@open-everywhere/provider-slack 0.1.0

package/dist/agent/access/slack-attachment-fetch.js

@@ -0,0 +1,151 @@
+// Trusted-provenance Slack attachment fetch — the ONE seam that attaches the Slack BOT TOKEN to
+// a file download, and ONLY ever sends it to a validated Slack file host.
+//
+// WHY THIS EXISTS, DISTINCT FROM oeFetch (access/host-egress.ts). `oeFetch` is the guard for a
+// MODEL-SUPPLIED URL: it sends NO credentials, precisely because a model-chosen destination must
+// never receive one (P0-1, the EXFIL leg). But a Slack image sits behind `url_private`, which
+// 302/403s without the bot token — so pasted Slack screenshots (the main describe_image use case)
+// are unfetchable credential-less. This helper closes that gap under two hard constraints that
+// oeFetch's blanket "send nothing" rule made moot there:
+//
+//   1. TRUSTED PROVENANCE — the URL is NOT a tool argument. It arrives as an already-resolved
+//      record whose `urlPrivate` came from a Slack event's `files[].url_private`
+//      (channels/slack-attachments.ts, populated only by parseMessageEvent). describe_image
+//      resolves a model-named FILE ID through that registry and passes the resulting record here.
+//      A model-chosen URL string can never reach this function — the signature takes a record, not
+//      a raw URL, and describe_image only ever builds that record from the registry.
+//
+//   2. HOST-PINNED CREDENTIAL — the bot token rides ONLY to a Slack file host (files.slack.com).
+//      Any other host is refused and the token is NEVER sent (nor is the host even resolved). So
+//      even if provenance were somehow subverted, the credential cannot leak to an attacker host.
+//
+// Plus the SAME SSRF posture as oeFetch: resolve-then-check-then-PIN (reusing
+// `assertSafeFetchUrl`) so even files.slack.com gets the DNS-rebind check — a poisoned resolver
+// pointing files.slack.com at an internal IP is refused — and `redirect:"error"` so a 3xx can't
+// bounce the token to another host.
+//
+// ONE TIER-DEPENDENT CAVEAT (OPE-322). `assertSafeFetchUrl` now routes through the forward proxy
+// when `*_PROXY` is set (the self-host/docker stack), because the app container has no WAN route at
+// all — without it this download simply fails there. On that path the IP-pin cannot operate (the
+// proxy resolves the CONNECT target itself) and anti-rebind is delegated to the proxy's default-deny
+// ACL; the returned `antiRebind` says which held, and this seam records it on the allow row. The
+// HOST-PIN above — the property that actually protects the token — is unaffected, and it is decided
+// before any dispatch. The token does traverse the operator's own proxy: Tier A tunnels it
+// undecrypted (CONNECT), Tier B decrypts with the operator's CA, which is what Tier B is for.
+import { assertSafeFetchUrl, auditToolAction, hostCallAuditFields, } from "@open-everywhere/core/agent/adapter-api.js";
+// THE CREDENTIAL'S IDENTITY, FOR THE AUDIT ROW (OPE-1547) — the ref NAME, never the value. This is
+// the one host-side seam that attaches a credential, so before this ticket it was the one place
+// where a plane both saw the call and knew whose credential rode it, and said neither on the row.
+// The shared cross-plane row shape (core access/egress.ts) is what it fills now.
+const SLACK_BOT_TOKEN_REF = "SLACK_BOT_TOKEN";
+/** Every attachment download is a GET — Slack's `url_private` is a file read. */
+const ATTACHMENT_VERB = "GET";
+// Slack serves `url_private` downloads from `files.slack.com` (Enterprise Grid included — same
+// host). The bot token is sent to NO other host. If Slack ever documents a second legitimate file
+// host, add it here — the pin is a closed set on purpose (a `*.slack.com` wildcard would let the
+// API host `slack.com` receive the token, which it must not).
