@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/src/rbac/legacy-policy.ts

@@ -56,6 +56,20 @@ const leadOrOperatorOrUser: LegacyRule = {
     principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal),
 };
 
+const extensionWrite: LegacyRule = {
+  name: "extension-owner-or-elevated",
+  denyReason: "requires extension owner, lead agent, operator, or user authentication",
+  evaluate: (principal, resource) => {
+    if (leadOrOperatorOrUser.evaluate(principal, resource)) return true;
+    return (
+      principal.kind === "agent" &&
+      principal.agentId !== "" &&
+      resource?.kind === "extension" &&
+      (resource.extensionId === undefined || resource.createdByAgentId === principal.agentId)
+    );
+  },
+};
+
 // Deployment-only: agents cannot reset this through swarm_config.
 const extensionActivation: LegacyRule = {
   name: "extension-activation",
@@ -242,6 +256,6 @@ export const LEGACY_POLICY = {
   "script.api.update": leadOnly,
   "script.api.rotate": leadOnly,
   "script.api.delete": leadOnly,
-  "extension.write": leadOrOperatorOrUser,
+  "extension.write": extensionWrite,
   "extension.activate": extensionActivation,
 } as const satisfies Record<PermissionVerb, LegacyRule>;

package/src/rbac/types.ts

@@ -32,6 +32,8 @@ export type RbacResource =
   | { kind: "app"; appId: string }
   /** Skills, mcp-servers, memory entries, scripts. */
   | { kind: "owned"; ownerAgentId?: string | null; scope?: string }
+  /** An omitted extensionId denotes a new install; existing rows retain their creator. */
+  | { kind: "extension"; extensionId?: string; createdByAgentId?: string | null }
   | { kind: "none" };
 
 export type RbacDecision =

package/src/server.ts

@@ -9,6 +9,7 @@ import { registerGithubTaskReactions } from "./github/task-reactions";
 import { loadGlobalConfigsIntoEnv } from "./http/core";
 import { resolveTemplate } from "./prompts/resolver";
 import { isRbacEnabled } from "./rbac";
+import { getSlackConfiguration } from "./slack/config";
 import { registerAcceptSteerTool } from "./tools/accept-steer";
 import { registerAppDiffTool } from "./tools/app-diff";
 import { registerAppGetTool } from "./tools/app-get";
@@ -268,7 +269,12 @@ export function hasCapability(cap: CAPABILITIES_T): boolean {
 }
 
 export function getEnabledCapabilities(): CAPABILITIES_T[] {
-  return Array.from(getCapabilities());
+  const capabilities = Array.from(getCapabilities());
+  // Phase 1 has no HTTP receiver. Do not advertise usable Slack tools to
+  // workers when HTTP (or an invalid transport) was selected.
+  return getSlackConfiguration().mode === "socket"
+    ? capabilities
+    : capabilities.filter((capability) => capability !== "slack");
 }
 
 /**

package/src/slack/ack.ts

@@ -1,5 +1,5 @@
 import type { WebClient } from "@slack/web-api";
-import { getLogsByTaskIdChronological, getSlackTasksInThread } from "../be/db";
+import { getLogsByTaskIdChronological, getSlackTasksInThread, getTaskById } from "../be/db";
 import { recordSlackReactionInvalidName } from "../otel";
 import { type AgentTask, isTerminalTaskStatus } from "../types";
 import { scrubSecrets } from "../utils/secret-scrubber";
@@ -10,6 +10,7 @@ import {
   SLACK_REACTION_DEFAULTS,
   type SlackReactionEvent,
 } from "./reaction-shortcode";
+import { deferralWakes, isAwaitingWake } from "./task-output";
 
 export { reactionName, type SlackReactionEvent } from "./reaction-shortcode";
 
