@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/tests/slack-external-channel-egress.test.ts

@@ -0,0 +1,237 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { webApi } from "@slack/bolt";
+import {
+  invalidateChannelExternality,
+  recordExternalChannel,
+  resetExternalChannelStateForTesting,
+} from "../slack/external-channel";
+import {
+  EXTERNAL_CHANNEL_BLOCKED_CODE,
+  EXTERNAL_CHANNEL_UNVERIFIED_CODE,
+  installSlackExternalChannelGuard,
+} from "../slack/external-channel-egress";
+import { callSlackWithRetry, isTerminalSlackError } from "../slack/render-v2";
+import { sendWithPersona } from "../slack/responses";
+
+// The guard sits on WebClient.prototype, so these tests drive real clients
+// against a local mock Slack API and assert which calls reach the wire.
+
+const originalFlag = process.env.SLACK_BLOCK_EXTERNAL_CHANNELS;
+const CHANNEL = "C_EGRESS";
+
+type InfoMode = "internal" | "external" | "error";
+let infoMode: InfoMode = "internal";
+const wire: string[] = [];
+let server: ReturnType<typeof Bun.serve>;
+let baseUrl = "";
+
+beforeAll(() => {
+  installSlackExternalChannelGuard();
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const { pathname } = new URL(req.url);
+      if (pathname.startsWith("/upload/")) {
+        wire.push("upload");
+        return new Response("OK");
+      }
+      const method = pathname.replace(/^\/api\//, "");
+      wire.push(method);
+      if (method === "conversations.info") {
+        if (infoMode === "error") return Response.json({ ok: false, error: "missing_scope" });
+        return Response.json({
+          ok: true,
+          channel: { id: CHANNEL, is_ext_shared: infoMode === "external" },
+        });
+      }
+      if (method === "files.getUploadURLExternal") {
+        return Response.json({ ok: true, upload_url: `${baseUrl}upload/F1`, file_id: "F1" });
+      }
+      if (method === "files.completeUploadExternal") {
+        return Response.json({ ok: true, files: [{ id: "F1" }] });
+      }
+      return Response.json({ ok: true, ts: "1.000001", channel: CHANNEL });
+    },
+  });
+  baseUrl = `http://localhost:${server.port}/`;
+});
+
+afterAll(() => {
+  server.stop(true);
+  if (originalFlag === undefined) delete process.env.SLACK_BLOCK_EXTERNAL_CHANNELS;
+  else process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = originalFlag;
+});
+
+beforeEach(() => {
+  resetExternalChannelStateForTesting();
+  process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+  infoMode = "internal";
+});
+
+afterEach(() => {
+  wire.length = 0;
+});
+
+function client(): InstanceType<typeof webApi.WebClient> {
+  return new webApi.WebClient("xoxb-test", {
+    slackApiUrl: `${baseUrl}api/`,
+    retryConfig: { retries: 0 },
+  });
+}
+
+/** Every swarm output path a running task uses, each through a real client. */
+const writes: Array<[string, (c: InstanceType<typeof webApi.WebClient>) => Promise<unknown>]> = [
+  [
+    "persona reply (sendWithPersona)",
+    (c) =>
+      sendWithPersona(c, {
+        channel: CHANNEL,
+        thread_ts: "1.0",
+        text: "progress",
+        username: "Agent",
+        icon_emoji: ":robot_face:",
+      }),
+  ],
+  [
+    "progress edit (chat.update)",
+    (c) =>
+      c.chat.update({
+        channel: CHANNEL,
+        ts: "1.000001",
+        text: "edit",
+        unfurl_links: false,
+        unfurl_media: false,
+      }),
+  ],