+const SLACK_FILE_HOSTS = new Set(["files.slack.com"]);
+/** Is `hostname` a Slack file host the bot token may be sent to? Exact-match, case-insensitive. */
+function isSlackFileHost(hostname) {
+    return SLACK_FILE_HOSTS.has(hostname.toLowerCase());
+}
+/**
+ * Download a Slack attachment with the bot token, host-pinned to a Slack file host and SSRF-guarded.
+ * Refuses (and never sends the token) if the URL is not HTTPS on a Slack file host. Returns the raw
+ * Response — the caller (describe_image) reads the bytes.
+ */
+export async function fetchSlackAttachment(ctx, ref) {
+    let url;
+    try {
+        url = new URL(ref.urlPrivate);
+    }
+    catch {
+        throw new Error("describe_image: the Slack attachment URL is not a valid URL.");
+    }
+    // HTTPS-only: a bearer token must never ride cleartext.
+    if (url.protocol !== "https:") {
+        throw new Error(`describe_image: refusing to send the Slack bot token over a non-HTTPS URL ("${url.protocol}").`);
+    }
+    // HOST-PIN (before any DNS): the token may ONLY go to a Slack file host. A non-Slack host is
+    // refused HERE — the token is never sent and the host isn't even resolved.
+    if (!isSlackFileHost(url.hostname)) {
+        await auditToolAction(ctx, "slack.attachment.deny", {
+            // `credential: null` is the load-bearing claim on every deny here: the host-pin is decided
+            // BEFORE the token is read, so a refused download never had one attached.
+            ...hostCallAuditFields({ host: url.hostname, verb: ATTACHMENT_VERB, outcome: "denied" }),
+            reason: "not-slack-file-host",
+            id: ref.id,
+        });
+        throw new Error(`describe_image: refusing to send the Slack bot token to non-Slack host "${url.hostname}".`);
+    }
+    // SSRF resolve-then-check-then-PIN — even Slack's own host gets the rebind check, and the
+    // connection is pinned to the validated public IP so it can't be re-resolved between check and
+    // connect. `redirect:"error"` (below) stops a 3xx bouncing the token to another host.
+    let safe;
+    try {
+        safe = await assertSafeFetchUrl(ref.urlPrivate);
+    }
+    catch (err) {
+        const resolveFailed = err?.oeEgressCause === "resolve-failed";
+        await auditToolAction(ctx, "slack.attachment.deny", {
+            // `denied` rather than `failed` — the SSRF guard refuses on POLICY before any dispatch. A
+            // resolver that could not ANSWER is a different event and core tags it, so this seam reports
+            // it as `failed` under its own reason rather than as an SSRF refusal.
+            ...hostCallAuditFields({ host: url.hostname, verb: ATTACHMENT_VERB, outcome: resolveFailed ? "failed" : "denied" }),
+            reason: resolveFailed ? "resolve-failed" : "ssrf",
+            id: ref.id,
+        });
+        throw err;
+    }
+    // Defence-in-depth: assertSafeFetchUrl preserves the hostname, but re-assert it so the token can
+    // NEVER ride a host that isn't a Slack file host, whatever the parse produced.
+    if (!isSlackFileHost(safe.url.hostname)) {
+        await auditToolAction(ctx, "slack.attachment.deny", {
+            ...hostCallAuditFields({ host: safe.url.hostname, verb: ATTACHMENT_VERB, outcome: "denied" }),
+            reason: "not-slack-file-host",
+            id: ref.id,
+        });
+        throw new Error(`describe_image: refusing to send the Slack bot token to non-Slack host "${safe.url.hostname}".`);
+    }
+    const token = process.env.SLACK_BOT_TOKEN;
+    if (!token) {
+        throw new Error("describe_image: SLACK_BOT_TOKEN is not set — the bot token is required to download a Slack attachment.");
+    }
+    // ONE row per call, carrying the OUTCOME — so it is written after the dispatch settles, not
+    // before it starts (the same trade core's `oeFetch` states: the refusal paths above still record
+    // before anything leaves, and what is lost is a process death mid-flight).
+    //
+    // 🔴 `credential` NAMES THE REF, NEVER THE TOKEN. `token` is read one line above and is not
+    // referenced here; the row carries the ref name only, which is the identity an operator looks up.