@@ -170,28 +171,62 @@ export async function finalizeSlackSteerReactions(
   }
 }
 
+// Deferral chains are short; the cap only guards against a parent cycle.
+const MAX_DEFERRAL_CHAIN_HOPS = 10;
+
+/**
+ * The Slack message a task answers. A deferral's wake-up does not inherit
+ * `slackTriggerMessageTs`, so walk its `parentTaskId` chain back to the task
+ * that deferred on the human's message.
+ */
+async function triggerMessageTs(task: AgentTask): Promise<string | undefined> {
+  let current: AgentTask | null = task;
+  for (let hop = 0; current && hop <= MAX_DEFERRAL_CHAIN_HOPS; hop++) {
+    if (current.slackTriggerMessageTs) return current.slackTriggerMessageTs;
+    if (current.taskType !== "deferred" || !current.parentTaskId) return undefined;
+    current = await getTaskById(current.parentTaskId);
+  }
+  return undefined;
+}
+
+/** The tasks answering `timestamp`, plus the wake-ups that continue them. */
+function tasksAnsweringTrigger(threadTasks: AgentTask[], timestamp: string): AgentTask[] {
+  const linked = threadTasks.filter((task) => task.slackTriggerMessageTs === timestamp);
+  for (let index = 0; index < linked.length; index++) {
+    for (const wake of deferralWakes(linked[index]!, threadTasks)) {
+      if (!linked.includes(wake)) linked.push(wake);
+    }
+  }
+  return linked;
+}
+
 export async function finalizeTerminalSlackReactions(tasks: AgentTask[]): Promise<void> {
   const app = getSlackApp();
   if (!app) return;
 
   const triggers = new Map<string, { channelId: string; threadTs: string; timestamp: string }>();
   for (const task of tasks) {
-    if (!task.slackChannelId || !task.slackThreadTs || !task.slackTriggerMessageTs) continue;
-    const key = `${task.slackChannelId}\0${task.slackTriggerMessageTs}`;
+    if (!task.slackChannelId || !task.slackThreadTs) continue;
+    const timestamp = await triggerMessageTs(task);
+    if (!timestamp) continue;
+    const key = `${task.slackChannelId}\0${timestamp}`;
     triggers.set(key, {
       channelId: task.slackChannelId,
       threadTs: task.slackThreadTs,
-      timestamp: task.slackTriggerMessageTs,
+      timestamp,
     });
   }
 
   for (const { channelId, threadTs, timestamp } of triggers.values()) {
-    const linkedTasks = (await getSlackTasksInThread(channelId, threadTs)).filter(
-      (task) => task.slackTriggerMessageTs === timestamp,
-    );
+    const threadTasks = await getSlackTasksInThread(channelId, threadTs);
+    const linkedTasks = tasksAnsweringTrigger(threadTasks, timestamp);
+    // A parked deferral is stored `completed`, but the message is not
+    // answered yet: keep 👀 until its wake-up settles.
     if (
       linkedTasks.length === 0 ||
-      linkedTasks.some((task) => !isTerminalTaskStatus(task.status))
+      linkedTasks.some(
+        (task) => !isTerminalTaskStatus(task.status) || isAwaitingWake(task, threadTasks),
+      )
     ) {
       continue;
     }

package/src/slack/app.ts

@@ -1,5 +1,6 @@
 import { App, LogLevel } from "@slack/bolt";
 import { emitBuiltInIntegrationConnectedOnce, ensureSlackRenderV2Activation } from "../be/db";
+import { getSlackConfiguration } from "./config";
 import { getSlackSocketModeBlockReason, SLACK_DEV_SOCKET_MODE_OPT_IN } from "./socket-mode-guard";
 import { startTaskWatcher, stopTaskWatcher } from "./watcher";
 
@@ -16,23 +17,38 @@ export async function initSlackApp(): Promise<App | null> {
     console.log("[Slack] Already initialized, skipping");
     return app;
   }
-  initialized = true;
-
-  // Check if Slack is explicitly disabled
-  const slackDisable = process.env.SLACK_DISABLE;
-  if (slackDisable === "true" || slackDisable === "1") {
+  const config = getSlackConfiguration();
+  if (config.disabled) {
     console.log("[Slack] Disabled via SLACK_DISABLE");
     return null;
   }
 
