@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack-approval-card.js

@@ -0,0 +1,232 @@
+// THE SLACK RETURN LEG FOR A BRIDGED APPROVAL CARD (OPE-1720) — what makes the button the unified
+// post arm now renders actually settle the approval it names.
+//
+// WHY THIS EXISTS RATHER THAN EVE'S OWN HITL ROUTE. eve's Slack channel has an interactivity seam for
+// its own `eve_input:` cards, and `slack-input-response.ts` is OE's admission on it. That seam cannot
+// serve this card, and the reason is structural rather than a not-yet: eve's own handler stores the
+// card it minted in the SLACK channel's state (`defaults.js` writes `state.pendingApprovalCards`) and
+// resolves the click against that channel's session address. A DM seat's parked request lives on the
+// UNIFIED window — another channel, another session, another state bag — so a click on a card OE
+// posted there has nothing for eve's route to resolve. It is OE's card, so it is OE's click.
+//
+// 🔴 THE SAME ADMISSION, THOUGH. `admitInputResponse` (core approvals/input-response-floor.ts) is the
+// ONE decision both HITL answer doors take, and `ingressSpendGate` with door `"answer"` is the same
+// spend floor `admitSlackInputResponse` consults FIRST for the same reason: a tap RESUMES a parked
+// turn, which is a decision to spend more on a scope nobody asked whether it could afford. This
+// module adds no floor of its own — it resolves the click, asks those two, and delivers.
+//
+// 🔴 A REFUSAL LEAVES THE CARD LIVE. Nothing here consumes a row on any outcome but a delivered
+// answer: the approval stays parked, the card stays tappable for somebody who may answer it, and the
+// question stays answerable IN WORDS through the text leg (`question-bridge.ts`), which is untouched.
+// That is the same "a refusal is not a drop" posture the text leg holds.
+import { admitInputResponse, APPROVAL_BUTTON_LABELS, APPROVAL_CARD_REFUSED_AUDIT_ACTION as CORE_APPROVAL_CARD_REFUSED_AUDIT_ACTION, APPROVAL_CARD_SETTLED_AUDIT_ACTION as CORE_APPROVAL_CARD_SETTLED_AUDIT_ACTION, auditApprovalCardTap, deploymentOrg, forgetApprovalCardTicket, forgetBridgedQuestion, getOperationalStore, ingressSpendGate, parseApprovalClickId, readBridgedQuestion, readApprovalCardTicket, resolveApprovalCardClick, resolvePartition, unifiedThreadRef, SLACK_SPEND_BADGES, } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackClickerIsGuest, slackForm } from "./slack-events.js";
+const log = (m) => console.log(`[open-everywhere:slack] approval card: ${m}`);
+/** The `input_response.routed` sibling for a tap: an approval settled through a BUTTON rather than a
+ *  typed reply. RE-EXPORTED FROM CORE, never re-spelled here — one action name for every surface, so
+ *  a scorer that joins on the row cannot under-count one of them (OPE-1856). */
+export const APPROVAL_CARD_SETTLED_AUDIT_ACTION = CORE_APPROVAL_CARD_SETTLED_AUDIT_ACTION;
+/** A verified tap that settled nothing, carrying WHICH refusal it was. Core-owned, as above. */
+export const APPROVAL_CARD_REFUSED_AUDIT_ACTION = CORE_APPROVAL_CARD_REFUSED_AUDIT_ACTION;
+/**
+ * Read the one `oe_input:` action out of a verified `block_actions` payload. `undefined` when the
+ * payload is not one of ours or is missing a field the decision needs — the front route then leaves
+ * it alone rather than half-handling it.
+ *
+ * THE FIRST `oe_input:` ACTION WINS and the rest are ignored: Slack sends one action per click, and a
+ * payload carrying two of ours is not a shape this host mints.