+    // `route` is the dispatch route — it was called `via` until OPE-1547, the same field name the
+    // SANDBOX plane used for the stamping connection.
+    const row = (outcome, extra = {}) => ({
+        ...hostCallAuditFields({
+            host: safe.url.hostname,
+            verb: ATTACHMENT_VERB,
+            outcome,
+            credential: SLACK_BOT_TOKEN_REF,
+        }),
+        id: ref.id,
+        route: safe.via,
+        antiRebind: safe.antiRebind,
+        ...extra,
+    });
+    let response;
+    try {
+        // Bot token ONLY to the pinned Slack file host; NO redirect follow (a 3xx must not bounce the
+        // token elsewhere); connection pinned to the validated IP.
+        response = await fetch(safe.url, {
+            dispatcher: safe.dispatcher,
+            redirect: "error",
+            headers: { authorization: `Bearer ${token}` },
+        });
+    }
+    catch (err) {
+        await auditToolAction(ctx, "slack.attachment.allow", row("failed"));
+        throw err;
+    }
+    await auditToolAction(ctx, "slack.attachment.allow", row("allowed", { status: response.status }));
+    return response;
+}
+//# sourceMappingURL=slack-attachment-fetch.js.map

package/dist/agent/access/slack-attachment-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-attachment-fetch.js","sourceRoot":"","sources":["../../../agent/access/slack-attachment-fetch.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,+FAA+F;AAC/F,yDAAyD;AACzD,EAAE;AACF,8FAA8F;AAC9F,iFAAiF;AACjF,4FAA4F;AAC5F,kGAAkG;AAClG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,8EAA8E;AAC9E,gGAAgG;AAChG,gGAAgG;AAChG,oCAAoC;AACpC,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,iGAAiG;AACjG,qGAAqG;AACrG,iGAAiG;AACjG,oGAAoG;AACpG,2FAA2F;AAC3F,8FAA8F;AAE9F,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,GAIpB,MAAM,4CAA4C,CAAC;AAEpD,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,+FAA+F;AAC/F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAE3E,mGAAmG;AACnG,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,GAA2B;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,wDAAwD;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+EAA+E,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;IACpH,CAAC;IACD,6FAA6F;IAC7F,2EAA2E;IAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,2FAA2F;YAC3F,0EAA0E;YAC1E,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YACxF,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,sFAAsF;IACtF,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,GAAI,GAA8C,EAAE,aAAa,KAAK,gBAAgB,CAAC;QAC1G,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,0FAA0F;YAC1F,6FAA6F;YAC7F,sEAAsE;YACtE,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnH,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM;YACjD,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,iGAAiG;IACjG,+EAA+E;IAC/E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,eAAe,CAAC,GAAG,EAAE,uBAAuB,EAAE;YAClD,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC7F,MAAM,EAAE,qBAAqB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,CAAC;IACD,4FAA4F;IAC5F,iGAAiG;IACjG,2EAA2E;IAC3E,EAAE;IACF,4FAA4F;IAC5F,kGAAkG;IAClG,8FAA8F;IAC9F,kDAAkD;IAClD,MAAM,GAAG,GAAG,CAAC,OAA6B,EAAE,KAAK,GAA4B,EAAE,EAA2B,EAAE,CAAC,CAAC;QAC5G,GAAG,mBAAmB,CAAC;YACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YACvB,IAAI,EAAE,eAAe;YACrB,OAAO;YACP,UAAU,EAAE,mBAAmB;SAChC,CAAC;QACF,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,KAAK;KACT,CAAC,CAAC;IACH,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,8FAA8F;QAC9F,2DAA2D;QAC3D,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACpB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/agent/app-manifest.d.ts

@@ -0,0 +1,15 @@
+/** The token the request URLs carry where the deployment's own host belongs. The ops plane
+ *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the wizard leaves it for the
+ *  operator, who has usually not deployed yet when they run it. */
+export declare const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
+/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the minimal
+ *  scope/event set docs/deploy/surfaces/slack.md walks through by hand. */
+export declare function slackAppManifestTemplate(): string;
+/** Where the operator pastes the manifest. */
+export declare const SLACK_APP_CONSOLE_URL = "https://api.slack.com/apps";
+/** The ordered clicks. Slack reserves every one of them for a workspace admin. */
+export declare const SLACK_APP_MANIFEST_STEPS: readonly string[];
+/** What the operator brings back. Both are environment variables, not credential-store secrets:
+ *  the bundle reads them from the environment (agent/ops.ts). */
+export declare const SLACK_APP_MANIFEST_COLLECT: readonly string[];
+//# sourceMappingURL=app-manifest.d.ts.map

package/dist/agent/app-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-manifest.d.ts","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAaA;;mEAEmE;AACnE,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D;2EAC2E;AAC3E,wBAAgB,wBAAwB,IAAI,MAAM,CA6GjD;AAED,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAMrD,CAAC;AAEF;iEACiE;AACjE,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAGvD,CAAC"}

package/dist/agent/app-manifest.js

@@ -0,0 +1,141 @@
+// THE Slack app manifest — one definition, three readers (OPE-1603).
