@assemblyline-agents/slack 1.0.0 → 3.0.0

package/dist/index.js

@@ -1,8 +1,31 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { connectionPluginMetadata, defineChannel, defineMcpPluginConnection, definePlugin } from "@assemblyline-agents/core";
 import { attachmentFetchTimeoutMs, attachmentRemoteUrl, attachmentTrustedForProvider, fetchWithPolicy, firstDownloadableUrl } from "@assemblyline-agents/runtime";
+import { augmentContext } from "./context.js";
+import { errorDetail } from "./error-detail.js";
+import { externalSlackMessageId, slackAttachments, slackConversationId, slackMessageSource, slackMessageText, slackTimestampToIso } from "./message-context.js";
+import { splitSlackMarkdown } from "./outbound-markdown.js";
+import { slackApi } from "./slack-api.js";
+import { slackSigningSecrets, slackWorkspaceCredentials } from "./workspace-credentials.js";
+export { slackSigningSecrets, slackWorkspaceCredentialMap, slackWorkspaceCredentials } from "./workspace-credentials.js";
+export { augmentContext } from "./context.js";
 export const SLACK_REQUIRED_ENV = ["SLACK_SIGNING_SECRET", "SLACK_BOT_TOKEN"];
-export const SLACK_OPTIONAL_ENV = ["SLACK_BOT_USER_ID", "SLACK_ASSISTANT_ENABLED"];
+export const SLACK_OPTIONAL_ENV = ["SLACK_BOT_USER_ID", "SLACK_ASSISTANT_ENABLED", "SLACK_WORKSPACE_CREDENTIALS_JSON"];
+export const SLACK_REQUIRED_BOT_SCOPES = ["app_mentions:read", "channels:history", "chat:write", "files:read", "files:write", "im:history"];
+export const SLACK_OPTIONAL_BOT_SCOPES = ["assistant:write", "groups:history"];
+export const SLACK_DEFAULT_STATUS = "is working...";
+export const SLACK_DEFAULT_LOADING_MESSAGES = [
+    "Beboppin'",
+    "Boondoggling",
+    "Cerebrating",
+    "Combobulating",
+    "Cooking",
+    "Elucidating",
+    "Flibbertigibbeting",
+    "Hullaballooing",
+    "Ionizing",
+    "Photosynthesizing"
+];
 /** Production ingress-auth requirement (any-of groups): Slack request signing. */
 export const SLACK_INGRESS_SECRET_ENV = [["SLACK_SIGNING_SECRET"]];
 const SLACK_CONNECTION_PLUGIN = connectionPluginMetadata("slack");
@@ -12,11 +35,17 @@ export function defineSlackConnection(options) {
 export const assemblyLinePlugin = definePlugin({ connections: [SLACK_CONNECTION_PLUGIN] });
 const DEFAULT_SLACK_ROUTE = "/slack/events";
 const DEFAULT_SLACK_WEBHOOK_TOLERANCE_SECONDS = 300;
-const SLACK_RECENT_ACTIVITY_HOURS = 24;
-const SLACK_RECENT_ACTIVITY_LIMIT = 3;
-const SLACK_RECENT_HISTORY_LIMIT = 20;
-const SLACK_SUMMARY_MAX_CHARS = 240;
-const SLACK_DELIVERY_FILE_MAX_COUNT = 10;
+const SLACK_STATUS_REFRESH_INTERVAL_MS = 90_000;
+function shuffledSlackLoadingMessages() {
+    const messages = [...SLACK_DEFAULT_LOADING_MESSAGES];
+    for (let index = messages.length - 1; index > 0; index -= 1) {
+        const swapIndex = Math.floor(Math.random() * (index + 1));
+        const current = messages[index];
+        messages[index] = messages[swapIndex];
+        messages[swapIndex] = current;
+    }
+    return messages;
+}
 export function defineSlackChannel(options = {}) {
     const definition = {
         description: options.description ?? "Receive Slack Events API callbacks and deliver replies through Slack Web API.",
@@ -25,14 +54,20 @@ export function defineSlackChannel(options = {}) {
         methods: options.methods ?? ["POST"],
         ingress: { requiredSecretEnv: SLACK_INGRESS_SECRET_ENV },
         metadata: {
+            ...(options.metadata ?? {}),
             provider: "slack",
-            ...(options.metadata ?? {})
+            installation: {
+                requiredBotScopes: [...SLACK_REQUIRED_BOT_SCOPES],
+                optionalBotScopes: [...SLACK_OPTIONAL_BOT_SCOPES]
+            }
         }
     };
     if (options.connection)
         definition.connection = options.connection;
     return Object.assign(defineChannel(definition), {