-  const botToken = process.env.SLACK_BOT_TOKEN;
-  const appToken = process.env.SLACK_APP_TOKEN;
+  if (!config.mode) {
+    console.error(
+      "[Slack] Invalid SLACK_MODE; expected socket or http. Slack integration disabled",
+    );
+    return null;
+  }
+
+  if (config.missingCredentials.length > 0) {
+    console.log(
+      `[Slack] Missing ${config.missingCredentials.join(" or ")} for ${config.mode} mode, Slack integration disabled`,
+    );
+    return null;
+  }
 
-  if (!botToken || !appToken) {
-    console.log("[Slack] Missing SLACK_BOT_TOKEN or SLACK_APP_TOKEN, Slack integration disabled");
+  // Phase 1 establishes the transport contract only. Never fall back to a
+  // socket when HTTP was explicitly selected; the receiver lands in Phase 3.
+  if (config.mode === "http") {
+    console.error(
+      "[Slack] HTTP mode is configured but unavailable until the HTTP receiver is installed",
+    );
     return null;
   }
 
+  const botToken = process.env.SLACK_BOT_TOKEN as string;
+  const appToken = process.env.SLACK_APP_TOKEN as string;
+
   const socketModeBlockReason = getSlackSocketModeBlockReason(process.env);
   if (socketModeBlockReason) {
     console.error(
@@ -51,6 +67,9 @@ export async function initSlackApp(): Promise<App | null> {
     ...(slackApiUrl ? { clientOptions: { slackApiUrl } } : {}),
   });
 
+  // Failed validation must remain retryable without requiring stopSlackApp().
+  initialized = true;
+
   // Register handlers
   const { registerMessageHandler } = await import("./handlers");
   const { registerCommandHandler } = await import("./commands");
@@ -69,7 +88,7 @@ export async function initSlackApp(): Promise<App | null> {
   return app;
 }
 
-export async function startSlackApp(): Promise<void> {
+export async function startSlackApp(): Promise<boolean> {
   if (!app) {
     await initSlackApp();
   }
@@ -84,7 +103,10 @@ export async function startSlackApp(): Promise<void> {
 
     // Start watching for task completions
     await startTaskWatcher();
+    return true;
   }
+
+  return false;
 }
 
 export async function stopSlackApp(): Promise<void> {

package/src/slack/config.ts

@@ -0,0 +1,29 @@
+export const SLACK_MODES = ["socket", "http"] as const;
+export type SlackMode = (typeof SLACK_MODES)[number];
+
+export type SlackConfiguration = {
+  disabled: boolean;
+  mode: SlackMode | null;
+  missingCredentials: string[];
+};
+
+/** Resolve Slack transport and credential presence without exposing credential values. */
+export function getSlackConfiguration(env: NodeJS.ProcessEnv = process.env): SlackConfiguration {
+  const rawMode = env.SLACK_MODE === undefined ? "socket" : env.SLACK_MODE.trim();
+  const mode = SLACK_MODES.includes(rawMode as SlackMode) ? (rawMode as SlackMode) : null;
+  const missingCredentials = ["SLACK_BOT_TOKEN"];
+
+  if (mode === "socket") missingCredentials.push("SLACK_APP_TOKEN");
+  if (mode === "http") missingCredentials.push("SLACK_SIGNING_SECRET");
+
+  return {
+    disabled: env.SLACK_DISABLE === "true" || env.SLACK_DISABLE === "1",
+    mode,
+    missingCredentials: missingCredentials.filter((key) => !env[key]?.trim()),
+  };
+}
+
+export function isSlackConfigured(env: NodeJS.ProcessEnv = process.env): boolean {
+  const config = getSlackConfiguration(env);
+  return !config.disabled && config.mode !== null && config.missingCredentials.length === 0;
+}

