@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack-identity.js

@@ -0,0 +1,405 @@
+// Pure Slack→OpenEverywhere identity capture AND interpretation. The Slack channel (slack.ts)
+// calls the capture half to stow RAW Slack facts (team/channel/user ids + channel_type +
+// is_private) into the session auth context's `attributes`; the INTERPRETATION of those facts into
+// mode/visibility/trust (slackMode/slackVisibility/slackTrust + the bindSlack mapper) moved here
+// from core identity/binding.ts in OPE-114 stage 4 — still one tested place for the
+// security-critical "is this private?" decision, now on the bundle side of the boundary.
+import { AsyncLocalStorage } from "node:async_hooks";
+import { declaredWorkspaceTrust, rootDmGrainAttrs, surfaceKeySegment, } from "@open-everywhere/core/agent/adapter-api.js";
+/** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
+export function buildSlackAuth(input) {
+    const attributes = {
+        channel_id: input.channelId,
+        user_id: input.userId,
+    };
+    if (input.teamId)
+        attributes.team_id = input.teamId;
+    if (input.enterpriseId)
+        attributes.enterprise_id = input.enterpriseId;
+    if (input.threadTs)
+        attributes.thread_ts = input.threadTs;
+    if (input.channelType)
+        attributes.channel_type = input.channelType;
+    if (typeof input.isPrivate === "boolean")
+        attributes.is_private = String(input.isPrivate);
+    if (typeof input.isExternal === "boolean")
+        attributes.is_ext_shared = String(input.isExternal);
+    if (typeof input.trustChecked === "boolean")
+        attributes.trust_checked = String(input.trustChecked);
+    if (input.dmPartnerTrust)
+        attributes.dm_partner_trust = input.dmPartnerTrust;
+    // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 DM OR an mpim (group
+    // DM) is a STANDING seat ⇒ narrowed hands — both are closed multi-party conversations with no
+    // channel identity. A DM is unambiguously channelType "im" (the DM path always sets it); the
+    // id-prefix "D" is the slackMode fallback for a DM with no type captured. mpim is ONLY matched via
+    // the explicit channelType — Slack's legacy "G"-prefixed ids are ambiguous between mpim and a
+    // private "group" channel, so there is no safe id-prefix fallback for it (unlike "D"/DM);
+    // channelType undefined ⇒ never inferred as mpim (fails closed to unstamped/full, not over-narrowed).
+    const isDmFamily = input.channelType === "im" || input.channelType === "mpim" || (input.channelType === undefined && input.channelId.startsWith("D"));
+    Object.assign(attributes, rootDmGrainAttrs(isDmFamily));
+    return { authenticator: "slack", principalId: input.userId, principalType: "slack-user", attributes };
+}
+const forwardedEnvelope = new AsyncLocalStorage();
+/**
+ * Run `fn` with `envelope` readable by anything it awaits. ONE caller — `slack-front.ts`'s
+ * `forwardNative`, around the hand-off to eve's native `slackChannel`. Do not wrap anything else:
+ * the value means "the envelope of the delivery being forwarded right now", and a second writer
+ * would make that false.
+ *
+ * `undefined` runs `fn` with NO carrier, so an ordinary single-workspace install (and any body the
+ * front could not parse) costs one `AsyncLocalStorage.run` and stows nothing.
+ */
+export function withForwardedSlackEnvelope(envelope, fn) {
+    return envelope === undefined ? fn() : forwardedEnvelope.run(envelope, fn);
+}
+/**
+ * The Enterprise Grid organisation of the message being handled on the native forward, or
+ * `undefined` outside a forward, on a non-Grid delivery, or for any message the carrier does not
+ * describe. See the block above for why the match is checked rather than assumed.
+ */
+export function forwardedSlackEnterpriseId(message) {
+    const carried = forwardedEnvelope.getStore();
+    if (!carried)
+        return undefined;
+    return carried.channelId === message.channelId && carried.ts === message.ts ? carried.enterpriseId : undefined;
+}
+/**
+ * The Enterprise Grid organisation a `users.info` user object belongs to (`E…`), or `undefined`.
+ * Grid nests it as `enterprise_user: { enterprise_id }`; an ordinary workspace's user object carries
+ * no such field, so every level is probed rather than assumed (Slack's raw JSON).
+ */
+function enterpriseIdOfUser(u) {
+    const eu = u["enterprise_user"];
+    if (!eu || typeof eu !== "object")
+        return undefined;
+    const id = eu["enterprise_id"];
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/**
+ * Does the operator's tracked config vouch this Slack WORKSPACE — the rung walk a person's home
+ * workspace goes through when it is NOT the workspace the event arrived in (OPE-1508, Tommy's ruling
+ * of 2026-09-07).
+ *
+ * 🔴 THE PROBLEM IT SOLVES. On Enterprise Grid a person's home `team_id` is their own workspace, not
+ * the workspace the message was posted in, so the plain `team_id === expectedTeamId` test read every
+ * Grid colleague as a stranger. The fix is NOT to stop comparing: it is to ask the register whether
+ * the author's OWN workspace is vouched, and the enterprise rung is what lets one line answer for
+ * every workspace in the Grid —
+ * `defineSurface({ key: "slack/E0GRID", trust: "internal" })`.