+  [
+    "outcome stream (chat.startStream)",
+    (c) => callSlackWithRetry(c, "chat.startStream", { channel: CHANNEL, thread_ts: "1.0" }),
+  ],
+  [
+    "outcome card (chat.postMessage)",
+    (c) =>
+      callSlackWithRetry(c, "chat.postMessage", {
+        channel: CHANNEL,
+        text: "outcome",
+        unfurl_links: false,
+        unfurl_media: false,
+      }),
+  ],
+  [
+    "native status (assistant.threads.setStatus)",
+    (c) => c.assistant.threads.setStatus({ channel_id: CHANNEL, thread_ts: "1.0", status: "x" }),
+  ],
+  [
+    "file upload (filesUploadV2)",
+    (c) => c.filesUploadV2({ channel_id: CHANNEL, content: "report", filename: "r.txt" }),
+  ],
+];
+
+function sent(): string[] {
+  return wire.filter((method) => method !== "conversations.info");
+}
+
+describe("WebClient external-channel guard", () => {
+  test.each(writes)("%s: flag on + external channel never reaches Slack", async (_, write) => {
+    infoMode = "external";
+    const error = await write(client()).catch((e: unknown) => e);
+    expect((error as { data?: { error?: string } }).data?.error).toBe(
+      EXTERNAL_CHANNEL_BLOCKED_CODE,
+    );
+    expect(isTerminalSlackError(error)).toBe(true);
+    expect(sent()).toEqual([]);
+  });
+
+  test.each(writes)("%s: flag on + info failure never reaches Slack", async (_, write) => {
+    infoMode = "error";
+    const error = await write(client()).catch((e: unknown) => e);
+    expect((error as { data?: { error?: string } }).data?.error).toBe(
+      EXTERNAL_CHANNEL_UNVERIFIED_CODE,
+    );
+    expect(isTerminalSlackError(error)).toBe(false);
+    expect(sent()).toEqual([]);
+  });
+
+  test.each(writes)("%s: flag on + internal channel is delivered", async (_, write) => {
+    await write(client());
+    expect(sent().length).toBeGreaterThan(0);
+  });
+
+  test.each(writes)("%s: flag off makes no lookup", async (_, write) => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "false";
+    infoMode = "external";
+    await write(client());
+    expect(wire).not.toContain("conversations.info");
+    expect(sent().length).toBeGreaterThan(0);
+  });
+
+  test("a task already running in an external channel stops emitting once the flag is on", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "false";
+    infoMode = "external";
+    const c = client();
+    await c.chat.postMessage({
+      channel: CHANNEL,
+      text: "before",
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    expect(sent()).toEqual(["chat.postMessage"]);
+    wire.length = 0;
+
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    for (const [, write] of writes) await write(c).catch(() => {});
+    expect(sent()).toEqual([]);
+  });
+
+  test("a channel shared after a cached internal lookup stops emitting", async () => {
+    const c = client();
+    await c.chat.postMessage({
+      channel: CHANNEL,
+      text: "before share",
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    wire.length = 0;
+
+    // Envelope evidence of the share, with no fresh lookup.
+    recordExternalChannel(CHANNEL);
+    await expect(
+      c.chat.postMessage({
+        channel: CHANNEL,
+        text: "after",
+        unfurl_links: false,
+        unfurl_media: false,
+      }),
+    ).rejects.toThrow(EXTERNAL_CHANNEL_BLOCKED_CODE);
+    expect(sent()).toEqual([]);
+
+    // channel_shared event: the cache is invalidated and Slack now says external.