         normalizeHttp,
+        ...(options.resolvePrincipal ? { resolvePrincipal: options.resolvePrincipal } : {}),
+        isPrivateSurface: options.isPrivateSurface ?? defaultSlackPrivateSurface,
         startTurn,
         augmentContext,
         send,
@@ -40,14 +75,21 @@ export function defineSlackChannel(options = {}) {
         ingressAuth: { requiredSecretEnv: SLACK_INGRESS_SECRET_ENV }
     });
 }
+function defaultSlackPrivateSurface(turn) {
+    const metadata = recordValue(turn.metadata);
+    const slack = recordValue(metadata?.slack);
+    const surface = stringValue(slack?.surface);
+    return surface === "dm" || surface === "assistant";
+}
 export function normalizeHttp(request, ctx) {
-    const signingSecret = ctx.env.SLACK_SIGNING_SECRET;
-    if (!signingSecret)
+    const payload = request.body;
+    const teamId = slackTeamId(recordValue(payload.event) ?? {}, payload);
+    const signingSecrets = slackSigningSecrets(ctx.env, teamId);
+    if (signingSecrets.length === 0)
         return { kind: "response", status: 500, body: { ok: false, error: "missing_slack_signing_secret" } };
-    if (!verifySlackRequest(request, signingSecret)) {
+    if (!signingSecrets.some((secret) => verifySlackRequest(request, secret))) {
         return { kind: "response", status: 401, body: { ok: false, error: "invalid_slack_signature" } };
     }
-    const payload = request.body;
     if (payload.type === "url_verification") {
         return { kind: "response", status: 200, body: { challenge: stringValue(payload.challenge) ?? "" } };
     }
@@ -60,119 +102,156 @@ export function normalizeHttp(request, ctx) {
     const event = recordValue(payload.event);
     if (!event)
         return ignored("missing_event", { eventId });
-    const ignoredReason = ignoredEventReason(event, ctx.env);
+    const ignoredReason = ignoredEventReason(event, payload, ctx.env, teamId);
     if (ignoredReason)
         return ignored(ignoredReason, { eventId, eventType: stringValue(event.type) ?? null });
     const normalized = slackTurnFromEvent(event, payload, eventId, ctx);
-    if (!normalized) {
-        return ignored("unsupported_event", { eventId, eventType: stringValue(event.type) ?? null });
+    if (normalized) {
+        return {
+            kind: "accepted",
+            status: 200,
+            body: { ok: true, accepted: true },
+            idempotencyKey: eventId,
+            idempotencyScope: `channel:${ctx.channel.name}:slack`,
+            turn: normalized
+        };
+    }
+    const observation = slackObservationFromEvent(event, payload, eventId, ctx);
+    if (observation) {
+        return {
+            kind: "observation",
+            status: 200,
+            body: { ok: true, observed: true },
+            observation
+        };
     }
     return {
-        kind: "accepted",
-        status: 200,
-        body: { ok: true, accepted: true },
-        idempotencyKey: eventId,
-        idempotencyScope: `channel:${ctx.channel.name}:slack`,
-        turn: normalized
+        ...ignored("unsupported_event", { eventId, eventType: stringValue(event.type) ?? null })
     };
 }
 export async function startTurn(turn, ctx) {
-    if (!isTruthy(ctx.env.SLACK_ASSISTANT_ENABLED))
-        return undefined;
     const target = slackDeliveryTarget(turn);
-    if (!target.channel || !target.threadTs || !ctx.env.SLACK_BOT_TOKEN)
+    const teamId = slackTeamIdForTurn(turn);
+    const threadTs = target.threadTs ?? target.messageTs;
+    if (!target.channel || !threadTs || !slackWorkspaceCredentials(ctx.env, teamId).botToken)
         return undefined;
     const channel = target.channel;
-    const threadTs = target.threadTs;
-    await slackApi(ctx, "assistant.threads.setStatus", {
-        channel_id: channel,
-        thread_ts: threadTs,
-        status: "Working on it..."