+//
+// This file is the only place the manifest exists. The install wizard's Slack step
+// (packages/create/src/steps/slack.ts) prints it, the ops MCP tool `surface_manifest` serves it
+// with this deployment's host substituted, and `scripts/slack-scope-audit-test.ts` parses the bot
+// scope array below against the runbook's documented scopes. It used to live in the wizard, where
+// the ops server could not reach it at all.
+//
+// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The install wizard depends on the bundle for this
+// document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
+// eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
+// only the vendor's own knowledge.
+/** The token the request URLs carry where the deployment's own host belongs. The ops plane
+ *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the wizard leaves it for the
+ *  operator, who has usually not deployed yet when they run it. */
+export const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
+/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the minimal
+ *  scope/event set docs/deploy/surfaces/slack.md walks through by hand. */
+export function slackAppManifestTemplate() {
+    return JSON.stringify({
+        display_information: { name: "Open Everywhere" },
+        features: {
+            bot_user: { display_name: "Open Everywhere", always_online: true },
+            // The "/oe" ZERO-INFERENCE control command (agent/commands/core.ts). Declared here rather
+            // than left to a manual setup step because one of its subcommands is `/oe stop` (OPE-418),
+            // and stop is not a convenience: it is the affordance a person reaches for when the agent
+            // is doing the wrong thing. An install where stop has to be wired by hand is an install
+            // where stop is missing. NOTE the request URL is the SLASH-COMMAND endpoint, which Slack
+            // configures SEPARATELY from the Events request URL above.
+            slash_commands: [
+                {
+                    command: "/oe",
+                    url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack/commands`,
+                    description: "Open Everywhere control commands — status, budget, stop.",
+                    usage_hint: "stop | status | budget",
+                    should_escape: false,
+                },
+            ],
+            // SHORTCUTS AS A WAKE (OPE-1376). Both kinds are declared, because they answer two
+            // different needs and neither substitutes for the other: the MESSAGE shortcut hands the
+            // agent one message somebody is looking at, and the GLOBAL shortcut starts a conversation
+            // from the composer with no room in scope (it wakes the invoker's own DM window). Both
+            // arrive on the interactivity Request URL declared under `settings` below, which is why
+            // that block is no longer optional in this manifest.
+            //
+            // The `callback_id`s are free-form: the front route owns EVERY shortcut payload the app
+            // receives, so renaming one here changes only the trigger name the model is told about.
+            shortcuts: [
+                {
+                    name: "Send to Open Everywhere",
+                    type: "message",
+                    callback_id: "oe_message_shortcut",
+                    description: "Wake the agent on this message.",
+                },
+                {
+                    name: "Ask Open Everywhere",
+                    type: "global",
+                    callback_id: "oe_global_shortcut",
+                    description: "Wake the agent in a DM.",
+                },
+            ],
+        },
+        oauth_config: {
+            scopes: {
+                bot: [
+                    "app_mentions:read",
+                    "chat:write",
+                    "channels:history",
+                    // Slack's own description: "Add shortcuts and slash commands that people can use". It
+                    // grants no read access — it is what lets this manifest DECLARE the `/oe` command above
+                    // and the two shortcuts beside it. Both entry points are wakes an install needs.