+ */
+export function parseSlackApprovalClick(payload) {
+    if (typeof payload !== "object" || payload === null)
+        return undefined;
+    const p = payload;
+    if (!Array.isArray(p.actions))
+        return undefined;
+    let actionId;
+    for (const a of p.actions) {
+        const id = typeof a === "object" && a !== null ? a.action_id : undefined;
+        if (typeof id === "string" && parseApprovalClickId(id) !== undefined) {
+            actionId = id;
+            break;
+        }
+    }
+    if (actionId === undefined)
+        return undefined;
+    const channel = typeof p.channel === "object" && p.channel !== null ? p.channel.id : undefined;
+    const user = typeof p.user === "object" && p.user !== null ? p.user.id : undefined;
+    const team = typeof p.team === "object" && p.team !== null ? p.team.id : undefined;
+    if (typeof channel !== "string" || channel.length === 0)
+        return undefined;
+    if (typeof user !== "string" || user.length === 0)
+        return undefined;
+    return { actionId, channelId: channel, userId: user, ...(typeof team === "string" && team.length > 0 ? { teamId: team } : {}) };
+}
+/** The bindable a partition resolve needs from a raw interactivity payload. The team id is the ONE
+ *  attribute that matters here, and it is read off the wire rather than through a placeholder — the
+ *  same reading, and the same reason, as `slackAuthTeamId` in slack-input-response.ts. */
+function bindableForClick(click) {
+    return {
+        channel: { kind: "slack" },
+        session: { auth: { current: { attributes: { ...(click.teamId ? { team_id: click.teamId } : {}), channel_id: click.channelId } } } },
+    };
+}
+/**
+ * The host copy that rides the delivered answer's `text` — the LABEL THIS DEPLOYMENT PUT ON THE
+ * BUTTON, read back out of the same allowlist that minted it, so the transcript says what the person
+ * actually chose. A tap carries no words, and writing the person's prose for them is not an option.
+ * The fallback capitalises the eve-minted option id, which can only be reached by a row written
+ * before an id left the allowlist; the DECISION is never this value, because eve settles on
+ * `optionId` alone.
+ */
+function approvalAnswerText(optionId) {
+    return APPROVAL_BUTTON_LABELS.get(optionId.toLowerCase())?.label ?? optionId.charAt(0).toUpperCase() + optionId.slice(1);
+}
+/** Show the tapper alone why nothing happened. EPHEMERAL, never a message in the room: the card is
+ *  still live for somebody who may answer it, and a public "you may not answer" note tells the room
+ *  nothing it needs. Best-effort — a failed notice never changes the verdict. */
+async function notifyTapper(channelId, userId, text) {
+    try {
+        await slackForm("chat.postEphemeral", new URLSearchParams({ channel: channelId, user: userId, text }).toString());
+    }
+    catch (err) {
+        log(`refusal notice failed to post: ${String(err)}`);
+    }
+}
+/**
+ * Handle one verified `oe_input:` click: resolve it, admit it, deliver the answer to eve, consume the
+ * rows. NEVER THROWS — the front route has already 200'd the interaction, and an unhandled throw here
+ * would only lose the log line.
+ *
+ * 🔴 THE ANSWER TEXT IS HOST COPY, and it must be. A tap carries no words, so a transcript that read
+ * the button as the person's own prose would be inventing their words. What rides is the host label
+ * this deployment put on that button (`Approve` / `Cancel`), which is what the person actually chose,
+ * and the `optionId` beside it is what eve settles on — `resolveApprovalOutcome` reads `optionId`
+ * ALONE, so the text is transcript only and never the decision.
+ *
+ * 🔴 CONSUME-ONCE, AND BOTH ROWS. The ticket goes so a second tap on the same card cannot answer a
+ * request eve has already settled; the outstanding-question row goes so the room's NEXT message is an
+ * ordinary wake again rather than a second answer to a settled request. Both happen only after eve
+ * accepted the delivery, exactly as the text leg orders them.
+ *
+ * THE LIMIT OF THAT, stated rather than implied: the read and the delete are not one atomic step, and
+ * the delete runs only AFTER `respond` returns, so anything arriving while the first tap is still in
+ * flight resolves against rows that are both still present. Two such deliveries each spend an
+ * admission, each call `respond`, and each can write a settled audit row — so one approval can read
+ * as decided by two taps. It is not a second DECISION: both had to be admitted and both had to name
+ * an option the request offered, and eve's own resolution refuses the second delivery for a request
+ * it already settled. A delivery that arrives after the first settle RETURNED is the covered case —
+ * the ticket is gone and it resolves `no-ticket`.
+ *
+ * 🔴 A SECOND DELIVERY IS MOST LIKELY TO BE SLACK'S OWN, NOT A SECOND PERSON, and this handler does
+ * not ack until the settle returns. Slack expects an interactivity endpoint to answer within about
+ * three seconds; what it does past that — show the tapper a connection error, redeliver, or both —
+ * is VENDOR BEHAVIOUR THIS TREE HAS NOT MEASURED, so do not read the bound above as covering it.
+ * Acking first and settling in the background would remove the delay and widen exactly the window
+ * this paragraph describes; the ordering here takes the narrower window instead. Whoever measures
+ * the real behaviour should revisit that trade, with the measurement written down.
+ */
+export async function handleSlackApprovalCardClick(payload, respond) {
+    // 🔴 HOISTED OUT OF THE `try` SO THE `catch` CAN STAMP ITS ROW (OPE-1856). A throw anywhere below
+    // — including from the partition resolve itself — must still leave a row saying this deployment
+    // took a tap and settled nothing; core's auditor accepts an absent partition for that case.