+    resetExternalChannelStateForTesting();
+    await c.chat.postMessage({
+      channel: CHANNEL,
+      text: "internal again",
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    infoMode = "external";
+    invalidateChannelExternality(CHANNEL);
+    wire.length = 0;
+    await expect(
+      c.chat.update({
+        channel: CHANNEL,
+        ts: "1.0",
+        text: "x",
+        unfurl_links: false,
+        unfurl_media: false,
+      }),
+    ).rejects.toThrow(EXTERNAL_CHANNEL_BLOCKED_CODE);
+    expect(sent()).toEqual([]);
+  });
+
+  test("a second install does not double-wrap", () => {
+    const proto = webApi.WebClient.prototype;
+    const before = proto.apiCall;
+    installSlackExternalChannelGuard();
+    expect(proto.apiCall).toBe(before);
+  });
+});

package/src/tests/slack-external-channel-guard.test.ts

@@ -0,0 +1,280 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlinkSync } from "node:fs";
+import { closeDb, createAgent, getSlackTasksInThread, initDb } from "../be/db";
+import { registerCommandHandler } from "../slack/commands";
+import {
+  EXTERNAL_CHANNEL_BLOCKED_REPLY,
+  resetExternalChannelStateForTesting,
+  shouldBlockChannel,
+} from "../slack/external-channel";
+import { registerMessageHandler, resetSlackHandlerCachesForTesting } from "../slack/handlers";
+
+const TEST_DB_PATH = "./test-slack-external-channel-guard.sqlite";
+const BOT_USER_ID = "U_EXT_GUARD_BOT";
+
+const previousEnv = {
+  SLACK_BLOCK_EXTERNAL_CHANNELS: process.env.SLACK_BLOCK_EXTERNAL_CHANNELS,
+  SLACK_RENDER_V2: process.env.SLACK_RENDER_V2,
+  ADDITIVE_SLACK: process.env.ADDITIVE_SLACK,
+  SLACK_ALERTS_CHANNEL: process.env.SLACK_ALERTS_CHANNEL,
+};
+
+type Handler = (args: Record<string, unknown>) => Promise<void>;
+const handlers = new Map<string, Handler>();
+
+let channelInfo: Record<string, unknown> = {};
+let infoCalls = 0;
+let infoFails = false;
+let leaveCalls: string[] = [];
+let alertPosts: string[] = [];
+
+const client = {
+  auth: { test: async () => ({ user_id: BOT_USER_ID, bot_id: "B_EXT_GUARD_BOT" }) },
+  conversations: {
+    info: async () => {
+      infoCalls++;
+      if (infoFails) throw new Error("An API error occurred: ratelimited");
+      return { ok: true, channel: channelInfo };
+    },
+    leave: async ({ channel }: { channel: string }) => {
+      leaveCalls.push(channel);
+      return { ok: true };
+    },
+    replies: async () => ({ ok: true, messages: [] }),
+  },
+  chat: {
+    postMessage: async ({ text }: { text: string }) => {
+      alertPosts.push(text);
+      return { ok: true, ts: "1.1" };
+    },
+  },
+  reactions: { add: async () => ({ ok: true }) },
+  users: { info: async () => ({ ok: true, user: { profile: {} } }) },
+};
+
+let counter = 0;
+async function sendMention(channel: string, envelopeExt: boolean) {
+  counter++;
+  const ts = `17000.${String(counter).padStart(4, "0")}`;
+  await handlers.get("message")!({
+    event: { channel, ts, text: `<@${BOT_USER_ID}> please help`, user: "U_EXT_GUARD_HUMAN" },
+    body: { event_id: `evt_ext_guard_${counter}`, is_ext_shared_channel: envelopeExt },
+    client,
+    say: async () => ({ ok: true, ts: "1.2" }),
+  });
+  return getSlackTasksInThread(channel, ts);
+}
+
+beforeAll(async () => {
+  initDb(TEST_DB_PATH);
+  process.env.SLACK_RENDER_V2 = "false";
+  process.env.ADDITIVE_SLACK = "false";
+  process.env.SLACK_ALERTS_CHANNEL = "C_ALERTS";
+  await createAgent({ name: "ext-guard-lead", isLead: true, status: "idle", capabilities: [] });
+  registerMessageHandler({
+    event: (type: string, handler: Handler) => {
+      handlers.set(type, handler);
+    },
+  } as never);
+});
+
+afterAll(() => {
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      unlinkSync(`${TEST_DB_PATH}${suffix}`);
+    } catch {
+      // ignore
+    }
+  }
+  for (const [key, value] of Object.entries(previousEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(() => {
+  resetExternalChannelStateForTesting();
+  resetSlackHandlerCachesForTesting();
+  channelInfo = { is_ext_shared: false, is_pending_ext_shared: false };
+  infoCalls = 0;
+  infoFails = false;