package/src/slack/handlers.ts

@@ -8,6 +8,7 @@ import {
   getLeadAgent,
   getMostRecentTaskInThread,
   getTasksByAgentId,
+  isExtensionAgent,
 } from "../be/db";
 import { dispatchPre } from "../extensions/dispatcher";
 import { resolveTemplate } from "../prompts/resolver";
@@ -621,7 +622,12 @@ export function registerMessageHandler(app: App): void {
       const { target } = routeResult.data;
       if (target.kind === "agent") {
         const agent = await getAgentById(target.agentId);
-        if (agent) {
+        if (agent && isExtensionAgent(agent)) {
+          console.warn(
+            "[Slack] Extension selected an extension-identity agent. Using the built-in router:",
+            scrubSecrets(target.agentId),
+          );
+        } else if (agent) {
           matches = [{ agent, matchedText: "extension" }];
         } else {
           console.warn(

package/src/slack/render-v2.ts

@@ -8,6 +8,7 @@ import {
   ensureSlackDelegationActivation,
   ensureSlackRenderV2Activation,
   getAgentById,
+  getResolvableDeferralOutcomes,
   getSlackOutcomeMessage,
   getSlackTasksInThread,
   getSlackTasksMissingTree,
@@ -17,6 +18,7 @@ import {
   getTaskAttachments,
   getTaskById,
   isPendingSlackMessage,
+  markSlackDeferralResolved,
   markSlackTreeRendered,
   reserveSlackMessage,
   type SlackConclusionKind,
@@ -44,7 +46,7 @@ import {
 import { buildAskClosure, type ClosureState, closureState } from "./closure";
 import { reactionName, type SlackReactionEvent } from "./reaction-shortcode";
 import { getAgentDisplayName, getAgentEmoji } from "./responses";
-import { isSlackEtaOnlyNotice, slackTaskOutput } from "./task-output";
+import { isAwaitingWake, isDeferredTask, slackTaskOutput } from "./task-output";
 
 const TREE_UPDATE_DEBOUNCE_MS = 500;
 const TREE_UPDATE_MIN_INTERVAL_MS = 3_000;
@@ -219,8 +221,16 @@ function isStalledMember(task: AgentTask, now: Date): boolean {
  * Blocked detection reuses `checkDependencies` — the same source `get-tasks`
  * `readyOnly` uses — rather than re-deriving it from the tree's own task list,
  * since a dependency can point outside the current Slack thread.
+ *
+ * A deferral reads ⏳ only while it is parked: once its wake-up settles in
+ * `threadTasks`, it falls through to the `completed` it is stored as.
  */
-async function taskStateGlyph(task: AgentTask, now: Date): Promise<string> {
+async function taskStateGlyph(
+  task: AgentTask,
+  now: Date,
+  threadTasks: readonly AgentTask[] = [],
+): Promise<string> {
+  if (isAwaitingWake(task, threadTasks)) return "⏳";
   switch (task.status) {
     case "backlog":
     case "unassigned":
@@ -335,6 +345,7 @@ async function renderNodeLines(
   depth: number,
   now: Date,
   isAsk: boolean,
+  threadTasks: readonly AgentTask[],
 ): Promise<string[]> {
   const duration = formatV2Duration(new Date(node.task.createdAt), terminalEnd(node.task, now));
   const indent = FIGURE_SPACE.repeat(
@@ -344,7 +355,7 @@ async function renderNodeLines(
     indent.length > MAX_TREE_PREFIX_LENGTH
       ? `${indent.slice(0, MAX_TREE_PREFIX_LENGTH - 1)}…`
       : indent;
-  let line = `${boundedPrefix}↳ ${await taskStateGlyph(node.task, now)} ${await renderNodeLabel(node, isAsk)} · ${duration} · ${getTaskLink(node.task.id)}`;
+  let line = `${boundedPrefix}↳ ${await taskStateGlyph(node.task, now, threadTasks)} ${await renderNodeLabel(node, isAsk)} · ${duration} · ${getTaskLink(node.task.id)}`;
   const progress = renderProgress(node.task.progress);
   const suffix = isTerminalTreeStatus(node.task.status) ? "" : progress ? ` · ${progress}` : "";
   if (suffix && line.length + suffix.length <= MAX_TREE_NODE_LINE_LENGTH) {
@@ -355,7 +366,7 @@ async function renderNodeLines(
   }
   const lines = [line];
   for (const child of node.children) {
-    lines.push(...(await renderNodeLines(child, depth + 1, now, false)));
+    lines.push(...(await renderNodeLines(child, depth + 1, now, false, threadTasks)));
   }
   return lines;
 }
@@ -382,6 +393,8 @@ function threadHeaderText(tasks: AgentTask[], now: Date, duration: string): stri
   if (tasks.some((task) => isStalledMember(task, now))) return `🧵 ⚠️ stalled — ${duration}`;
   if (tasks.some((task) => !isTerminalTreeStatus(task.status)))
     return `🧵 🔄 working — ${duration}`;
+  // A parked deferral is stored `completed`, but the ask is not answered yet.
+  if (tasks.some((task) => isAwaitingWake(task, tasks))) return `🧵 ⏳ waiting — ${duration}`;
   const hasFailure = tasks.some((task) => task.status === "failed");
   return hasFailure ? `🧵 ❌ done with failures — ${duration}` : `🧵 ✅ done — ${duration}`;
 }
@@ -406,7 +419,7 @@ export async function renderThreadTree(
   const lines = [threadHeaderText(tasks, now, threadDuration)];
   const roots = buildRenderForest(tasks);
   for (const root of roots) {
-    lines.push(...(await renderNodeLines(root, 1, now, root.task.source === "slack")));
+    lines.push(...(await renderNodeLines(root, 1, now, root.task.source === "slack", tasks)));
   }
   const text = normalizeV2Text(lines.join("\n"));
   if (text.length <= MAX_SECTION_LENGTH) return text;
@@ -416,7 +429,7 @@ export async function renderThreadTree(
   for (let index = tasks.length - 1; index >= 0; index--) {
     const task = tasks[index]!;
     const recentLine = (
-      await renderNodeLines({ task, children: [] }, 1, now, task.source === "slack")
+      await renderNodeLines({ task, children: [] }, 1, now, task.source === "slack", tasks)
     )[0]!;
     const candidateLines = [recentLine, ...recentLines];
     const omitted = index;
@@ -741,24 +754,52 @@ function outcomeText(value: string | null | undefined, fallback: string): string
   return value?.trim() ? value : fallback;
 }
 