+    let tapper = "";
+    let auditPartition;
+    try {
+        const click = parseSlackApprovalClick(payload);
+        if (click === undefined)
+            return { handled: false, reason: "not an oe_input: click" };
+        const parsed = parseApprovalClickId(click.actionId);
+        if (parsed === undefined)
+            return { handled: false, reason: "oe_input: action id did not parse" };
+        tapper = click.userId;
+        const org = deploymentOrg();
+        const store = getOperationalStore();
+        const partition = resolvePartition(bindableForClick(click));
+        auditPartition = partition;
+        // THE SPEND GATE FIRST, ahead of the identity admission — the same order and the same reason
+        // `admitSlackInputResponse` takes: over budget outranks identity, and a decline must not spend a
+        // roster lookup. Its refusal copy is its own; a decline here leaves the request PENDING.
+        const spend = await ingressSpendGate({
+            bindable: bindableForClick(click),
+            door: "answer",
+            principalId: click.userId,
+            workspaceRef: click.teamId ?? null,
+            badges: SLACK_SPEND_BADGES,
+            post: async (text) => {
+                await notifyTapper(click.channelId, click.userId, text);
+            },
+        });
+        if (spend === "declined") {
+            // AUDITED, not only logged (OPE-1856): a decline is this deployment refusing a person's tap,
+            // and a refusal nobody can count is indistinguishable from a tap that never arrived.
+            await auditApprovalCardTap({ platform: "slack", principalId: click.userId, partition, outcome: { kind: "refused", reason: "spend-declined" } });
+            log(`tap declined by the spend gate — the approval stays parked`);
+            return { handled: true, reason: "spend-declined" };
+        }
+        // The room the tap came from, in the SAME vocabulary the card's ticket stored — derived through
+        // core's own codec rather than spelled here, so the two sides cannot drift on the key's shape.
+        const containerKey = unifiedThreadRef({ platform: "slack", channelId: click.channelId }).channelKey;
+        const routing = await resolveApprovalCardClick({ ticket: parsed.ticket, optionId: parsed.optionId, containerKey }, {
+            read: (ticket) => readApprovalCardTicket(store, org, ticket),
+            // The join with the TEXT leg — see the dep's own note. Fail-CLOSED on an unreadable row: a
+            // store this leg cannot read cannot say the request is still parked, and settling on that
+            // guess is the one direction that spends a governed decision twice.
+            stillOutstanding: async (bareToken, requestId) => {
+                const outstanding = await readBridgedQuestion(store, org, bareToken).catch(() => undefined);
+                return outstanding?.requestId === requestId;
+            },
+            admit: async () => {
+                // Leg B, the same positive guest verdict both other clicker floors use, and inert on an
+                // unreadable probe (`undefined` never refuses).
+                const answererIsGuest = await slackClickerIsGuest(click.userId, click.teamId).catch(() => undefined);
+                const verdict = await admitInputResponse({
+                    org: partition.org,
+                    platform: partition.platform,
+                    workspace: partition.workspace,
+                    surface: partition.surface,
+                    surfaceKey: partition.surfaceKey,
+                    principalId: click.userId,
+                    responses: 1,
+                    ...(answererIsGuest === undefined ? {} : { answererIsGuest }),
+                });
+                return { ok: verdict.ok, floor: verdict.ok ? verdict.floor : "", notice: verdict.ok ? "" : verdict.notice };
+            },
+        });
+        if (routing.kind === "refuse") {
+            await auditApprovalCardTap({ platform: "slack", principalId: click.userId, partition, outcome: { kind: "refused", reason: routing.reason } });
+            if (routing.notice !== undefined)
+                await notifyTapper(click.channelId, click.userId, routing.notice);
+            log(`tap settled nothing (${routing.reason}) — the approval stays parked and answerable in words`);
+            return { handled: true, reason: routing.reason, ...(routing.notice ? { notice: routing.notice } : {}) };
+        }
+        const label = approvalAnswerText(routing.optionId);
+        // 🔴 DELIVERED BY SESSION ID, never by the window token (OPE-1863): a continuation token is
+        // channel-local, and this route is the SLACK channel's, so `from(bareToken)` here named a
+        // session that never existed and the settle threw into the catch below. The token's job is the
+        // outstanding-question row on the two lines that follow.
+        await respond(routing.sessionId, { requestId: routing.requestId, optionId: routing.optionId, text: label });
+        // CONSUME-ONCE, and only now that eve accepted the delivery. A throw above skips both, which
+        // leaves the card tappable and the question answerable — the safe direction.