-    }).catch(() => undefined);
+    const loadingMessages = shuffledSlackLoadingMessages();
+    const setWorkingStatus = async () => {
+        await slackApi(ctx, "assistant.threads.setStatus", {
+            channel_id: channel,
+            thread_ts: threadTs,
+            status: SLACK_DEFAULT_STATUS,
+            loading_messages: loadingMessages
+        }, teamId).then(() => undefined, () => undefined);
+    };
+    await setWorkingStatus();
+    let stopped = false;
+    let refreshInFlight;
+    const refreshTimer = setInterval(() => {
+        if (stopped || refreshInFlight)
+            return;
+        refreshInFlight = setWorkingStatus().finally(() => {
+            refreshInFlight = undefined;
+        });
+    }, SLACK_STATUS_REFRESH_INTERVAL_MS);
+    refreshTimer.unref?.();
     return {
         stop: async () => {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(refreshTimer);
+            await refreshInFlight;
             await slackApi(ctx, "assistant.threads.setStatus", {
                 channel_id: channel,
                 thread_ts: threadTs,
                 status: ""
-            }).catch(() => undefined);
+            }, teamId).catch(() => undefined);
         }
     };
 }
-export async function augmentContext(turn, ctx) {
-    const recentHistory = (await ctx.state.listRecentMessages(turn.conversationId, SLACK_RECENT_HISTORY_LIMIT)).map(messageHistoryLine);
-    const since = new Date(Date.now() - SLACK_RECENT_ACTIVITY_HOURS * 60 * 60 * 1000).toISOString();
-    const relatedConversations = turn.userId && ctx.state.listRecentConversationsBySubject
-        ? await ctx.state.listRecentConversationsBySubject({
-            channel: turn.channel,
-            subject: turn.userId,
-            since,
-            limit: SLACK_RECENT_ACTIVITY_LIMIT,
-            excludeId: turn.conversationId
-        })
-        : [];
-    const related = await Promise.all(relatedConversations.map((conversation) => summarizeConversation(ctx, conversation)));
-    const slack = recordValue(turn.metadata?.slack);
-    return {
-        recentHistory,
-        channelContext: compactJsonObject({
-            provider: "slack",
-            surface: stringValue(slack?.surface),
-            teamId: stringValue(slack?.teamId),
-            enterpriseId: stringValue(slack?.enterpriseId),
-            channelId: stringValue(slack?.channel),
-            threadTs: stringValue(slack?.threadTs),
-            currentConversation: {
-                id: turn.conversationId,
-                userId: turn.userId ?? null,
-                eventId: turn.eventId
-            },
-            relatedConversations: related,
-            contextPolicy: {
-                source: "openeve_state",
-                maxRelatedConversations: SLACK_RECENT_ACTIVITY_LIMIT,
-                maxAgeHours: SLACK_RECENT_ACTIVITY_HOURS,
-                note: "Related Slack context is bounded to this user's recent OpenEve conversations and contains summaries, not workspace-wide Slack history."
-            }
-        })
-    };
-}
 export async function send(delivery, ctx) {
     const target = slackDeliveryTarget(delivery.turn, delivery.payload);
+    const teamId = slackTeamIdForTurn(delivery.turn, delivery.payload);
     if (!target.channel)
         throw new Error("Slack delivery requires a channel.");
-    const uploadedFiles = await uploadSlackDeliveryFiles(delivery, ctx, target);
-    if (uploadedFiles.length > 0) {
+    const response = neutralizeSlackBroadcasts(delivery.response);
+    const deliveryFiles = slackDeliveryFiles(delivery.payload);
+    if (deliveryFiles.length > 0) {
+        const uploadResult = await uploadSlackDeliveryFiles(deliveryFiles, ctx, teamId);
+        if (uploadResult.failures.length > 0) {
+            throw slackAttachmentFailuresError(uploadResult.failures);
+        }
+        if (uploadResult.uploaded.length !== deliveryFiles.length) {
+            throw new Error(`Slack file delivery prepared ${deliveryFiles.length} files but uploaded ${uploadResult.uploaded.length}.`);
+        }
         const result = await slackApi(ctx, "files.completeUploadExternal", compactJsonObject({
             channel_id: target.channel,
             thread_ts: target.threadTs,
-            initial_comment: delivery.response,
-            files: uploadedFiles.map((file) => compactJsonObject({
+            files: uploadResult.uploaded.map((file) => compactJsonObject({
                 id: stringValue(file.id),
                 title: stringValue(file.title)
-            }))
-        }));
+            })),
+            initial_comment: response || undefined
+        }), teamId).catch((error) => {
+            throw slackPhaseError("Slack upload completion failed", error);
+        });
+        const slackFiles = arrayValue(result.files) ?? [];