+// Markdown that only parses at the start of a line: a code fence, a list
+// item, a blockquote, a heading, a table row, a thematic break, or an
+// indented code block. Put after the status icon, it would render as literal
+// text, so the body keeps its own line.
+const LINE_START_BLOCK =
+  /^(?:`{3}|~{3}|[-*+]\s|\d+[.)]\s|>|#{1,6}\s|\||(?:-{3,}|\*{3,}|_{3,})[ \t]*(?:\r?\n|$)|(?: {4}|\t))/;
+
+/**
+ * `✅ The build passed.` — the status icon (and label, when there is one)
+ * opens the body's first line instead of standing alone above it. A body
+ * that opens with a line-start construct (see `LINE_START_BLOCK`) keeps the
+ * blank line so its markdown still renders.
+ */
+export function withStatusLead(lead: string, body: string): string {
+  const text = body.replace(/^(?:[ \t]*\r?\n)+/, "");
+  if (LINE_START_BLOCK.test(text)) return `${lead}\n\n${body}`;
+  return `${lead} ${text.trimStart()}`;
+}
+
 async function outcomeContent(task: AgentTask, slackReplySent: boolean): Promise<string> {
   if (task.status === "failed") {
-    return `❌ **Failed**\n\n${outcomeText(task.failureReason, "Task failed.")}`;
+    return withStatusLead("❌ **Failed:**", outcomeText(task.failureReason, "Task failed."));
   }
   if (task.status === "cancelled") {
-    return `🚫 **Cancelled**\n\n${outcomeText(task.failureReason, "Task was cancelled.")}`;
+    return withStatusLead(
+      "🚫 **Cancelled:**",
+      outcomeText(task.failureReason, "Task was cancelled."),
+    );
   }
   // A deferral's output is engine-authored, never posted by hand via
   // slack-reply, so it must not collapse into the "agent completed" summary
   // even when the agent also sent a slack-reply earlier in the same task.
-  const isDeferred = task.tags?.includes("deferred");
+  const isDeferred = isDeferredTask(task);
   if (slackReplySent && task.status === "completed" && !isDeferred) {
     const agentName = task.agentId
       ? ((await getAgentById(task.agentId))?.name ?? "Agent")
       : "Agent";
     return `✅ ${agentName} completed`;
   }
-  return `✅\n\n${outcomeText(slackTaskOutput(task), "Task completed.")}`;
+  // A deferral is `completed` in the database but unfinished to a human: the
+  // work resumes in a wake-up task. Rendering it ✅ told the thread the ask
+  // was answered when it was only parked.
+  if (isDeferred) {
+    return withStatusLead("⏳", outcomeText(slackTaskOutput(task), "Deferred."));
+  }
+  return withStatusLead("✅", outcomeText(slackTaskOutput(task), "Task completed."));
 }
 
