create checks if CLI or SLack, so don't process/return both formats every time

src/handlers/sigma/sigma_create_handler.js

@@ -2,7 +2,6 @@
  * sigma_create_handler.js
  * 
  * Handles Sigma rule conversion requests from Slack commands
- * Action handlers moved to sigma_action_core.js
  */
 const logger = require('../../utils/logger');
 const { handleError } = require('../../utils/error_handler');

src/handlers/sigma/sigma_details_handler.js

@@ -22,6 +22,9 @@ const handleCommand = async (command, respond) => {
   try {
     logger.debug(`${FILE_NAME}: Processing sigma-details command: ${command.text}`);
     
+    // Determine if request is from CLI
+    const isCliRequest = command.channel_id === 'cli' || command.channel_name === 'cli';
+    
     if (!command || !command.text) {
       logger.warn(`${FILE_NAME}: Empty command received for sigma-details`);
       await respond({
@@ -61,25 +64,28 @@ const handleCommand = async (command, respond) => {
       return;
     }
     
-    // For Slack responses, generate Block Kit blocks
+    // Create response based on interface type
-    let blocks;
+    if (isCliRequest) {
-    try {
+      // For CLI, just return the raw data
-      // This is for Slack - get the Block Kit UI components
+      await respond({
-      blocks = getSigmaRuleDetailsBlocks(sigmaRuleDetailsResult.explanation);
+        responseData: sigmaRuleDetailsResult.explanation,
-    } catch (blockError) {
+        response_type: 'cli'
-      await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
-        responseType: 'ephemeral',
-        customMessage: 'Error generating rule details view'
       });
-      return;
+    } else {
+      // For Slack, generate and return Block Kit blocks
+      try {
+        const blocks = getSigmaRuleDetailsBlocks(sigmaRuleDetailsResult.explanation);
+        await respond({
+          blocks: blocks,
+          response_type: 'in_channel'
+        });
+      } catch (blockError) {
+        await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
+          responseType: 'ephemeral',
+          customMessage: 'Error generating rule details view'
+        });
+      }
     }
-    
-    // Return the response with both blocks for Slack and responseData for CLI
-    await respond({
-      blocks: blocks, // For Slack interface
-      responseData: sigmaRuleDetailsResult.explanation, // For CLI interface
-      response_type: 'in_channel'
-    });
   } catch (error) {
     await handleError(error, `${FILE_NAME}: Details command handler`, respond, {
       responseType: 'ephemeral'

src/handlers/sigma/sigma_search_handler.js

@@ -110,47 +110,56 @@ const handleCommand = async (command, respond) => {
       return;
     }
 