+        const completedFileIds = new Set(slackFiles
+            .map((file) => stringValue(recordValue(file)?.id))
+            .filter((id) => id !== undefined));
+        const missingFileIds = uploadResult.uploaded
+            .map((file) => stringValue(file.id))
+            .filter((id) => id !== undefined && !completedFileIds.has(id));
+        if (missingFileIds.length > 0) {
+            throw new Error(`Slack upload completion did not confirm file ids: ${missingFileIds.join(", ")}.`);
+        }
         return compactJsonObject({
             provider: "slack",
             mode: "files.completeUploadExternal",
             channel: target.channel,
             threadTs: target.threadTs,
-            uploadedFiles,
-            slackFiles: arrayValue(result.files),
+            messageCount: response ? 1 : 0,
+            uploadedFiles: uploadResult.uploaded,
+            slackFiles,
             idempotencyKey: delivery.idempotencyKey
         });
     }
-    const result = await slackApi(ctx, "chat.postMessage", compactJsonObject({
-        channel: target.channel,
-        thread_ts: target.threadTs,
-        text: delivery.response
-    }));
+    const messageResults = await postSlackResponse(response, target.channel, target.threadTs, ctx, teamId);
+    return slackTextDeliveryMetadata(target.channel, target.threadTs, delivery.idempotencyKey, messageResults);
+}
+async function postSlackResponse(response, channel, threadTs, ctx, teamId) {
+    const markdownChunks = splitSlackMarkdown(response);
+    const messageResults = [];
+    for (const [index, markdownText] of markdownChunks.entries()) {
+        try {
+            messageResults.push(await slackApi(ctx, "chat.postMessage", compactJsonObject({
+                channel,
+                thread_ts: threadTs,
+                markdown_text: markdownText
+            }), teamId));
+        }
+        catch (error) {
+            throw slackPhaseError(`Slack text delivery failed for message ${index + 1}/${markdownChunks.length}`, error);
+        }
+    }
+    return messageResults;
+}
+function slackMessageTimestamps(messageResults) {
+    return messageResults
+        .map((result) => stringValue(result.ts))
+        .filter((value) => value !== undefined);
+}
+function slackTextDeliveryMetadata(channel, threadTs, idempotencyKey, messageResults) {
     return compactJsonObject({
         provider: "slack",
-        channel: target.channel,
-        threadTs: target.threadTs,
-        slackTs: stringValue(result.ts),
-        idempotencyKey: delivery.idempotencyKey
+        mode: "chat.postMessage",
+        channel,
+        threadTs,
+        slackMessageTs: slackMessageTimestamps(messageResults),
+        messageCount: messageResults.length,
+        idempotencyKey
     });
 }
 /**
@@ -189,12 +268,13 @@ export async function resolveAttachment(attachment, ctx) {
         return undefined;
     if (!isSlackUrl(url))
         throw new Error("Slack attachment download URL host is not allowed.");
-    return slackAttachmentRequest(url, slackAuthHeaders(ctx.env), stringValue(attachment.filename) ?? stringValue(attachment.name));
+    return slackAttachmentRequest(url, slackAuthHeaders(ctx.env, stringValue(attachment.slackTeamId)), stringValue(attachment.filename) ?? stringValue(attachment.name));
 }
 async function slackAttachmentDownload(attachment, ctx) {
     if (!isSlackAttachment(attachment))
         return undefined;
-    const headers = slackAuthHeaders(ctx.env);
+    const teamId = stringValue(attachment.slackTeamId);
+    const headers = slackAuthHeaders(ctx.env, teamId);
     const remote = recordValue(attachment.remote);
     const download = recordValue(attachment.download);
     const directUrl = firstDownloadableUrl([
@@ -215,7 +295,7 @@ async function slackAttachmentDownload(attachment, ctx) {
         return slackAttachmentRequest(directUrl, headers, filename);
     }
     const fileId = slackFileIdFromAttachment(attachment);
-    if (!fileId || !slackDownloadToken(ctx.env))
+    if (!fileId || !slackDownloadToken(ctx.env, teamId))
         return undefined;
     const response = await fetchWithPolicy(ctx.fetch, `https://slack.com/api/files.info?file=${encodeURIComponent(fileId)}`, { headers }, {
         timeoutMs: attachmentFetchTimeoutMs(ctx.env)
@@ -269,12 +349,12 @@ function slackFileIdFromAttachment(attachment) {
         return id;
     return undefined;
 }
-function slackAuthHeaders(env) {
-    const token = slackDownloadToken(env);
+function slackAuthHeaders(env, teamId) {
+    const token = slackDownloadToken(env, teamId);
     return token ? { authorization: `Bearer ${token}` } : {};
 }
-function slackDownloadToken(env) {
-    return env.SLACK_BOT_TOKEN ?? env.SLACK_USER_TOKEN;
+function slackDownloadToken(env, teamId) {