+ *
+ * 🔴 ABSENCE INFERS NON-MEMBER, which is the ruling's other half. An undeclared sibling workspace is
+ * a GUEST here, exactly as a Slack Connect stranger from an unrelated org is. The operator vouches by
+ * writing a line in `agent/identity/surfaces.ts`; there is no probe that could infer it, and a Grid
+ * an operator has not named is not one this deployment has asserted anything about.
+ *
+ * PURE and SYNCHRONOUS — the register read is (identity/trust.ts's own contract), so this adds no
+ * I/O to a leg that already pays for one `users.info`.
+ */
+export function slackWorkspaceVouched(teamId, enterpriseId) {
+    const team = surfaceKeySegment(teamId);
+    if (team.length === 0)
+        return false; // no workspace named ⇒ nothing to ask about ⇒ not vouched
+    const enterprise = surfaceKeySegment(enterpriseId);
+    return (declaredWorkspaceTrust(`slack/${team}`, enterprise.length === 0 ? undefined : `slack/${enterprise}`) === "internal");
+}
+/**
+ * DM-partner trust from a `users.info` response — the authoritative source for "is this person an
+ * internal member?". Defensive (Slack's raw JSON) and FAIL-CLOSED: a missing/failed lookup, a guest
+ * (restricted / ultra_restricted), a Connect stranger, a deleted account, or a workspace this
+ * deployment does not admit all yield `external`. Mirrors channelFactsFromInfo for the DM universe,
+ * and — since OPE-466 — it is also the ONE reader behind the per-author membership probe
+ * (`slackAuthorIsMember`), so a DM partner and a channel/group-DM author cannot drift apart on what
+ * a member is.
+ *
+ * 🔴 THE WORKSPACE TEST IS A RUNG WALK, NOT AN EQUALITY (OPE-1508). The author's OWN workspace
+ * answers first and needs no declaration: `team_id === expectedTeamId` is a member, which is what
+ * every single-workspace deployment has always relied on. A DIFFERENT workspace then asks the
+ * operator's register through {@link slackWorkspaceVouched}, so an Enterprise Grid colleague whose
+ * home `team_id` is a sibling workspace is a member when the operator declared the Grid, and a guest
+ * when they did not. Read the ruling in {@link slackWorkspaceVouched}.
+ *
+ * 🔴 AN ABSENT `expectedTeamId` IS A GUEST QUESTION, NOT A SKIPPED ONE. A caller that knows no
+ * workspace gets the register walk alone, so an undeclared author is a guest. The body says which
+ * live envelope produces that absence and what admitting it cost.
+ *
+ * 🔴 A BOT IS JUDGED BY ITS WORKSPACE, WITH NO CARVE-OUT (OPE-1508, the same ruling). `is_bot` used
+ * to refute on its own, which marked the deployment's OWN admitted apps as guests — including the
+ * e2e driver bot in a group DM. It is gone from the refutation: the workspace's own app carries that
+ * workspace's `team_id` and is a member, a foreign app carries another and is a guest unless the
+ * operator vouched its workspace. `deleted` still refutes, because a deleted account is not a member
+ * of anything.
+ *
+ * 🔴 WHAT THIS WIDENS — EVERY CONSUMER, NOT THE FIRST ONE. This verdict has four readers, and both
+ * halves of the ruling (a bot is not refuted; a declared foreign workspace is admitted) reach all
+ * four. Naming one and calling it plain is how a wrong claim survives:
+ *   1. the 1:1 DM's SHARED READ LAYER — `internal` selects the org brain, so a DM with the
+ *      workspace's own app now binds `internal` where it bound `external`;
+ *   2. the CHAT AUTHOR TAINT — `slackAuthorIsMember` (slack-events.ts), which stamps
+ *      `oe_chat_nonmember`, fences the author's words, and is what the member plane refuses on;
+ *   3. the APPROVAL CLICKER FLOOR leg D (access/../approvals/clicker-floor.ts), through
+ *      `slackClickerIsGuest` — who may EXECUTE a member-tier approval card;
+ *   4. the HITL ANSWER FLOOR leg B (approvals/input-response-floor.ts), same probe — who may resume
+ *      a parked turn, which is a spend commitment.
+ * So a workspace-installed app's bot user, and a person in a partner workspace the operator declared
+ * internal, now clear (3) and (4) where they were refused as guests. That is the ruling applied
+ * consistently rather than a side effect — the bot rule was asked and answered at the author leg,
+ * and one function is what keeps the four readers from disagreeing — but it is a wider change than
+ * the DM layer alone, so it is written here in full.
+ *
+ * The guest flags are unchanged and still refute on every one of the four. Consumers (3) and (4)
+ * describe this same rule in their own headers, corrected under OPE-1558 — they sit behind the merge
+ * fence's approvals-plane rule, which is why the correction landed in its own reviewed change rather
+ * than in this one.