 async function agentDisplayNameFor(task: AgentTask): Promise<string> {
@@ -782,12 +823,24 @@ export async function childOutcomeContent(
 ): Promise<string> {
   const agentName = await agentDisplayNameFor(task);
   if (task.status === "failed") {
-    return `↳ ❌ ${agentName} — failed\n\n${outcomeText(task.failureReason, "Task failed.")}`;
+    return withStatusLead(
+      `↳ ❌ ${agentName} — failed:`,
+      outcomeText(task.failureReason, "Task failed."),
+    );
   }
-  if (slackReplySent && !task.tags?.includes("deferred")) {
+  if (slackReplySent && !isDeferredTask(task)) {
     return `↳ ✅ ${agentName} completed`;
   }
-  return `↳ ✅ ${agentName} — result\n\n${outcomeText(slackTaskOutput(task), "Task completed.")}`;
+  if (isDeferredTask(task)) {
+    return withStatusLead(
+      `↳ ⏳ ${agentName} — deferred:`,
+      outcomeText(slackTaskOutput(task), "Deferred."),
+    );
+  }
+  return withStatusLead(
+    `↳ ✅ ${agentName} — result:`,
+    outcomeText(slackTaskOutput(task), "Task completed."),
+  );
 }
 
 // A deferred wake continues a human conversation even though the scheduler
@@ -809,7 +862,6 @@ function isSlackContinuation(task: AgentTask): boolean {
  */
 function isChildCardCandidate(task: AgentTask, delegationActivatedAt: string): boolean {
   return (
-    !isSlackEtaOnlyNotice(task) &&
     task.source !== "slack" &&
     !isSlackContinuation(task) &&
     !!task.slackChannelId &&
@@ -823,7 +875,6 @@ function isChildCardCandidate(task: AgentTask, delegationActivatedAt: string): b
 
 function taskNeedsDirectOutcome(task: AgentTask, activatedAt: string): boolean {
   return (
-    !isSlackEtaOnlyNotice(task) &&
     ((task.source === "slack" && isAskOutcomeStatus(task.status)) ||
       (isSlackContinuation(task) && isOutcomeStatus(task.status))) &&
     task.createdAt >= activatedAt
@@ -842,7 +893,7 @@ async function conclusionResultsLines(closure: AgentTask[]): Promise<string[]> {
   const lines: string[] = [];
   for (const member of closure) {
     if (member.taskType === "follow-up" || member.taskType === "reroute-decision") continue;
-    if (!isOutcomeStatus(member.status) || isSlackEtaOnlyNotice(member)) continue;
+    if (!isOutcomeStatus(member.status)) continue;
     const glyph = await taskStateGlyph(member, new Date());
     const agentName = await agentDisplayNameFor(member);
     const card = await getSlackOutcomeMessage(member.id);
@@ -1212,6 +1263,119 @@ export async function streamOutcomeCard(
   });
 }
 