+        await forgetApprovalCardTicket(store, org, parsed.ticket);
+        await forgetBridgedQuestion(store, org, routing.bareToken);
+        await auditApprovalCardTap({
+            platform: "slack",
+            principalId: click.userId,
+            partition,
+            outcome: { kind: "settled", requestId: routing.requestId, optionId: routing.optionId, floor: routing.floor },
+        });
+        log(`tap settled ${routing.requestId} as "${routing.optionId}" (floor ${routing.floor})`);
+        return { handled: true, reason: "settled" };
+    }
+    catch (err) {
+        // The approval is still parked and the card is still tappable, so the honest outcome is to say so
+        // and leave both rows in place. Never a throw: this runs after the interaction was acknowledged.
+        // AUDITED, not only logged (OPE-1856): ship #212's S-EVE-CARD leg could not say whether its tap
+        // had been refused or had thrown, because neither arm left a row. `auditApprovalCardTap` never
+        // throws, so this cannot turn a failed tap into a failed response.
+        await auditApprovalCardTap({ platform: "slack", principalId: tapper, ...(auditPartition === undefined ? {} : { partition: auditPartition }), outcome: { kind: "refused", reason: "error" } });
+        log(`tap failed (${err?.message ?? String(err)}) — nothing was settled, the approval stays parked`);
+        return { handled: true, reason: "error" };
+    }
+}
+//# sourceMappingURL=slack-approval-card.js.map

package/dist/agent/channels/slack-approval-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-approval-card.js","sourceRoot":"","sources":["../../../agent/channels/slack-approval-card.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,8DAA8D;AAC9D,EAAE;AACF,sGAAsG;AACtG,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,6FAA6F;AAC7F,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,yFAAyF;AACzF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,sGAAsG;AACtG,yEAAyE;AAEzE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kCAAkC,IAAI,uCAAuC,EAC7E,kCAAkC,IAAI,uCAAuC,EAC7E,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;AAE5F;;gFAEgF;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAC1F,gGAAgG;AAChG,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAwB1F;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,QAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAA6B,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACrE,QAAQ,GAAG,EAAE,CAAC;YACd,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,OAAmC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5H,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClI,CAAC;AAED;;0FAE0F;AAC1F,SAAS,gBAAgB,CAAC,KAA0B;IAClD,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE;KACtG,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED;;iFAEiF;AACjF,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,oBAAoB,EAAE,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAgB,EAAE,OAA0B;IAC7F,kGAAkG;IAClG,gGAAgG;IAChG,4FAA4F;IAC5F,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,cAA+D,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACjG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACtB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,cAAc,GAAG,SAAS,CAAC;QAC3B,6FAA6F;QAC7F,iGAAiG;QACjG,yFAAyF;QACzF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;YACnC,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,YAAY,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAClC,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnB,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;SACF,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YACzB,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAChJ,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACrD,CAAC;QACD,gGAAgG;QAChG,+FAA+F;QAC/F,MAAM,YAAY,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC;QACpG,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,EAClE;YACE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC;YAC5D,2FAA2F;YAC3F,0FAA0F;YAC1F,oEAAoE;YACpE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;gBAC/C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5F,OAAO,WAAW,EAAE,SAAS,KAAK,SAAS,CAAC;YAC9C,CAAC;YACD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,wFAAwF;gBACxF,gDAAgD;gBAChD,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrG,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC;oBACvC,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,WAAW,EAAE,KAAK,CAAC,MAAM;oBACzB,SAAS,EAAE,CAAC;oBACZ,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;iBAC9D,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9G,CAAC;SACF,CACF,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9I,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpG,GAAG,CAAC,wBAAwB,OAAO,CAAC,MAAM,uDAAuD,CAAC,CAAC;YACnG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,4FAA4F;QAC5F,0FAA0F;QAC1F,+FAA+F;QAC/F,yDAAyD;QACzD,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5G,6FAA6F;QAC7F,6EAA6E;QAC7E,MAAM,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,oBAAoB,CAAC;YACzB,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;SAC7G,CAAC,CAAC;QACH,GAAG,CAAC,eAAe,OAAO,CAAC,SAAS,QAAQ,OAAO,CAAC,QAAQ,YAAY,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kGAAkG;QAClG,iGAAiG;QACjG,gGAAgG;QAChG,+FAA+F;QAC/F,mEAAmE;QACnE,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9L,GAAG,CAAC,eAAgB,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/agent/channels/slack-attachments.d.ts

@@ -0,0 +1,66 @@
+/** A resolved attachment record — its `urlPrivate` came from a Slack event's `files[].url_private`
+ *  (trusted provenance), never a model-supplied string. */
+export interface SlackAttachmentRecord {
+    /** The Slack `url_private` download URL from the event's `files[]`. */
+    readonly urlPrivate: string;
+    /** IANA media type from the event (`files[].mimetype`), when known — describe_image uses it
+     *  because the id-based ref carries no filename extension to infer from. */
+    readonly mimeType?: string;
+    /** Original filename from the event, when known — the raw-bytes read path (read_file_upload)
+     *  infers a type from its extension when the mimetype is absent. */
+    readonly name?: string;
+    /** The Slack team id the event belonged to (for future multi-bot token routing). */
+    readonly teamId?: string;
+    /** The platform that minted this attachment id — always "slack" for records written here. Stamped
+     *  at ingest so the attachment plane's provenance is explicit end to end (channels/attachments.ts). */
+    readonly platform?: "slack";
+}
+/**
+ * Record an image attachment's trusted `url_private` under its Slack file id. THIS LIST IS THE
+ * AUDIT LIST for "who may write a fetchable url_private into the registry", so keep it exact.