+  leaveCalls = [];
+  alertPosts = [];
+});
+
+describe("inbound guard (message handler)", () => {
+  test("flag true + envelope is_ext_shared_channel: 0 tasks", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    expect(await sendMention("C_EXT_ENVELOPE", true)).toHaveLength(0);
+  });
+
+  test("flag false + envelope is_ext_shared_channel: 1 task (current behavior)", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "false";
+    expect(await sendMention("C_EXT_FLAG_OFF", true)).toHaveLength(1);
+  });
+
+  test("flag true + envelope false + is_pending_ext_shared: 0 tasks", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    channelInfo = { is_pending_ext_shared: true };
+    expect(await sendMention("C_EXT_PENDING", false)).toHaveLength(0);
+    expect(infoCalls).toBe(1);
+  });
+
+  test("flag true + internal channel: 1 task", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    expect(await sendMention("C_INTERNAL", false)).toHaveLength(1);
+  });
+
+  test("flag true + conversations.info failure + no envelope: 0 tasks (fail closed)", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    infoFails = true;
+    expect(await sendMention("C_UNVERIFIED", false)).toHaveLength(0);
+  });
+
+  test("an envelope-marked channel blocks later lookups with no envelope", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    expect(await shouldBlockChannel(client as never, "C_EXT_LATER")).toBe(false);
+    expect(await sendMention("C_EXT_LATER", true)).toHaveLength(0);
+    expect(await shouldBlockChannel(client as never, "C_EXT_LATER")).toBe(true);
+  });
+});
+
+describe("join and share events", () => {
+  test("bot joins an external channel: 1 leave and 1 alert", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    channelInfo = { is_ext_shared: true };
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_JOIN_EXT" },
+      client,
+    });
+    expect(leaveCalls).toEqual(["C_JOIN_EXT"]);
+    expect(alertPosts).toHaveLength(1);
+    expect(alertPosts[0]).toContain("Trigger: joined");
+  });
+
+  test("bot joins a channel Slack cannot classify: 0 leaves", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    infoFails = true;
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_JOIN_UNVERIFIED" },
+      client,
+    });
+    expect(leaveCalls).toEqual([]);
+  });
+
+  test("a human joins an external channel: 0 Slack calls", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    channelInfo = { is_ext_shared: true };
+    await handlers.get("member_joined_channel")!({
+      event: { user: "U_SOMEONE_ELSE", channel: "C_JOIN_HUMAN" },
+      client,
+    });
+    expect(infoCalls).toBe(0);
+    expect(leaveCalls).toHaveLength(0);
+    expect(alertPosts).toHaveLength(0);
+  });
+
+  test("bot joins an internal channel: 0 leave calls", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_JOIN_INT" },
+      client,
+    });
+    expect(leaveCalls).toHaveLength(0);
+  });
+
+  test("channel_shared on a cached internal channel: fresh info call and 1 leave", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_SHARED" },
+      client,
+    });
+    expect(infoCalls).toBe(1);
+    channelInfo = { is_ext_shared: true };
+    await handlers.get("channel_shared")!({
+      event: { channel: "C_SHARED", connected_team_id: "T0OTHER" },
+      client,
+    });
+    expect(infoCalls).toBe(2);
+    expect(leaveCalls).toEqual(["C_SHARED"]);
+    expect(alertPosts[0]).toContain("Trigger: shared");
+  });
+
+  test("channel_unshared invalidates the cache only", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_UNSHARED" },
+      client,
+    });
+    await handlers.get("channel_unshared")!({ event: { channel: "C_UNSHARED" }, client });
+    expect(infoCalls).toBe(1);
+    expect(leaveCalls).toHaveLength(0);
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_UNSHARED" },
+      client,
+    });
+    expect(infoCalls).toBe(2);
+  });
+
+  test("flag false: 0 Slack calls from any event", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "false";
+    channelInfo = { is_ext_shared: true };
+    let authCalls = 0;
+    const countingClient = {