+/**
+ * The body a resolved deferral card is rewritten to. The ⏳ block promised
+ * the thread an answer; this is that promise being kept in place, instead of
+ * in a second card below it — `isAnsweredByDeferralCard` keeps the wake-up
+ * from posting one, so the answer lands in the thread exactly once. It is
+ * the card the wake-up would have posted, collapsed the same way when the
+ * wake-up already answered by hand with `slack-reply`.
+ *
+ * A wake-up that deferred again does post its own card — the next ⏳ in the
+ * chain, which its own wake-up resolves — so this card only points at it.
+ */
+async function resolvedDeferralContent(wake: AgentTask): Promise<string> {
+  if (!isDeferredTask(wake)) {
+    const content = await outcomeContent(wake, wake.slackReplySent);
+    return outcomePresentation(wake, content, attachmentLine(await getTaskAttachments(wake.id)));
+  }
+  const card = await getSlackOutcomeMessage(wake.id);
+  const pointer = card?.permalink ? ` — ${card.permalink}` : ".";
+  return `↪️ Resumed by ${await agentDisplayNameFor(wake)} and deferred again${pointer}`;
+}
+
+/**
+ * True when `task` is a wake-up whose answer goes into its deferral's ⏳ card
+ * (`refreshResolvedDeferralCards`), so it must not post an outcome card of
+ * its own. False — and the wake-up posts its own card as before — when it
+ * deferred again, when the deferral never got a card, and when the in-place
+ * rewrite was abandoned.
+ */
+async function isAnsweredByDeferralCard(
+  task: AgentTask,
+  threadTasks: readonly AgentTask[],
+): Promise<boolean> {
+  if (!isSlackContinuation(task) || !task.parentTaskId || isDeferredTask(task)) return false;
+  const deferred = threadTasks.find((candidate) => candidate.id === task.parentTaskId);
+  // Mirrors getResolvableDeferralOutcomes: only a `deferredAt` card is rewritten.
+  if (!deferred?.deferredAt) return false;
+  const card = await getSlackOutcomeMessage(deferred.id);
+  return !!card?.finalizedAt && !isPendingSlackMessage(card) && !card.deferralAbandonedAt;
+}
+
+/**
+ * `callSlackWithRetry` only ever retries rate limits, so any error that
+ * escapes it still carrying a Slack API error code is a verdict rather than a
+ * blip: `message_not_found`, `channel_not_found`, `cant_update_message` and
+ * `msg_too_long` all answer identically on the next tick.
+ */
+function isTerminalSlackError(error: unknown): boolean {
+  const code = (error as { data?: { error?: string } }).data?.error;
+  return typeof code === "string" && code.length > 0 && code !== "ratelimited";
+}
+
+// Everything else reaching the catch has no Slack verdict attached (a socket
+// reset, a DNS blip, a local read that threw), so it is worth retrying — but
+// only a bounded number of times. Without a ceiling a card that fails for a
+// reason we cannot classify is re-attempted at tick cadence forever.
+const DEFERRAL_REFRESH_MAX_ATTEMPTS = 5;
+const deferralRefreshAttempts = new Map<string, number>();
+
+/**
+ * Rewrite every ⏳ deferral card whose wake-up task has settled, in place.
+ *
+ * Runs after the tree loop and independently of it: resolution needs only
+ * the retained outcome `ts`, so it must not be skipped when the thread has
+ * no other pending render work. After, so a wake-up that deferred again has
+ * already posted the card this one points at. Each card is rewritten exactly
+ * once (`deferral_resolved_at`).
+ *
+ * The marker is also burned when Slack refuses the rewrite for good, and when
+ * an unclassifiable failure has used up its attempts — a card that can never
+ * be rewritten must stop competing for the per-tick row budget with cards
+ * that still can. Those are marked abandoned, so the wake-up's answer goes
+ * out in its own card on the next tick instead of being lost.
+ */
+export async function refreshResolvedDeferralCards(): Promise<void> {
+  const app = getSlackApp();
+  if (!app) return;