+ * Two writers, both of trusted provenance:
+ *   • `parseMessageEvent` (slack-events.ts) — an Events API message, which only arrives for a room
+ *     the app is subscribed to and in;
+ *   • `registerAttachments` in the front route's SHORTCUT branch (slack-front.ts) — a message
+ *     shortcut, which Slack delivers even for a room the app is NOT in. It therefore registers
+ *     only what that branch's readability and wake gates admitted (OPE-1442). The shortcut PARSER
+ *     registers nothing: it runs at classification time, in front of those gates.
+ * A falsy id or an empty url is ignored (nothing to resolve later). Re-registering an id refreshes
+ * its recency.
+ */
+export declare function registerSlackAttachment(fileId: string | undefined, rec: SlackAttachmentRecord): void;
+/** The trusted record for a Slack file id, or undefined when this session never saw an event
+ *  carrying it (→ describe_image fails closed rather than fetching an arbitrary URL). PROCESS-LOCAL:
+ *  a cross-process worker must go through {@link resolveSlackAttachmentDurable}. */
+export declare function resolveSlackAttachment(fileId: string): SlackAttachmentRecord | undefined;
+/**
+ * Mirror one event attachment into the DURABLE store (task #107) so a delegated worker in a
+ * SEPARATE process can resolve it. Called ONLY from the trusted parse-consumption path (slack-front),
+ * with `org` resolved from the same event — never a model-supplied string. Best-effort: a store
+ * failure must never break the wake (the in-memory path still serves the same-process seat), so it
+ * swallows and logs. `org` defaults to the deployment org (single-tenant) when omitted.
+ */
+export declare function persistSlackAttachment(fileId: string | undefined, rec: SlackAttachmentRecord, org?: string): Promise<void>;
+/**
+ * Resolve a file id ACROSS processes: the in-memory registry first (same-process fast path), then
+ * the durable store (the cross-process bridge a delegated worker needs). Returns undefined when
+ * neither knows the id (→ the caller fails closed rather than fetching an arbitrary URL). `org`
+ * defaults to the deployment org (single-tenant) when omitted.
+ */
+export declare function resolveSlackAttachmentDurable(fileId: string, org?: string): Promise<SlackAttachmentRecord | undefined>;
+/**
+ * Register Slack as an attachment-plane resolver (channels/attachments.ts) — the neutral seam
+ * describe_image consults so its contract carries no per-platform union arm. The resolver wraps the
+ * SAME two guarantees the in-memory/durable registry + host-pinned fetch already provide:
+ *   • it resolves a model-named id ONLY through the trusted registry (in-memory then durable,
+ *     org-scoped) — an id no real Slack event recorded returns `undefined`, so the plane fails
+ *     closed rather than fetching an arbitrary URL;
+ *   • the download rides `fetchSlackAttachment` (bot token, HOST-PINNED to Slack, SSRF-guarded,
+ *     redirect:error) against the event-supplied `url_private` — never a model string.
+ * A recognised id whose fetch fails THROWS (the plane surfaces it as a fetch failure), distinct
+ * from an unknown id (undefined). Idempotent per platform key.
+ */
+export declare function registerSlackAttachmentResolver(): void;
+/** Test seam: clear the in-memory registry so a test starts from empty. */
+export declare function _resetSlackAttachmentsForTest(): void;
+//# sourceMappingURL=slack-attachments.d.ts.map

package/dist/agent/channels/slack-attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-attachments.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AAsCA;2DAC2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;gFAC4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;wEACoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;2GACuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,GAAG,IAAI,CASpG;AAED;;oFAEoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAExF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahI;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAY5H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAoCtD;AAMD,2EAA2E;AAC3E,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/agent/channels/slack-attachments.js

@@ -0,0 +1,174 @@
+// Trusted Slack attachment registry — the provenance bridge between a Slack event's
+// `files[].url_private` and the `describe_image` tool.