+                    "commands",
+                    // conversations.info/conversations.members (channel trust gate, join intros, the
+                    // governance roster) — public and private channel halves. Without these, EVERY
+                    // channel binds `external` (fail-closed) on a fresh install, silently (OPE-175).
+                    "channels:read",
+                    "groups:read",
+                    "im:history",
+                    // conversations.info/conversations.members on a `D…` DM — the `im` half of the SAME two
+                    // calls channels:read/groups:read cover for channels. The governance roster
+                    // (slackGovernanceRoster) is keyed on whatever room a click or a card lands in, and DMs
+                    // are rooms: on a member-tier approve-click in a DM the roster resolves the `D…` id, so
+                    // without this both calls return `missing_scope`, the roster comes back unresolved, and
+                    // the clicker floor's beneficiary leg refuses the click citing the roster (OPE-332,
+                    // live-proven 2026-08-09). channels:read/groups:read do NOT cover an `im`.
+                    "im:read",
+                    // conversations.open — the governance DM-delivery arm (OPE-44): org-scope admin output
+                    // asked in an ordinary room is delivered to the requester's DM, never rendered there.
+                    "im:write",
+                    "groups:history",
+                    // The group-DM (`mpim`) half of `im:read` — same two calls, same call sites. Code-derived
+                    // rather than live-proven: the roster/disclosure paths are keyed on the room, and a
+                    // member-tier click or a card can land in a group DM exactly as it can in a 1:1.
+                    "mpim:read",
+                    "reactions:write",
+                    "reactions:read",
+                    "pins:read",
+                    "pins:write",
+                    // users.info — the DM-partner trust check. Without this, EVERY DM binds `external`
+                    // (fail-closed) on a fresh install, silently (OPE-175).
+                    "users:read",
+                ],
+            },
+        },
+        settings: {
+            event_subscriptions: {
+                request_url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack`,
+                bot_events: ["app_mention", "message.im", "reaction_added", "reaction_removed"],
+            },
+            // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every
+            // button click and every shortcut lands here, and the front route classifies which handler
+            // owns it. Required by the `shortcuts` above; without it Slack refuses to deliver a
+            // shortcut at all, and the approval / connector / "Set API key" cards' buttons fail with
+            // "the app is not configured to handle interactive responses".
+            interactivity: {
+                is_enabled: true,
+                request_url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack`,
+            },
+            org_deploy_enabled: false,
+            socket_mode_enabled: false,
+            token_rotation_enabled: false,
+        },
+    }, null, 2);
+}
+/** Where the operator pastes the manifest. */
+export const SLACK_APP_CONSOLE_URL = "https://api.slack.com/apps";
+/** The ordered clicks. Slack reserves every one of them for a workspace admin. */
+export const SLACK_APP_MANIFEST_STEPS = [
+    "Open https://api.slack.com/apps and sign in to the workspace that will host the agent.",
+    "Create New App → From an app manifest.",
+    "Pick the workspace, choose JSON, and paste the manifest below.",
+    "Next → Create.",
+    "Install to Workspace, and approve the scopes Slack lists.",
+];
+/** What the operator brings back. Both are environment variables, not credential-store secrets:
+ *  the bundle reads them from the environment (agent/ops.ts). */
+export const SLACK_APP_MANIFEST_COLLECT = [
+    "OAuth & Permissions → Bot User OAuth Token (xoxb-…) = SLACK_BOT_TOKEN",
+    "Basic Information → App Credentials → Signing Secret = SLACK_SIGNING_SECRET",
+];
+//# sourceMappingURL=app-manifest.js.map