+      ...client,
+      auth: {
+        test: async () => {
+          authCalls++;
+          return { user_id: BOT_USER_ID };
+        },
+      },
+    };
+    await handlers.get("member_joined_channel")!({
+      event: { user: BOT_USER_ID, channel: "C_OFF" },
+      client: countingClient,
+    });
+    await handlers.get("channel_shared")!({ event: { channel: "C_OFF" }, client: countingClient });
+    await handlers.get("channel_unshared")!({
+      event: { channel: "C_OFF" },
+      client: countingClient,
+    });
+    expect(authCalls + infoCalls + leaveCalls.length + alertPosts.length).toBe(0);
+  });
+});
+
+describe("/agent-swarm-status", () => {
+  async function runStatus(channelId: string): Promise<Array<Record<string, unknown>>> {
+    const commands = new Map<string, Handler>();
+    registerCommandHandler({
+      command: (name: string, handler: Handler) => {
+        commands.set(name, handler);
+      },
+    } as never);
+    const responses: Array<Record<string, unknown>> = [];
+    await commands.get("/agent-swarm-status")!({
+      ack: async () => {},
+      respond: async (response: Record<string, unknown>) => {
+        responses.push(response);
+      },
+      command: { channel_id: channelId },
+      client,
+    });
+    return responses;
+  }
+
+  test("flag true + external channel: refusal only, no task summaries", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    channelInfo = { is_ext_shared: true };
+    expect(await runStatus("C_EXT_CMD")).toEqual([
+      { response_type: "ephemeral", text: EXTERNAL_CHANNEL_BLOCKED_REPLY },
+    ]);
+  });
+
+  test("flag true + internal channel: status blocks", async () => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    const responses = await runStatus("C_INT_CMD");
+    expect(responses).toHaveLength(1);
+    expect(responses[0]?.blocks).toBeDefined();
+  });
+});

package/src/tests/slack-external-channel-tools.test.ts

@@ -0,0 +1,173 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, createTaskExtended, initDb } from "../be/db";
+import { resetExternalChannelStateForTesting } from "../slack/external-channel";
+import { registerSlackPostTool } from "../tools/slack-post";
+import { registerSlackReadTool } from "../tools/slack-read";
+import { registerSlackReplyTool } from "../tools/slack-reply";
+import { registerSlackStartThreadTool } from "../tools/slack-start-thread";
+import { registerSlackUpdateTool } from "../tools/slack-update";
+import { registerSlackUploadFileTool } from "../tools/slack-upload-file";
+
+const TEST_DB_PATH = "./test-slack-external-channel-tools.sqlite";
+const originalFlag = process.env.SLACK_BLOCK_EXTERNAL_CHANNELS;
+
+const EXT_CHANNEL = "C_EXT_TOOLS";
+let channelInfo: Record<string, unknown> = { is_ext_shared: true };
+let infoFails = false;
+
+const mockPostMessage = mock(() =>
+  Promise.resolve({ ok: true, ts: "500.2", channel: EXT_CHANNEL }),
+);
+const mockInfo = mock(() =>
+  infoFails
+    ? Promise.reject(new Error("An API error occurred: missing_scope"))
+    : Promise.resolve({ ok: true, channel: channelInfo }),
+);
+const mockUpdate = mock(() => Promise.resolve({ ok: true, ts: "500.2", channel: EXT_CHANNEL }));
+const mockUpload = mock(() => Promise.resolve({ ok: true, files: [{ files: [{ id: "F1" }] }] }));
+const mockReplies = mock(() => Promise.resolve({ ok: true, messages: [] }));
+const mockHistory = mock(() => Promise.resolve({ ok: true, messages: [] }));
+
+mock.module("../slack/app", () => ({
+  getSlackApp: () => ({
+    client: {
+      chat: { postMessage: mockPostMessage, update: mockUpdate },
+      filesUploadV2: mockUpload,
+      conversations: { info: mockInfo, replies: mockReplies, history: mockHistory },
+      users: { info: () => Promise.resolve({ ok: true, user: {} }) },
+      auth: { test: () => Promise.resolve({ ok: true, user_id: "U_BOT", bot_id: "B_BOT" }) },
+    },
+  }),
+}));
+
+type ToolResult = {
+  isError?: boolean;
+  structuredContent: { success: boolean; message: string };
+};
+type RegisteredTool = { handler: (args: unknown, extra: unknown) => Promise<ToolResult> };
+
+function buildTools() {