+  for (const { card, wakeTaskId } of await getResolvableDeferralOutcomes()) {
+    try {
+      const wake = await getTaskById(wakeTaskId);
+      if (!wake) continue;
+      const content = await resolvedDeferralContent(wake);
+      await callSlackWithRetry(app.client, "chat.update", {
+        channel: card.channelId,
+        ts: card.ts,
+        text: content,
+      });
+      await markSlackDeferralResolved(card.id);
+      deferralRefreshAttempts.delete(card.id);
+      // The rewrite is the wake-up's outcome, so it settles the ask's reaction.
+      await finalizeTerminalSlackReactions([wake]);
+    } catch (error) {
+      const attempts = (deferralRefreshAttempts.get(card.id) ?? 0) + 1;
+      deferralRefreshAttempts.set(card.id, attempts);
+      const terminal = isTerminalSlackError(error);
+      if (terminal || attempts >= DEFERRAL_REFRESH_MAX_ATTEMPTS) {
+        await markSlackDeferralResolved(card.id, { abandoned: true });
+        deferralRefreshAttempts.delete(card.id);
+        console.error(
+          `[Slack] Giving up on deferral card ${card.id} after ${attempts} attempt(s)` +
+            `${terminal ? " (Slack refused the rewrite)" : ""}:`,
+          error,
+        );
+        continue;
+      }
+      console.error(
+        `[Slack] Failed to resolve deferral card ${card.id} ` +
+          `(attempt ${attempts}/${DEFERRAL_REFRESH_MAX_ATTEMPTS}):`,
+        error,
+      );
+    }
+  }
+}
+
 export async function processSlackRenderV2(): Promise<void> {
   if (!isSlackRenderV2Enabled()) return;
   const activatedAt = await ensureSlackRenderV2Activation();
@@ -1270,7 +1434,9 @@ export async function processSlackRenderV2(): Promise<void> {
       // not represent immediately active outcome work, so avoid waking an old
       // tree solely to verify its permalink on every render tick.
       const isDirectCandidate =
-        taskNeedsDirectOutcome(task, activatedAt) && isOutcomeStatus(task.status);
+        taskNeedsDirectOutcome(task, activatedAt) &&
+        isOutcomeStatus(task.status) &&
+        !(await isAnsweredByDeferralCard(task, tasks));
       const isChildCandidate =
         delegationEnabled &&
         delegationActivatedAt !== null &&
@@ -1365,6 +1531,7 @@ export async function processSlackRenderV2(): Promise<void> {
       if (!isSlackRenderV2Enabled()) return;
       if (!taskNeedsDirectOutcome(task, activatedAt)) continue;
       if ((await getSlackOutcomeMessage(task.id))?.finalizedAt) continue;
+      if (await isAnsweredByDeferralCard(task, tasks)) continue;
       const deferByClosure =
         task.source === "slack" &&
         delegationEnabled &&
@@ -1444,6 +1611,8 @@ export async function processSlackRenderV2(): Promise<void> {
       console.error(`[Slack] Failed to update v2 tree ${tree.id}:`, error);
     }
   }
+
+  await refreshResolvedDeferralCards();
 }
 
 export function _resetSlackRenderV2ForTests(): void {

package/src/slack/responses.ts

@@ -15,7 +15,7 @@ import {
   markdownToSlack,
   splitSlackSectionText,
 } from "./blocks";
-import { isSlackEtaOnlyNotice, slackTaskOutput } from "./task-output";
+import { slackTaskOutput } from "./task-output";
 
 // Re-export for backward compatibility
 export { markdownToSlack } from "./blocks";
@@ -116,7 +116,6 @@ export async function sendInlineTaskOutput(task: AgentTask): Promise<boolean> {
  * Send a task completion message to Slack with the agent's persona.
  */
 export async function sendTaskResponse(task: AgentTask): Promise<boolean> {
-  if (isSlackEtaOnlyNotice(task)) return true;
   const app = getSlackApp();
   if (!app || !task.slackChannelId || !task.slackThreadTs) {
     return false;
@@ -287,7 +286,6 @@ export async function updateToFinal(
   task: AgentTask,
   messageTs: string,
 ): Promise<SlackUpdateResult> {
-  if (isSlackEtaOnlyNotice(task)) return "ok";
   const app = getSlackApp();
   if (!app || !task.slackChannelId || !task.agentId) return "failed";