package/dist/agent/app-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-manifest.js","sourceRoot":"","sources":["../../agent/app-manifest.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,mFAAmF;AACnF,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,4CAA4C;AAC5C,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mCAAmC;AAEnC;;mEAEmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAE/D;2EAC2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,mBAAmB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QAChD,QAAQ,EAAE;YACR,QAAQ,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;YAClE,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,yFAAyF;YACzF,2DAA2D;YAC3D,cAAc,EAAE;gBACd;oBACE,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,WAAW,6BAA6B,wBAAwB;oBACrE,WAAW,EAAE,0DAA0D;oBACvE,UAAU,EAAE,wBAAwB;oBACpC,aAAa,EAAE,KAAK;iBACrB;aACF;YACD,mFAAmF;YACnF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,qDAAqD;YACrD,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,qBAAqB;oBAClC,WAAW,EAAE,iCAAiC;iBAC/C;gBACD;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oBAAoB;oBACjC,WAAW,EAAE,yBAAyB;iBACvC;aACF;SACF;QACD,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG,EAAE;oBACH,mBAAmB;oBACnB,YAAY;oBACZ,kBAAkB;oBAClB,sFAAsF;oBACtF,wFAAwF;oBACxF,iFAAiF;oBACjF,UAAU;oBACV,iFAAiF;oBACjF,+EAA+E;oBAC/E,iFAAiF;oBACjF,eAAe;oBACf,aAAa;oBACb,YAAY;oBACZ,wFAAwF;oBACxF,4EAA4E;oBAC5E,wFAAwF;oBACxF,wFAAwF;oBACxF,wFAAwF;oBACxF,oFAAoF;oBACpF,2EAA2E;oBAC3E,SAAS;oBACT,uFAAuF;oBACvF,sFAAsF;oBACtF,UAAU;oBACV,gBAAgB;oBAChB,0FAA0F;oBAC1F,oFAAoF;oBACpF,iFAAiF;oBACjF,WAAW;oBACX,iBAAiB;oBACjB,gBAAgB;oBAChB,WAAW;oBACX,YAAY;oBACZ,mFAAmF;oBACnF,wDAAwD;oBACxD,YAAY;iBACb;aACF;SACF;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE;gBACnB,WAAW,EAAE,WAAW,6BAA6B,eAAe;gBACpE,UAAU,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;aAChF;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,oFAAoF;YACpF,yFAAyF;YACzF,+DAA+D;YAC/D,aAAa,EAAE;gBACb,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,WAAW,6BAA6B,eAAe;aACrE;YACD,kBAAkB,EAAE,KAAK;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;SAC9B;KACF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,wFAAwF;IACxF,wCAAwC;IACxC,gEAAgE;IAChE,gBAAgB;IAChB,2DAA2D;CAC5D,CAAC;AAEF;iEACiE;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,uEAAuE;IACvE,6EAA6E;CAC9E,CAAC"}

package/dist/agent/channels/slack-approval-card.d.ts

@@ -0,0 +1,71 @@
+import { type ApprovalCardRespondFn } from "@open-everywhere/core/agent/adapter-api.js";
+/** The `input_response.routed` sibling for a tap: an approval settled through a BUTTON rather than a
+ *  typed reply. RE-EXPORTED FROM CORE, never re-spelled here — one action name for every surface, so
+ *  a scorer that joins on the row cannot under-count one of them (OPE-1856). */
+export declare const APPROVAL_CARD_SETTLED_AUDIT_ACTION = "input_response.card_settled";
+/** A verified tap that settled nothing, carrying WHICH refusal it was. Core-owned, as above. */
+export declare const APPROVAL_CARD_REFUSED_AUDIT_ACTION = "input_response.card_refused";
+/** The settle delivery this leg needs. CORE-OWNED and bound by the front route through
+ *  `approvalCardRespondVia(args.attachSession)` — re-exported here, never re-spelled, so the address
+ *  the answer takes cannot drift per surface (OPE-1863). */
+export type ApprovalRespondFn = ApprovalCardRespondFn;
+/** What one verified tap did, for the front route's log line. Never thrown — this endpoint answers a
+ *  person who is waiting, so every path returns. */
+export interface ApprovalCardClickOutcome {
+    readonly handled: boolean;
+    readonly reason: string;
+    /** A line to show the tapper alone, or undefined when the outcome needs no note. */
+    readonly notice?: string;
+}
+/** The `block_actions` fields this leg reads, narrowed so nothing here needs Slack's own types. */
+interface ParsedApprovalClick {
+    readonly actionId: string;
+    readonly channelId: string;
+    readonly userId: string;
+    readonly teamId?: string;
+}
+/**
+ * Read the one `oe_input:` action out of a verified `block_actions` payload. `undefined` when the
+ * payload is not one of ours or is missing a field the decision needs — the front route then leaves
+ * it alone rather than half-handling it.
