feat(stripe,slack): flesh out plugin content — skills, agents, commands

[asachs01]

What

#120 scaffolded Stripe + Slack (plugin.json + .mcp.json + README + empty skills/agents/commands). This fills them with domain-appropriate, strong-first-pass content — mirroring the huntress structure/depth bar (not its security domain) per the build steer.

Conduit relevance: YES (data layer). This regenerates docs/src/data/plugins.ts, and conduit's white-label docs public/ is built from this Astro source at CI time (conduit/docs/white-label.md:143). So these plugin pages propagate to conduit's white-label docs — flagged for the conduit digest. (Determined read-only; same finding resolves murph's #122 as YES.)

Stripe (payments domain)

• Skills: payments (payment intents/charges/refunds/balance/payouts + reading why a payment failed), subscriptions (products/prices/subscriptions/invoices/dunning), disputes (chargeback triage by deadline + evidence draft→review→submit).
• Agent: stripe-billing-support — confirm-before-write money discipline.
• Commands: /dispute-triage (deadline-ordered queue), /subscription-audit <customer> (billing-health snapshot).

Slack (messaging domain)

• Skills: messaging (history/search/post + threads), channels-users (resolve #name→id, email→user), threads-reactions (thread replies + reactions as signals).
• Agent: slack-workspace-assistant — resolve-then-act, posting restraint, threaded by default.
• Commands: /channel-digest <channel>, /find-discussions <query>.

Mechanics (per the msp-plugin-development checklist)

• Bumped both plugin.json 0.1.0→0.2.0 + marketplace.json 1.10.0→1.11.0.
• Regenerated docs/src/data/plugins.ts (data only, via tsx scripts/generate-plugins.ts): 66 insertions, stripe/slack only, no drift to other plugins.
• .mcp.json (from feat(marketplace): minimal scaffolds for Stripe + Slack hosted MCP vendors #120) is correct for hosted-OAuth vendors — no API-key headers; the gateway handles the OAuth token. README documents the connection model (Stripe DCR public client / Slack BYOC operator app).

Honest notes

• Tool names are the gateway-prefixed stripe__* / slack__* form following each vendor's documented hosted-MCP tools; exact names should be confirmed against a live tools/list once connected (authored without live credentials per the overnight scope).
• Did NOT run the full astro build (isolated worktree, no node_modules) — repo CI validates frontmatter + categories; frontmatter mirrors the huntress pattern and categories (accounting/productivity) pre-exist in marketplace.
• Deferred (flagged per README): Stripe payout-reconciliation skill + more commands; Slack canvases + files skills (the scaffold lists both surfaces) + more commands. Strong-first-pass per the "depth-on-core over breadth-of-shells" steer — a draft for Aaron to react to.

[asachs01]

⛔ MERGE-BLOCKED pending tool-name verification. The skills/commands reference gateway-prefixed tool names (stripe__* / slack__*) authored without live credentials. If these diverge from the live Stripe/Slack MCP tools/list, the content references non-existent tools = silently broken plugin. Do not merge until the names are verified against the live hosted servers (gated on Aaron's creds → Stripe/Slack connect → tools/list diff). Marked draft. Interim published-docs cross-check in progress; full live verification to follow.

[asachs01]

Interim published-docs cross-check — DIVERGENCES FOUND (fix at live-verify before merge)

Cross-checked the skill/command tool refs against the published MCP docs (docs.stripe.com/mcp, docs.slack.dev). Result: partial divergence — must fix before merge.

Stripe — confirmed in published tools ✓

list_payment_intents, create_payment_intent, create_refund, list_subscriptions, update_subscription, cancel_subscription, list_products, list_prices, list_invoices, create_invoice, finalize_invoice, retrieve_balance, list_disputes, update_dispute, create_customer, list_customers, create_payment_link.

Stripe — referenced but NOT in published tools ❌ (MUST FIX)

• list_charges → Stripe MCP is payment-intent-centric; no charges tool. Use list_payment_intents.
• list_refunds → no list tool; create_refund only. Track status via the payment intent.
• retrieve_payment_intent / retrieve_subscription / retrieve_invoice / retrieve_dispute → no retrieve_* tools; the list_* tools return full objects.
• list_payouts / list_balance_transactions → not exposed; only retrieve_balance (+ niche get_non_local_payouts).

→ The payments, subscriptions, and disputes skills + /subscription-audit need their tool refs rewritten to the published set.

Slack — not cleanly verifiable from docs ⚠️

docs.slack.dev surfaces scopes + Web-API methods (chat.postMessage, canvases.read, search.read.*, users.read…), not a clean MCP tool list. My refs follow the Slack Web-API method convention (conversations.history, chat.postMessage, reactions.add…) — not contradicted by docs but not confirmed. Verify against the live Slack MCP tools/list.

Plan

Both fixes land in the live-verify pass (Aaron creds → Stripe/Slack connect → tools/list diff → rewrite to real names). The skill workflows, domain framing, and safety guidance are sound — only the tool identifiers need reconciliation. Stays draft + merge-blocked until then.