+//
+// THE PROBLEM IT SOLVES. A Slack image sits behind `url_private`, which needs the bot token to
+// download. That token must NEVER ride a model-chosen URL (an exfil channel). So describe_image
+// can't let the model hand it a Slack URL string — but the model still needs to point at *which*
+// image it wants to see. This registry is the indirection: the wake pipeline (parseMessageEvent)
+// registers each image attachment's `url_private` under its Slack FILE ID (trusted provenance —
+// the event, not the model). describe_image's slack-attachment path takes a model-named file id,
+// resolves it HERE to the event-supplied `url_private`, and hands THAT to the authenticated fetch
+// helper (access/slack-attachment-fetch.ts). A model-supplied URL string can therefore never reach
+// the token-bearing fetch — the model can only *name* an id that a real event already recorded.
+//
+// BOUNDED: a long-lived process must not accumulate url_private entries without limit, so the map
+// evicts oldest-first past a cap. An evicted id simply fails closed in describe_image ("no such
+// attachment") — a re-post (or a fresh wake) re-registers it. url_private links are themselves
+// short-lived Slack-side, so unbounded retention would be pointless as well as leaky.
+//
+// THE CROSS-PROCESS HALF (task #107). The map above is PROCESS-LOCAL, so a DELEGATED worker — a
+// one-shot task in a SEPARATE session/process from the seat that saw the upload (delegation-reshape-
+// plan-2026-07-16.md) — can't resolve a file id it never received, and "read this uploaded file"
+// couldn't be delegated. `persistSlackAttachment` mirrors each event attachment into the DURABLE
+// operational store (org-scoped, TTL-pruned), and `resolveSlackAttachmentDurable` reads in-memory
+// first (same-process fast path) then the store (cross-process). Written ONLY from the trusted parse
+// path — never a model string — the same provenance contract the in-memory map holds. Non-image
+// uploads are persisted too (the in-memory map is image-only for describe_image), so the raw-bytes
+// read path (read_file_upload) can resolve a CSV/text/log an image reader never registered.
+import { getOperationalStore, deploymentOrg, resolvePartition, registerAttachmentResolver, AttachmentOversizeError, } from "@open-everywhere/core/agent/adapter-api.js";
+import { fetchSlackAttachment } from "../access/slack-attachment-fetch.js";
+/** How long a durable attachment row is retained. Slack `url_private` links are short-lived
+ *  server-side, and a delegated worker resolves its brief within hours — a day bounds the table
+ *  without stranding a legitimately slow task. */
+const SLACK_ATTACHMENT_TTL_MS = 24 * 60 * 60 * 1000;
+const MAX_ENTRIES = 1000;
+const registry = new Map();
+/**
+ * Record an image attachment's trusted `url_private` under its Slack file id. THIS LIST IS THE
+ * AUDIT LIST for "who may write a fetchable url_private into the registry", so keep it exact.
+ * Two writers, both of trusted provenance:
+ *   • `parseMessageEvent` (slack-events.ts) — an Events API message, which only arrives for a room
+ *     the app is subscribed to and in;
+ *   • `registerAttachments` in the front route's SHORTCUT branch (slack-front.ts) — a message
+ *     shortcut, which Slack delivers even for a room the app is NOT in. It therefore registers
+ *     only what that branch's readability and wake gates admitted (OPE-1442). The shortcut PARSER
+ *     registers nothing: it runs at classification time, in front of those gates.
+ * A falsy id or an empty url is ignored (nothing to resolve later). Re-registering an id refreshes
+ * its recency.
+ */
+export function registerSlackAttachment(fileId, rec) {
+    if (!fileId || !rec.urlPrivate)
+        return;
+    if (registry.has(fileId))
+        registry.delete(fileId); // refresh insertion order (LRU-ish)
+    registry.set(fileId, { ...rec, platform: "slack" }); // stamp provenance for the attachment plane
+    while (registry.size > MAX_ENTRIES) {
+        const oldest = registry.keys().next().value;
+        if (oldest === undefined)
+            break;
+        registry.delete(oldest);
+    }
+}
+/** The trusted record for a Slack file id, or undefined when this session never saw an event
+ *  carrying it (→ describe_image fails closed rather than fetching an arbitrary URL). PROCESS-LOCAL:
+ *  a cross-process worker must go through {@link resolveSlackAttachmentDurable}. */
+export function resolveSlackAttachment(fileId) {
+    return registry.get(fileId);
+}
+/**
+ * Mirror one event attachment into the DURABLE store (task #107) so a delegated worker in a
+ * SEPARATE process can resolve it. Called ONLY from the trusted parse-consumption path (slack-front),
+ * with `org` resolved from the same event — never a model-supplied string. Best-effort: a store
+ * failure must never break the wake (the in-memory path still serves the same-process seat), so it
+ * swallows and logs. `org` defaults to the deployment org (single-tenant) when omitted.