+ *
+ * THE FIRST `oe_input:` ACTION WINS and the rest are ignored: Slack sends one action per click, and a
+ * payload carrying two of ours is not a shape this host mints.
+ */
+export declare function parseSlackApprovalClick(payload: unknown): ParsedApprovalClick | undefined;
+/**
+ * Handle one verified `oe_input:` click: resolve it, admit it, deliver the answer to eve, consume the
+ * rows. NEVER THROWS — the front route has already 200'd the interaction, and an unhandled throw here
+ * would only lose the log line.
+ *
+ * 🔴 THE ANSWER TEXT IS HOST COPY, and it must be. A tap carries no words, so a transcript that read
+ * the button as the person's own prose would be inventing their words. What rides is the host label
+ * this deployment put on that button (`Approve` / `Cancel`), which is what the person actually chose,
+ * and the `optionId` beside it is what eve settles on — `resolveApprovalOutcome` reads `optionId`
+ * ALONE, so the text is transcript only and never the decision.
+ *
+ * 🔴 CONSUME-ONCE, AND BOTH ROWS. The ticket goes so a second tap on the same card cannot answer a
+ * request eve has already settled; the outstanding-question row goes so the room's NEXT message is an
+ * ordinary wake again rather than a second answer to a settled request. Both happen only after eve
+ * accepted the delivery, exactly as the text leg orders them.
+ *
+ * THE LIMIT OF THAT, stated rather than implied: the read and the delete are not one atomic step, and
+ * the delete runs only AFTER `respond` returns, so anything arriving while the first tap is still in
+ * flight resolves against rows that are both still present. Two such deliveries each spend an
+ * admission, each call `respond`, and each can write a settled audit row — so one approval can read
+ * as decided by two taps. It is not a second DECISION: both had to be admitted and both had to name
+ * an option the request offered, and eve's own resolution refuses the second delivery for a request
+ * it already settled. A delivery that arrives after the first settle RETURNED is the covered case —
+ * the ticket is gone and it resolves `no-ticket`.
+ *
+ * 🔴 A SECOND DELIVERY IS MOST LIKELY TO BE SLACK'S OWN, NOT A SECOND PERSON, and this handler does
+ * not ack until the settle returns. Slack expects an interactivity endpoint to answer within about
+ * three seconds; what it does past that — show the tapper a connection error, redeliver, or both —
+ * is VENDOR BEHAVIOUR THIS TREE HAS NOT MEASURED, so do not read the bound above as covering it.
+ * Acking first and settling in the background would remove the delay and widen exactly the window
+ * this paragraph describes; the ordering here takes the narrower window instead. Whoever measures
+ * the real behaviour should revisit that trade, with the measurement written down.
+ */
+export declare function handleSlackApprovalCardClick(payload: unknown, respond: ApprovalRespondFn): Promise<ApprovalCardClickOutcome>;
+export {};
+//# sourceMappingURL=slack-approval-card.d.ts.map

package/dist/agent/channels/slack-approval-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-approval-card.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-approval-card.ts"],"names":[],"mappings":"AAsBA,OAAO,EAkBL,KAAK,qBAAqB,EAE3B,MAAM,4CAA4C,CAAC;AAKpD;;gFAEgF;AAChF,eAAO,MAAM,kCAAkC,gCAA0C,CAAC;AAC1F,gGAAgG;AAChG,eAAO,MAAM,kCAAkC,gCAA0C,CAAC;AAE1F;;4DAE4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEtD;oDACoD;AACpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,mGAAmG;AACnG,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAmBzF;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGlI"}