+    return slackWorkspaceCredentials(env, teamId).botToken;
 }
 function isSlackUrl(value) {
     if (!value)
@@ -287,33 +367,59 @@ function isSlackUrl(value) {
         return false;
     }
 }
-async function uploadSlackDeliveryFiles(delivery, ctx, _target) {
-    const files = slackDeliveryFiles(delivery.payload).slice(0, SLACK_DELIVERY_FILE_MAX_COUNT);
+async function uploadSlackDeliveryFiles(files, ctx, teamId) {
     const uploaded = [];
+    const failures = [];
     for (const file of files) {
-        const bytes = await deliveryFileBytes(file, ctx);
-        if (!bytes || bytes.byteLength === 0)
-            continue;
         const filename = stringValue(file.filename) ?? stringValue(file.name) ?? filenameFromPath(stringValue(file.path)) ?? "artifact";
+        let bytes;
+        try {
+            bytes = await deliveryFileBytes(file, ctx);
+        }
+        catch (error) {
+            failures.push(slackAttachmentFailure(filename, "read", error));
+            continue;
+        }
+        if (!bytes || bytes.byteLength === 0) {
+            failures.push(slackAttachmentFailure(filename, "read", new Error("Slack delivery file was empty or unavailable.")));
+            continue;
+        }
         const contentType = stringValue(file.contentType) ?? stringValue(file.mimeType) ?? "application/octet-stream";
-        const ticket = await slackApi(ctx, "files.getUploadURLExternal", {
-            filename,
-            length: bytes.byteLength
-        });
+        let ticket;
+        try {
+            ticket = await slackApi(ctx, "files.getUploadURLExternal", {
+                filename,
+                length: bytes.byteLength
+            }, teamId, { encoding: "form" });
+        }
+        catch (error) {
+            failures.push(slackAttachmentFailure(filename, "ticket", error));
+            continue;
+        }
         const uploadUrl = stringValue(ticket.upload_url);
         const fileId = stringValue(ticket.file_id);
-        if (!uploadUrl || !fileId)
-            throw new Error("Slack file upload URL response was missing upload_url or file_id.");
-        const response = await fetchWithPolicy(ctx.fetch, uploadUrl, {
-            method: "POST",
-            headers: {
-                "content-type": contentType,
-                "content-length": String(bytes.byteLength)
-            },
-            body: bytes
-        });
-        if (!response.ok)
-            throw new Error(`Slack file upload failed with ${response.status}.`);
+        if (!uploadUrl || !fileId) {
+            failures.push(slackAttachmentFailure(filename, "ticket", new Error("Slack file upload URL response was missing upload_url or file_id.")));
+            continue;
+        }
+        let response;
+        try {
+            response = await fetchWithPolicy(ctx.fetch, uploadUrl, {
+                method: "POST",
+                headers: {
+                    "content-type": contentType
+                },
+                body: bytes
+            });
+        }
+        catch (error) {
+            failures.push(slackAttachmentFailure(filename, "upload", error));
+            continue;
+        }
+        if (!response.ok) {
+            failures.push(slackAttachmentFailure(filename, "upload", new Error(`Slack file upload failed with ${response.status}.`)));
+            continue;
+        }
         uploaded.push(compactJsonObject({
             id: fileId,
             title: stringValue(file.title) ?? filename,
@@ -324,7 +430,27 @@ async function uploadSlackDeliveryFiles(delivery, ctx, _target) {
             blobKey: stringValue(file.blobKey)
         }));
     }
-    return uploaded;
+    return { uploaded, failures };
+}
+function slackAttachmentFailure(filename, phase, error) {
+    return {
+        filename,
+        phase,
+        error: errorDetail(error)
+    };
+}
+function slackAttachmentFailuresError(failures) {
+    const detail = failures.map((failure) => {
+        const filename = stringValue(failure.filename) ?? "artifact";
+        const phase = stringValue(failure.phase) ?? "upload";
+        const error = stringValue(failure.error) ?? "unknown error";
+        return `${filename} (${phase}): ${error}`;
+    }).join("; ");
+    return new Error(`Slack file delivery failed: ${detail}`);
+}
+function slackPhaseError(message, error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return new Error(`${message}: ${detail}`, { cause: error });
 }
 function slackDeliveryFiles(payload) {
     const seen = new Set();
@@ -389,6 +515,8 @@ function slackTurnFromEvent(event, payload, eventId, ctx) {
     const text = slackMessageText(event);
     if (!userId || !channelId || !messageTs)
         return undefined;
+    if (stringValue(event.bot_id) || stringValue(recordValue(event.bot_profile)?.id))
