For example, /claude review-pr sends a request to your backend, which invokes Claude Code and posts results back. To set up:

1. Create a Slack app at api.slack.com. 2. Under "Slash Commands", register a new command (e.g., /claude). 3. Provide a Request URL—your backend API endpoint that handles the command. 4. Set a signing secret; use it to verify Slack's requests (prevents forgery). 5. Subscribe to events (e.g., app_mention) if you want Claude to respond to @app mentions in channels.

When a user types /claude task-name, Slack sends a POST request to your backend with the command text, user ID, channel, and workspace context. Your backend parses the command, invokes Claude Code, and responds with acknowledgment (Slack waits max 3 seconds for a response, so return immediately and update the channel asynchronously).

When an engineer runs /claude refactor auth module, your backend must gather context (repo URL, branch, relevant files) and send it to Claude Code. The workflow is:

1. Receive command: Parse the slash command text (e.g., "refactor auth module"). 2. Gather context: Clone or sync the repo; identify files mentioned (or all Python files if generic). 3. Invoke Claude Code: Run Claude with a prompt like "Refactor the auth module for DRY principles; output a diff and commit message". 4. Monitor execution: Claude Code runs in a background process; poll its status or use a callback. 5. Post results: Share findings in Slack (summary, metrics, link to branch).

Context is critical. If you just pass "refactor auth module" without file context, Claude works blind. Better: include the full auth module code, recent commits, and coding standards from your repo (README, linting config).

Async task execution means the user doesn't wait. Instead, update them in real time:

1. Acknowledge immediately: Reply in Slack within 3 seconds with "Starting refactor...". 2. Monitor progress: Use background jobs (e.g., Bull queue in Node.js) or AWS Lambda with callbacks. 3. Post updates: As Claude Code runs, edit the Slack message with progress ("Step 1/4: Analyzing code..."). 4. Post results: When complete, replace the message with findings (lines changed, new tests added, any errors). 5. Link to PR: Include a link to the auto-created PR so engineers can review and merge.

Slack message threads make this seamless. The original slash command response posts in the thread; subsequent updates (progress, results) add replies to that thread, keeping the main channel clean.

Not all Claude tasks should auto-merge. For risky changes (auth, payments, schema), require approval:

1. Claude proposes: Claude generates code and posts a summary in Slack. 2. Request approval: Include a button ("Approve", "Request Changes", "Reject") in the Slack message. 3. Handle response: When clicked, log the decision and proceed (approve = merge PR, reject = close branch). 4. Audit trail: Every approval/rejection is logged with the approver's name and timestamp.

Slack's Block Kit allows interactive buttons. When a user clicks "Approve", Slack sends a payload to your backend; parse it, verify permissions, then proceed with the merge.

Slack threads keep related messages together. If Claude needs clarification on a task, use threads:

1. Initial command: User runs /claude fix auth bug. 2. Acknowledgment: Bot posts "Starting investigation..." in the thread. 3. Clarification: If Claude needs details, bot asks "Is this the file path? src/auth/jwt.ts" as a thread reply. 4. Refinement: User replies in thread: "Yes, and also check src/auth/oauth.ts". 5. Execution: Claude restarts with refined context and posts final results in thread.

This keeps all context in one place; reviewing the thread shows the full conversation and decisions made.

Setup requires:

1. Create a Slack app at api.slack.com; note the signing secret and bot token. 2. Deploy a backend (Node.js, Python, Go) that handles slash commands. This backend needs: - Ability to receive POST requests from Slack. - Access to your Git repos (SSH key or GitHub token). - Ability to run Claude Code CLI or call Claude API. 3. Set permissions: Your Slack bot needs scopes: - commands (respond to slash commands) - chat:write (post messages) - reactions:write (add reaction emojis) - users:read (identify users) 4. Test: Type /claude help in Slack; verify the bot responds.

Example Node.js backend snippet:

1const express = require('express');2const app = express();3 4app.post('/slack/commands', (req, res) => {5  const { command, text, user_id, channel_id, response_url } = req.body;6 7  // Verify signature8  if (!verifySignature(req)) {9    return res.status(401).send('Unauthorized');10  }11 12  // Respond immediately13  res.json({ text: 'Starting task...' });14 15  // Run Claude async16  runClaudeTask(text, channel_id, response_url);17});18 19function runClaudeTask(task, channel_id, response_url) {20  exec(`claude-code run "${task}"`, (err, stdout) => {21    if (err) {22      postToSlack(response_url, `Error: ${err.message}`);23    } else {24      postToSlack(response_url, `Done: ${stdout}`);25    }26  });27}

2 AM. Production alert: "Payment API returning 503." On-call engineer is half-asleep. Instead of SSH-ing and debugging:

1. Slack message: /claude investigate payment api 503 errors in src/payments/api.ts 2. Claude analyzes: Reads recent logs, finds a null pointer in retry logic, suggests a fix. 3. Slack update: Posts "Found issue: retry logic missing null check on line 42. Fix: add if (response) check." 4. Auto PR: Claude creates a branch, commits the fix, opens a PR with the diff. 5. Approval: On-call engineer clicks "Approve" in Slack. 6. Auto merge: PR is merged, CI runs, fix is deployed. 7. Notification: Slack posts "✅ Deployed! Response time back to normal."

Total time: 2 minutes instead of 15. No context switching, no terminal commands. The on-call engineer reviews the fix in Slack and approves with one click.

Not everyone should be able to run arbitrary Claude tasks. Implement permissions:

1. Role-based access: Only engineers in the "code-review" team can run /claude refactor. 2. Dangerous task restrictions: Tasks like "delete database records" require explicit approval + two-factor confirmation. 3. Audit log: Every Claude invocation is logged with user, task, result, timestamp, and approval status. 4. Retention: Keep logs for at least 90 days; archive after 1 year for compliance.

Example permission matrix:

| Task | Junior Dev | Senior Dev | Tech Lead | All | |------|-----------|-----------|-----------|-----| | review-pr | ✅ | ✅ | ✅ | Yes | | refactor-module | ❌ | ✅ | ✅ | No | | delete-records | ❌ | ❌ | ✅ | No |

In your backend, check the user's role before invoking Claude Code. Log the decision (approved, denied, why).