+  const server = new McpServer({ name: "slack-external-channel-tools-test", version: "1.0.0" });
+  registerSlackPostTool(server);
+  registerSlackReplyTool(server);
+  registerSlackStartThreadTool(server);
+  registerSlackReadTool(server);
+  registerSlackUpdateTool(server);
+  registerSlackUploadFileTool(server);
+  return (server as unknown as { _registeredTools: Record<string, RegisteredTool> })
+    ._registeredTools;
+}
+
+function meta(agentId: string) {
+  return { sessionId: "s1", requestInfo: { headers: { "x-agent-id": agentId } } };
+}
+
+async function removeDbFiles() {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(`${TEST_DB_PATH}${suffix}`);
+    } catch {}
+  }
+}
+
+let leadId: string;
+let taskId: string;
+let tools: Record<string, RegisteredTool>;
+
+beforeAll(async () => {
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  leadId = (await createAgent({ name: "Lead Ext Tools", isLead: true, status: "idle" })).id;
+  taskId = (
+    await createTaskExtended("ext tools", {
+      agentId: leadId,
+      source: "slack",
+      slackChannelId: EXT_CHANNEL,
+      slackThreadTs: "500.1",
+    })
+  ).id;
+  tools = buildTools();
+});
+
+beforeEach(() => {
+  resetExternalChannelStateForTesting();
+  channelInfo = { is_ext_shared: true };
+  infoFails = false;
+  mockPostMessage.mockClear();
+  mockUpdate.mockClear();
+  mockUpload.mockClear();
+  mockInfo.mockClear();
+  mockReplies.mockClear();
+  mockHistory.mockClear();
+});
+
+afterAll(async () => {
+  if (originalFlag === undefined) delete process.env.SLACK_BLOCK_EXTERNAL_CHANNELS;
+  else process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = originalFlag;
+  closeDb();
+  await removeDbFiles();
+});
+
+const calls: Array<[string, () => Record<string, unknown>]> = [
+  ["slack-post", () => ({ channelId: EXT_CHANNEL, message: "hi" })],
+  ["slack-start-thread", () => ({ channelId: EXT_CHANNEL, message: "hi" })],
+  ["slack-reply", () => ({ taskId, message: "hi" })],
+  ["slack-read", () => ({ channelId: EXT_CHANNEL })],
+  ["slack-update", () => ({ channelId: EXT_CHANNEL, messageTs: "500.2", message: "hi" })],
+  [
+    "slack-upload-file",
+    () => ({
+      channelId: EXT_CHANNEL,
+      content: Buffer.from("hi").toString("base64"),
+      filename: "hi.txt",
+    }),
+  ],
+];
+
+function slackWriteCount(): number {
+  return (
+    mockPostMessage.mock.calls.length +
+    mockHistory.mock.calls.length +
+    mockUpdate.mock.calls.length +
+    mockUpload.mock.calls.length
+  );
+}
+
+describe("outbound guard (E8)", () => {
+  test.each(calls)("%s: flag true + external channel is refused", async (name, args) => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    const result = await tools[name]!.handler(args(), meta(leadId));
+    expect(result.isError).toBe(true);
+    expect(result.structuredContent.message).toContain(
+      "SLACK_BLOCK_EXTERNAL_CHANNELS blocks swarm messages there",
+    );
+    expect(slackWriteCount()).toBe(0);
+  });
+
+  test.each(calls)("%s: flag true + conversations.info failure is refused", async (name, args) => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    infoFails = true;
+    const result = await tools[name]!.handler(args(), meta(leadId));
+    expect(result.isError).toBe(true);
+    expect(result.structuredContent.message).toContain("Could not verify that channel");
+    expect(slackWriteCount()).toBe(0);
+  });
+
+  test.each(calls)("%s: flag true + verified internal channel proceeds", async (name, args) => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "true";
+    channelInfo = { is_ext_shared: false };
+    const result = await tools[name]!.handler(args(), meta(leadId));
+    expect(result.isError).toBeFalsy();
+    expect(slackWriteCount()).toBe(1);
+  });
+
+  test.each(calls)("%s: flag false keeps the current behavior", async (name, args) => {
+    process.env.SLACK_BLOCK_EXTERNAL_CHANNELS = "false";
+    const result = await tools[name]!.handler(args(), meta(leadId));
+    expect(result.isError).toBeFalsy();
+    expect(mockInfo).not.toHaveBeenCalled();
+    expect(slackWriteCount()).toBe(1);
+  });
+});