+        return undefined;
     const channelType = stringValue(event.channel_type);
     const surface = slackSurface(event, ctx.env);
     if (!surface)
@@ -397,6 +525,15 @@ function slackTurnFromEvent(event, payload, eventId, ctx) {
     const threadRootTs = eventThreadTs ?? messageTs;
     const deliveryThreadTs = surface === "dm" ? eventThreadTs : threadRootTs;
     const conversationId = slackConversationId(surface, scope, channelId, threadRootTs, userId);
+    const source = slackMessageSource({
+        scope,
+        channelId,
+        threadId: threadRootTs,
+        messageId: messageTs,
+        authorId: userId,
+        channelType,
+        observedAt: slackTimestampToIso(messageTs)
+    });
     const delivery = compactJsonObject({
         provider: "slack",
         channel: channelId,
@@ -407,16 +544,20 @@ function slackTurnFromEvent(event, payload, eventId, ctx) {
         eventId,
         surface
     });
+    const principal = slackPrincipal(userId, teamId, enterpriseId);
     return {
         eventId,
         channel: ctx.channel.name,
         conversationId,
         userId,
+        principal,
+        initiator: principal,
         message: text,
-        attachments: slackAttachments(event),
+        attachments: slackAttachments(event, teamId),
         delivery,
         metadata: {
             provider: "slack",
+            source,
             slack: compactJsonObject({
                 eventId,
                 eventType,
@@ -432,6 +573,89 @@ function slackTurnFromEvent(event, payload, eventId, ctx) {
         }
     };
 }
+function slackObservationFromEvent(event, payload, eventId, ctx) {
+    if (stringValue(event.type) !== "message")
+        return undefined;
+    const channelType = stringValue(event.channel_type) ?? "channel";
+    if (channelType === "im")
+        return undefined;
+    const subtype = stringValue(event.subtype);
+    const changedMessage = subtype === "message_changed" ? recordValue(event.message) : undefined;
+    const previousMessage = recordValue(event.previous_message);
+    const messageEvent = changedMessage ?? previousMessage ?? event;
+    const channelId = stringValue(event.channel) ?? stringValue(messageEvent.channel);
+    const messageTs = subtype === "message_deleted"
+        ? stringValue(event.deleted_ts) ?? stringValue(previousMessage?.ts)
+        : stringValue(messageEvent.ts) ?? stringValue(event.ts);
+    const userId = stringValue(messageEvent.user) ?? stringValue(previousMessage?.user) ?? stringValue(event.user) ??
+        stringValue(messageEvent.bot_id) ?? stringValue(previousMessage?.bot_id) ?? stringValue(event.bot_id);
+    if (!channelId || !messageTs)
+        return undefined;
+    const teamId = slackTeamId(event, payload);
+    const enterpriseId = slackEnterpriseId(event, payload);
+    const scope = enterpriseId ?? teamId ?? "unknown";
+    const threadRootTs = stringValue(messageEvent.thread_ts) ?? stringValue(previousMessage?.thread_ts) ?? messageTs;
+    const edited = recordValue(messageEvent.edited);
+    const deletedAt = subtype === "message_deleted"
+        ? slackTimestampToIso(stringValue(event.event_ts) ?? messageTs)
+        : undefined;
+    const source = slackMessageSource({
+        scope,
+        channelId,
+        threadId: threadRootTs,
+        messageId: messageTs,
+        authorId: userId,
+        channelType,
+        observedAt: slackTimestampToIso(stringValue(event.event_ts) ?? messageTs),
+        editedAt: slackTimestampToIso(stringValue(edited?.ts)),
+        deletedAt
+    });
+    const observation = {
+        eventId,
+        conversationId: slackConversationId("channel", scope, channelId, threadRootTs, userId ?? "unknown"),
+        messageId: externalSlackMessageId(scope, channelId, messageTs),
+        message: deletedAt ? "" : slackMessageText(messageEvent),
+        source,
+        attachments: deletedAt ? [] : slackAttachments(messageEvent, teamId),
+        metadata: {
+            provider: "slack",
+            source,
+            slack: compactJsonObject({
+                eventId,
+                eventType: "message",
+                subtype,
+                teamId,
+                enterpriseId,
+                channel: channelId,
+                channelType,
+                ts: messageTs,
+                threadTs: threadRootTs,
+                userId,
+                surface: "channel"
+            })
+        }
+    };
+    const createdAt = slackTimestampToIso(messageTs);
+    if (createdAt)
+        observation.createdAt = createdAt;
+    return observation;
+}
+function slackPrincipal(userId, teamId, enterpriseId) {
+    const attributes = {
+        provider: "slack",
+        slackUserId: userId
+    };
+    if (teamId)
+        attributes.slackTeamId = teamId;