+ */
+export async function persistSlackAttachment(fileId, rec, org) {
+    if (!fileId || !rec.urlPrivate)
+        return;
+    const row = {
+        urlPrivate: rec.urlPrivate,
+        ...(rec.mimeType ? { mimeType: rec.mimeType } : {}),
+        ...(rec.name ? { name: rec.name } : {}),
+        ...(rec.teamId ? { teamId: rec.teamId } : {}),
+    };
+    try {
+        await getOperationalStore().putSlackAttachment(org ?? deploymentOrg(), fileId, row, new Date().toISOString(), SLACK_ATTACHMENT_TTL_MS);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:slack-attachments] dropped a durable attachment row for "${fileId}": ${String(err)}`);
+    }
+}
+/**
+ * Resolve a file id ACROSS processes: the in-memory registry first (same-process fast path), then
+ * the durable store (the cross-process bridge a delegated worker needs). Returns undefined when
+ * neither knows the id (→ the caller fails closed rather than fetching an arbitrary URL). `org`
+ * defaults to the deployment org (single-tenant) when omitted.
+ */
+export async function resolveSlackAttachmentDurable(fileId, org) {
+    const local = registry.get(fileId);
+    if (local)
+        return local;
+    try {
+        const row = await getOperationalStore().getSlackAttachment(org ?? deploymentOrg(), fileId);
+        // Stamp provenance on the durable read too (the store is Slack-specific) so every resolved
+        // SlackAttachmentRecord carries `platform`, cross-process included.
+        return row ? { ...row, platform: "slack" } : undefined;
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:slack-attachments] durable attachment lookup for "${fileId}" failed: ${String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * Register Slack as an attachment-plane resolver (channels/attachments.ts) — the neutral seam
+ * describe_image consults so its contract carries no per-platform union arm. The resolver wraps the
+ * SAME two guarantees the in-memory/durable registry + host-pinned fetch already provide:
+ *   • it resolves a model-named id ONLY through the trusted registry (in-memory then durable,
+ *     org-scoped) — an id no real Slack event recorded returns `undefined`, so the plane fails
+ *     closed rather than fetching an arbitrary URL;
+ *   • the download rides `fetchSlackAttachment` (bot token, HOST-PINNED to Slack, SSRF-guarded,
+ *     redirect:error) against the event-supplied `url_private` — never a model string.
+ * A recognised id whose fetch fails THROWS (the plane surfaces it as a fetch failure), distinct
+ * from an unknown id (undefined). Idempotent per platform key.
+ */
+export function registerSlackAttachmentResolver() {
+    registerAttachmentResolver({
+        platform: "slack",
+        async resolve(attachmentId, ctx) {
+            const rec = await resolveSlackAttachmentDurable(attachmentId, resolvePartition(ctx).org);
+            if (!rec)
+                return undefined; // not a Slack id we saw → let the plane fail closed
+            const res = await fetchSlackAttachment(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId });
+            if (!res.ok)
+                throw new Error(`fetching Slack attachment "${attachmentId}" failed (HTTP ${res.status})`);
+            return { bytes: new Uint8Array(await res.arrayBuffer()), ref: `slack-file:${attachmentId}`, mimeType: rec.mimeType };
+        },
+        // Size-guarded variant (task #107) for read_file_upload's raw-bytes read path. It resolves the
+        // TRUSTED record up front (no fetch) so the caller can refuse a type before any download, then
+        // defers the host-pinned, bot-token fetch to `pull` — which preserves the Content-Length
+        // pre-check EXACTLY: it rejects (AttachmentOversizeError, phase "declared") off the declared
+        // length BEFORE reading the body, and re-checks the actual byte count after (phase "actual").
+        async resolveGuarded(attachmentId, ctx) {
+            const rec = await resolveSlackAttachmentDurable(attachmentId, resolvePartition(ctx).org);
+            if (!rec)
+                return undefined; // not a Slack id we saw → let the plane fail closed
+            return {
+                ref: `slack-file:${attachmentId}`,
+                mimeType: rec.mimeType,
+                name: rec.name,
+                async pull({ maxBytes }) {
+                    const res = await fetchSlackAttachment(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId });
+                    if (!res.ok)
+                        throw new Error(`fetching the upload failed (HTTP ${res.status})`);
+                    // Content-Length pre-check off the declared length — reject before reading the body.