-    // Generate blocks with pagination support
+    const isCliRequest = command.channel_id === 'cli' || command.channel_name === 'cli';
-    let blocks;
+
-    try {
+    if (isCliRequest) {
-      logger.debug(`${FILE_NAME}: Calling getSearchResultBlocks with ${searchResult.results.length} results`);
+      // For CLI, just return the raw data
-      // If we have too many results, add a warning block at the beginning
+      await respond({
-      if (searchResult.tooManyResults) {
+        responseData: searchResult.results,
-        blocks = getSearchResultBlocks(keyword, searchResult.results, searchResult.pagination);
+        response_type: 'cli'
-        // Insert warning at the beginning of blocks (after the header)
-        blocks.splice(1, 0, {
-          "type": "section",
-          "text": {
-            "type": "mrkdwn",
-            "text": `:warning: Your search for "${keyword}" returned ${totalCount} results, which is a lot. Displaying the first page. Consider using a more specific keyword for narrower results.`
-          }
-        });
-      } else {
-        blocks = getSearchResultBlocks(keyword, searchResult.results, searchResult.pagination);
-      }
-      logger.debug(`${FILE_NAME}: Successfully generated ${blocks?.length || 0} blocks`);
-    } catch (blockError) {
-      // Use error handler for block generation errors
-      await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
-        responseType: 'in_channel',
-        customMessage: `Found ${searchResult.results.length} of ${totalCount} rules matching "${keyword}" (page ${page} of ${searchResult.pagination?.totalPages || 1}). Use /sigma-details [id] to view details.`
       });
-      return;
+    } else {
+      // For Slack, generate and return Block Kit blocks
+      let blocks;
+      try {
+        logger.debug(`${FILE_NAME}: Calling getSearchResultBlocks with ${searchResult.results.length} results`);
+        // If we have too many results, add a warning block at the beginning
+        if (searchResult.tooManyResults) {
+          blocks = getSearchResultBlocks(keyword, searchResult.results, searchResult.pagination);
+          // Insert warning at the beginning of blocks (after the header)
+          blocks.splice(1, 0, {
+            "type": "section",
+            "text": {
+              "type": "mrkdwn",
+              "text": `:warning: Your search for "${keyword}" returned ${totalCount} results, which is a lot. Displaying the first page. Consider using a more specific keyword for narrower results.`
+            }
+          });
+        } else {
+          blocks = getSearchResultBlocks(keyword, searchResult.results, searchResult.pagination);
+        }
+        logger.debug(`${FILE_NAME}: Successfully generated ${blocks?.length || 0} blocks`);
+
+        // Determine if this should be visible to everyone or just the user
+        const isEphemeral = totalCount > 20;
+
+        // Add debug log before sending response
+        logger.debug(`${FILE_NAME}: About to send response with ${blocks?.length || 0} blocks`);
+
+        // Respond with the search results
+        // Respond with the search results
+        await respond({
+          blocks: blocks,
+          response_type: isEphemeral ? 'ephemeral' : 'in_channel'
+        });
+      } catch (blockError) {
+        // Use error handler for block generation errors
+        await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
+          responseType: 'in_channel',
+          customMessage: `Found ${searchResult.results.length} of ${totalCount} rules matching "${keyword}" (page ${page} of ${searchResult.pagination?.totalPages || 1}). Use /sigma-details [id] to view details.`
+        });
+      }
     }
 
-    // Add debug log before sending response
-    logger.debug(`${FILE_NAME}: About to send response with ${blocks?.length || 0} blocks`);
-    
-    // Determine if this should be visible to everyone or just the user
-    const isEphemeral = totalCount > 20;
-    
-    // Respond with the search results
-    await respond({
-      blocks: blocks,
-      responseData: searchResult.results,
-      response_type: isEphemeral ? 'ephemeral' : 'in_channel'
-    });
-    
     // Add debug log after sending response
     logger.debug(`${FILE_NAME}: Response sent successfully`);
   } catch (error) {

src/handlers/sigma/sigma_stats_handler.js

@@ -22,6 +22,9 @@ const handleCommand = async (command, respond) => {
   try {
     logger.info(`${FILE_NAME}: Processing sigma-stats command`);
     
+    // Determine if request is from CLI by checking channel properties
+    const isCliRequest = command.channel_id === 'cli' || command.channel_name === 'cli';
+    
     await respond({
       text: 'Gathering Sigma rule statistics... This may take a moment.',
       response_type: 'ephemeral'
@@ -39,24 +42,28 @@ const handleCommand = async (command, respond) => {
       return;
     }
     
-    // For Slack responses, generate Block Kit blocks
+    // For CLI, only include responseData
-    let blocks;
+    if (isCliRequest) {
-    try {
+      await respond({
-      blocks = getStatsBlocks(statsResult.stats);
+        responseData: statsResult.stats,
-    } catch (blockError) {
+        response_type: 'cli'
-      await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
-        responseType: 'ephemeral',
-        customMessage: 'Error generating statistics view'
       });
-      return;
     } 
-    
+    // For Slack, only generate Block Kit blocks
-    // Return the response with both blocks for Slack and responseData for CLI
+    else {
-    await respond({
+      try {
-      blocks: blocks,
+        const blocks = getStatsBlocks(statsResult.stats);
-      responseData: statsResult.stats, // Include raw data for CLI
+        await respond({
-      response_type: 'in_channel'
+          blocks: blocks,
-    });
+          response_type: 'in_channel'
+        });
+      } catch (blockError) {
+        await handleError(blockError, `${FILE_NAME}: Block generation`, respond, {
+          responseType: 'ephemeral',
+          customMessage: 'Error generating statistics view'
+        });
+      }
+    }
   } catch (error) {
     await handleError(error, `${FILE_NAME}: Stats command handler`, respond, {
       responseType: 'ephemeral'