+    if (enterpriseId)
+        attributes.slackEnterpriseId = enterpriseId;
+    return {
+        type: "user",
+        id: userId,
+        issuer: `slack:${enterpriseId ?? teamId ?? "unknown"}`,
+        attributes
+    };
+}
 function slackSurface(event, env) {
     const eventType = stringValue(event.type);
     if (eventType === "app_mention")
@@ -444,110 +668,63 @@ function slackSurface(event, env) {
         return "assistant";
     return "dm";
 }
-function slackConversationId(surface, scope, channelId, threadTs, userId) {
-    if (surface === "channel")
-        return `slack:${scope}:channel:${channelId}:thread:${threadTs}`;
-    if (surface === "assistant")
-        return `slack:${scope}:assistant:${channelId}:thread:${threadTs}`;
-    return `slack:${scope}:dm:${channelId}:user:${userId}`;
-}
-function ignoredEventReason(event, env) {
+function ignoredEventReason(event, payload, env, teamId) {
     const eventType = stringValue(event.type);
-    if (eventType === "assistant_thread_started" || eventType === "assistant_thread_context_changed")
+    if (eventType === "app_home_opened" || eventType === "app_context_changed")
         return eventType;
     if (eventType !== "app_mention" && eventType !== "message")
         return undefined;
     const subtype = stringValue(event.subtype);
-    if (subtype && subtype !== "file_share")
+    if (subtype && !["file_share", "bot_message", "message_changed", "message_deleted"].includes(subtype))
         return `message_subtype:${subtype}`;
-    if (stringValue(event.bot_id))
-        return "bot_message";
-    const botUserId = env.SLACK_BOT_USER_ID;
-    if (botUserId && stringValue(event.user) === botUserId)
+    const nestedMessage = recordValue(event.message) ?? recordValue(event.previous_message);
+    const botUserId = slackWorkspaceCredentials(env, teamId).botUserId;
+    if (botUserId && (stringValue(event.user) === botUserId || stringValue(nestedMessage?.user) === botUserId))
+        return "self_message";
+    const botProfile = recordValue(event.bot_profile) ?? recordValue(nestedMessage?.bot_profile);
+    const eventAppId = stringValue(event.app_id) ?? stringValue(nestedMessage?.app_id) ?? stringValue(botProfile?.app_id);
+    if (eventAppId && eventAppId === stringValue(payload.api_app_id))
         return "self_message";
+    const channelType = stringValue(event.channel_type);
+    if (channelType === "im" && (subtype === "message_changed" || subtype === "message_deleted")) {
+        return `message_subtype:${subtype}`;
+    }
+    if (channelType === "im" && (subtype === "bot_message" || stringValue(event.bot_id) || stringValue(nestedMessage?.bot_id)))
+        return "bot_message";
     return undefined;
 }
 function ignored(reason, metadata = {}) {
     return { kind: "ignored", status: 200, body: { ok: true, ignored: true, reason, ...metadata } };
 }
-async function summarizeConversation(ctx, conversation) {
-    const messages = await ctx.state.listRecentMessages(conversation.id, 8);
-    const latestUser = latestText(messages, "user");
-    const latestAssistant = latestText(messages, "assistant");
-    const slack = recordValue(conversation.metadata.slack);
-    return compactJsonObject({
-        conversationId: conversation.id,
-        updatedAt: conversation.updatedAt,
-        surface: stringValue(slack?.surface),
-        channelId: stringValue(slack?.channel),
-        threadTs: stringValue(slack?.threadTs),
-        latestUser,
-        latestAssistant
-    });
-}
-function latestText(messages, role) {
-    const message = [...messages].reverse().find((candidate) => candidate.role === role);
-    const text = typeof message?.content.text === "string" ? message.content.text : undefined;
-    return text ? truncate(text, SLACK_SUMMARY_MAX_CHARS) : undefined;
-}
-function messageHistoryLine(message) {
-    const text = typeof message.content.text === "string" ? message.content.text : JSON.stringify(message.content);
-    return `${message.role}: ${text}`;
-}
 function slackDeliveryTarget(turn, payload) {
     const target = recordValue(turn?.delivery) ?? recordValue(payload?.delivery);
     const out = {};
     const channel = stringValue(target?.channel);
     const threadTs = stringValue(target?.threadTs) ?? stringValue(target?.thread_ts);
+    const messageTs = stringValue(target?.ts);
     if (channel)
         out.channel = channel;
     if (threadTs)
         out.threadTs = threadTs;
+    if (messageTs)
+        out.messageTs = messageTs;
     return out;
 }
-async function slackApi(ctx, method, body) {
-    const token = ctx.env.SLACK_BOT_TOKEN;
-    if (!token)
-        throw new Error("Slack API call requires SLACK_BOT_TOKEN.");
-    // fetchWithPolicy adds per-attempt timeouts and honors Slack's 429 Retry-After header before retrying.
