chore: pre-public polish (docs, sample host, NOTICE, drop unused test.proto)

.github/contributing.md

@@ -15,7 +15,7 @@ For security issues, do not open a public issue. See [SECURITY.md](../SECURITY.m
 
 ## Development setup
 
-This is a TypeScript project targeting Node.js 20+.
+This is a TypeScript project targeting Node.js 22+.
 
 ```bash
 npm install

README.md

@@ -44,7 +44,7 @@ OpenShell gateway  <--gRPC-->  Bridge  <--Socket Mode-->  Slack
 Create the app from [`manifest.json`](./manifest.json): [api.slack.com/apps](https://api.slack.com/apps)
 -> **Create New App** -> **From a manifest**. It is a Socket Mode app (no request URLs) and requests a
 single bot scope, `chat:write`, to keep the install easy for admins to approve. It also sets the App
-Home + `app_home_opened` subscription, interactivity, and the Messages tab.
+Home + `app_home_opened` subscription and interactivity.
 
 After creating it, install to the workspace for the bot token (`xoxb-...`) and generate an
 app-level token with `connections:write` (`xapp-...`) for Socket Mode. The bot does not self-join

docs/03-deployment.md

@@ -6,7 +6,7 @@ mock, see the README's "Local testing" section.
 
 ## Prerequisites
 
-- Node.js 20+ and npm.
+- Node.js 22+ and npm.
 - Network reach from wherever the bridge runs to the OpenShell gateway (gRPC).
 - A Slack workspace where you can install an app.
 - OpenShell gateway credentials: an mTLS bundle (single-host installs) or a bearer token
@@ -27,9 +27,9 @@ with minimal review. Two consequences to know:
   keep the scope surface small. You must create the approval channel and invite the bot yourself
   (next step). If the bot is later removed from the channel, posts fail with `not_in_channel` and the
   bridge retries on each poll until it is re-invited (no restart needed).
-- **Messages tab enabled** (`features.app_home.messages_tab_enabled`). Approvals route to a channel,
-  not DMs, so the whole admin group has visibility; the Messages tab is enabled only for a complete
-  App Home experience and adds no OAuth scope.
+- **Messages tab off, Home tab on** (`features.app_home`). Approvals route to a channel, not DMs, so
+  the app needs no Messages tab (`messages_tab_enabled: false`). The App Home dashboard uses the Home
+  tab (`home_tab_enabled: true`) instead. Neither tab adds an OAuth scope.
 
 ### Tokens
 

docs/04-testing-runbook.md

@@ -32,7 +32,7 @@ It covers both capabilities: the approval flow (Steps 1-8) and the audit-event c
 
 * macOS Apple Silicon (Homebrew present) or Linux x86_64/arm64 with glibc >= 2.28. Intel macOS and Alpine/musl are rejected by the installer.
 * A container runtime the gateway can drive (Docker Desktop / Docker Engine 28.0+, or Podman 5.x) is installed and running.
-* Node.js 20+ and npm, git, curl, jq available (Step 9 also uses `openssl`). On Linux the install step may require sudo (apt/dnf).
+* Node.js 22+ and npm, git, curl, jq available (Step 9 also uses `openssl`). On Linux the install step may require sudo (apt/dnf).
 * The bridge repo is `github.com/slack-samples/openshell-slack-admin-bridge`; the runtime it drives is `NVIDIA/OpenShell` (installed via curl below), a separate, unrelated project that happens to share the OpenShell name.
 
 # Step 1 - Preflight
@@ -45,7 +45,7 @@ It covers both capabilities: the approval flow (Steps 1-8) and the audit-event c
 export WORK="${WORK:-/tmp/openshell-bridge}"
 set -o pipefail
 mkdir -p "$WORK"
-node -p "+process.versions.node.split('.')[0] >= 20 ? 'NODE_OK' : 'NODE_BAD'"
+node -p "+process.versions.node.split('.')[0] >= 22 ? 'NODE_OK' : 'NODE_BAD'"
 npm -v
 git --version
 jq --version

proto/NOTICE

@@ -9,8 +9,8 @@ from NVIDIA's OpenShell project:
 They are included in this repository to define the gRPC wire contract that this
 sample communicates with. Each file retains its original SPDX header:
 
+    SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
     SPDX-License-Identifier: Apache-2.0
-    Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 These files are licensed under the Apache License, Version 2.0. You may obtain a
 copy of that license at:

scripts/send-samples.ts

@@ -59,7 +59,7 @@ const proposedChunks = [
     rule_name: "allow-telemetry",
     proposed_rule: {
       name: "allow-telemetry",
-      endpoints: [endpoint("telemetry.vendor.io", [443])],
+      endpoints: [endpoint("telemetry.example.io", [443])],
       binaries: [{ path: "/opt/agent/runner" }],
     },
     rationale: "Agent attempted to POST anonymous usage telemetry to an unlisted host.",

src/capture/sample-events.ts

@@ -68,7 +68,7 @@ const HOSTS = [
   "github.com",
   "api.openai.com",
   "weights.internal.example.net",
-  "telemetry.vendor.io",
+  "telemetry.example.io",
   "cdn.jsdelivr.net",
   "unknown-host.example.com",
 ];