+                    const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+                    if (Number.isFinite(declared) && declared > maxBytes)
+                        throw new AttachmentOversizeError(declared, "declared", maxBytes);
+                    const bytes = new Uint8Array(await res.arrayBuffer());
+                    // Post-read cap — a chunked response can exceed the (possibly-absent) Content-Length.
+                    if (bytes.byteLength > maxBytes)
+                        throw new AttachmentOversizeError(bytes.byteLength, "actual", maxBytes);
+                    return bytes;
+                },
+            };
+        },
+    });
+}
+// NOTE (OPE-114 stage 4): the resolver is no longer wired at module load — registerSlackProvider()
+// (agent/register.ts) calls registerSlackAttachmentResolver() at boot, the same "register in every
+// process" posture (register-adapters.ts runs in every process that can execute describe_image).
+/** Test seam: clear the in-memory registry so a test starts from empty. */
+export function _resetSlackAttachmentsForTest() {
+    registry.clear();
+}
+//# sourceMappingURL=slack-attachments.js.map

package/dist/agent/channels/slack-attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-attachments.js","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAC/F,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,qGAAqG;AACrG,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAE5F,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAoB3E;;kDAEkD;AAClD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA0B,EAAE,GAA0B;IAC5F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC;IACvF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,4CAA4C;IACjG,OAAO,QAAQ,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;oFAEoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAA0B,EAAE,GAA0B,EAAE,GAAY;IAC/G,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,MAAM,GAAG,GAAuB;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6EAA6E,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAY;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,2FAA2F;QAC3F,oEAAoE;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sEAAsE,MAAM,aAAa,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B;IAC7C,0BAA0B,CAAC;QACzB,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG;YAC7B,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACxG,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvH,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,yFAAyF;QACzF,6FAA6F;QAC7F,8FAA8F;QAC9F,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG;YACpC,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,OAAO;gBACL,GAAG,EAAE,cAAc,YAAY,EAAE;gBACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE;oBACrB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;oBAChF,qFAAqF;oBACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;wBAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACxH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;oBACtD,sFAAsF;oBACtF,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;wBAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACzG,OAAO,KAAK,CAAC;gBACf,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AAEjG,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B;IAC3C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/agent/channels/slack-commands.d.ts

@@ -0,0 +1,27 @@
+import { type BindableContext } from "@open-everywhere/core/agent/adapter-api.js";
+/** The public URL Slack POSTs the "/oe" slash command to (the app's Slash Command Request URL). */
+export declare const SLACK_COMMANDS_ROUTE = "/eve/v1/slack/commands";
+/** Build the BindableContext the identity seam (bindFrom/bindSlack) expects from Slack's
+ *  slash-command form fields. Slack's slash-command payload carries no `channel_type` /
+ *  `is_private` bit (unlike an app_mention/message event) — `bindSlack`'s existing fallbacks
+ *  already handle that (DM detection via the `channel_id`'s "D" prefix; visibility fails
+ *  closed to private), same posture as every other under-specified Slack event.
+ *
+ *  🔴 IT DOES CARRY THE ENTERPRISE GRID RUNG (OPE-1559). Slack sends `enterprise_id` as a form field
+ *  on a Grid, beside `team_id`, and it reaches `RawIdentity.trustEnterprise` → the declaration walk →
+ *  `binding.declaredTrust`. That is the OPERATOR-DECLARATION half — the half `roomVouchedInternalFrom`
+ *  reads — so a Grid declared once now answers here the same way it answers at every other door,
+ *  instead of resolving as though the line were absent.
+ *
+ *  🔴 STATE ITS REACH EXACTLY, because this door is narrower than the wake doors. For a CHANNEL
+ *  command it does NOT change `binding.trust`: this payload carries no `conversations.info` verdict,
+ *  so `slackTrust(undefined, undefined, "channel")` fails closed to `external`, and `bindFrom` takes
+ *  that raw verdict ahead of any vouch. So a channel `/oe` stays `trust: "external"` with the rung
+ *  and without it, and the budget scope `domainNameForScope` picks is unchanged. The rung reaches
+ *  `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), where the mapper leaves trust
+ *  undefined and the vouch is what answers. Spread conditionally, like every other door: a
+ *  single-workspace install stamps nothing. */
+export declare function bindableForSlashCommand(params: URLSearchParams): BindableContext;
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=slack-commands.d.ts.map

package/dist/agent/channels/slack-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-commands.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAoCA,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,4CAA4C,CAAC;AAOpD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAS7D;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkBhF"}