-    const response = await fetchWithPolicy(ctx.fetch, `https://slack.com/api/${method}`, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${token}`,
-            "content-type": "application/json; charset=utf-8"
-        },
-        body: JSON.stringify(body)
-    });
-    const json = await response.json().catch(() => ({}));
-    const result = recordValue(json) ?? {};
-    if (!response.ok || result.ok === false) {
-        const error = stringValue(result.error) ?? `Slack API ${method} failed with ${response.status}`;
-        throw new Error(error);
-    }
-    return result;
-}
-function slackMessageText(event) {
-    return stringValue(event.text)?.trim() ?? "";
+function slackTeamIdForTurn(turn, payload) {
+    const metadata = recordValue(turn?.metadata?.slack);
+    const delivery = recordValue(turn?.delivery) ?? recordValue(payload?.delivery);
+    return stringValue(metadata?.teamId) ?? stringValue(delivery?.teamId) ?? stringValue(payload?.teamId);
 }
-function slackAttachments(event) {
-    const files = Array.isArray(event.files) ? event.files.filter(isJsonObject) : [];
-    return files.map((file) => compactJsonObject({
-        provider: "slack",
-        fileId: stringValue(file.id),
-        slackFileId: stringValue(file.id),
-        filename: stringValue(file.name) ?? stringValue(file.title),
-        title: stringValue(file.title),
-        contentType: stringValue(file.mimetype),
-        size: numberValue(file.size),
-        url: stringValue(file.url_private_download) ?? stringValue(file.url_private),
-        remote: compactJsonObject({
-            provider: "slack",
-            auth: "slack",
-            trusted: true,
-            fileId: stringValue(file.id),
-            url: stringValue(file.url_private_download) ?? stringValue(file.url_private)
-        })
-    }));
+const SLACK_BROADCAST_PATTERN = /<!(here|channel|everyone)(?:\|[^>]*)?>/giu;
+/**
+ * Neutralize broadcast commands in outbound text. Inbound `<!here>` /
+ * `<!channel>` / `<!everyone>` pass through to the agent verbatim, so an
+ * agent that quotes user input could otherwise ping the whole channel.
+ * The plain-text forms (`@here`, …) render inert in a chat.postMessage
+ * `text` field; links and user mentions are left untouched.
+ */
+function neutralizeSlackBroadcasts(text) {
+    return text.replace(SLACK_BROADCAST_PATTERN, (_match, name) => `@${name.toLowerCase()}`);
 }
 function slackTeamId(event, payload) {
     return stringValue(event.team) ??
@@ -589,9 +766,6 @@ function isJsonObject(value) {
 function stringValue(value) {
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
-function numberValue(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
-}
 function arrayValue(value) {
     return Array.isArray(value) ? value.filter(isJsonValue) : undefined;
 }
@@ -610,9 +784,4 @@ function isTruthy(value) {
 function filenameFromPath(path) {
     return path?.split("/").filter(Boolean).at(-1);
 }
-function truncate(value, maxChars) {
-    if (value.length <= maxChars)
-        return value;
-    return `${value.slice(0, Math.max(0, maxChars - 1))}...`;
-}
 //# sourceMappingURL=index.js.map