+ */
+export function partnerFactsFromInfo(info, expectedTeamId) {
+    const u = info?.user;
+    if (!u || typeof u !== "object")
+        return { dmPartnerTrust: "external" }; // lookup failed → fail closed
+    const guestOrStranger = Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+    const deleted = Boolean(u["deleted"]);
+    const homeTeamId = typeof u["team_id"] === "string" ? u["team_id"] : undefined;
+    // 🔴 NO EXPECTED WORKSPACE IS NOT AN OWN-WORKSPACE ANSWER. This used to read the absence as
+    // "member", which admitted EVERY author the guest flags did not refute. The absence is reachable
+    // from the callers, not hypothetical: `slack-events.ts` builds its `teamId` as
+    // `envelope.team_id ?? e.team` and `slack-input-response.ts` reads the raw `team_id` attribute, so
+    // an inbound payload that names no workspace hands `undefined` down here. The shape expected to
+    // produce it is a Grid ORG-WIDE install, which carries an `enterprise_id`; that vendor detail is
+    // NOT verified here, and nothing below rests on it — the arm is fail-closed either way. With
+    // `is_bot` gone from the refutation (the ruling above), a
+    // FOREIGN app's bot user carrying no `is_restricted` / `is_stranger` flag then resolved as a
+    // MEMBER — no `oe_chat_nonmember` stamp, no untrusted fence, and the same wrong verdict on both
+    // approval floors. So absence falls to the register walk below, exactly as a differing workspace
+    // does: ABSENCE INFERS NON-MEMBER. A Grid the operator declared still answers `internal` here,
+    // because the walk reads the author's OWN home workspace and enterprise off `users.info` and needs
+    // nothing from the envelope.
+    const ownWorkspace = expectedTeamId !== undefined && expectedTeamId.length > 0 && homeTeamId === expectedTeamId;
+    const admittedWorkspace = ownWorkspace || slackWorkspaceVouched(homeTeamId, enterpriseIdOfUser(u));
+    const internal = !guestOrStranger && !deleted && admittedWorkspace;
+    return { dmPartnerTrust: internal ? "internal" : "external" };
+}
+/** What an app_mention envelope tells us directly (often just channel_type). */
+export function channelFactsFromRaw(raw) {
+    const channelType = typeof raw["channel_type"] === "string" ? raw["channel_type"] : undefined;
+    return { channelType };
+}
+/**
+ * Facts from a `conversations.info` response — the authoritative source for the
+ * public/private bit AND the external-sharing bit that app_mention events don't carry.
+ * Defensive: the response is Slack's raw JSON, so everything is probed, never assumed.
+ *
+ * External sharing is the memory trust signal: a Slack Connect / shared / org-shared
+ * channel may contain people outside the org, so its memory is gated off entirely
+ * (binding.ts slackTrust). We treat ANY of is_shared / is_ext_shared / is_org_shared /
+ * is_pending_ext_shared as external. A successful fetch sets `trustChecked: true` so the
+ * binding can distinguish "checked, internal" from "never checked" (which fails closed).
+ */
+export function channelFactsFromInfo(info) {
+    const ch = info?.channel;
+    if (!ch || typeof ch !== "object")
+        return {};
+    const isPrivate = typeof ch["is_private"] === "boolean" ? ch["is_private"] : undefined;
+    const isExternal = Boolean(ch["is_ext_shared"] || ch["is_org_shared"] || ch["is_shared"] || ch["is_pending_ext_shared"]);
+    let channelType;
+    if (ch["is_im"])
+        channelType = "im";
+    else if (ch["is_mpim"])
+        channelType = "mpim";
+    else if (ch["is_group"] || ch["is_private"])
+        channelType = "group";
+    else if (ch["is_channel"])
+        channelType = "channel";
+    // `is_member` is the APP's own membership of the room. Slack sends it for a channel/group and
+    // omits it for a DM, so a missing field stays undefined rather than becoming false — the
+    // readability rule (slack-events.ts appCanReadConversation) decides what a missing field means
+    // per channel type, and this function only reports what Slack said.
+    //
+    // 🔴 THE PRIVATE-CHANNEL HALF IS MEASURED (OPE-1447, 2026-09-08). A live `conversations.info` on a
+    // private fixture channel the caller is in answered `is_member: true` — the field is PRESENT for a
+    // private channel, so `appCanReadConversation` returns readable and the shortcut route keeps that
+    // room's files. It also answered `is_private: true, is_channel: true, is_group: false`: Slack no
+    // longer returns the legacy `is_group` shape for a private channel, which is why the `is_private`
+    // arm above is load-bearing rather than belt-and-braces. Measured with a USER token, not the app's
+    // bot token, so what stays unproven is narrow: whether a BOT token gets the same field.
+    const appInChannel = typeof ch["is_member"] === "boolean" ? ch["is_member"] : undefined;
+    // The fetch succeeded (we have a channel object), so trust is authoritatively known.
+    return { channelType, isPrivate, isExternal, trustChecked: true, ...(appInChannel === undefined ? {} : { appInChannel }) };
+}
+/**
+ * Can THIS APP read the conversation {@link channelFactsFromInfo} just described? Positive and
+ * FAIL-CLOSED: it says yes only on a probe that SUCCEEDED and said the app is in the room.
+ *
+ * The rule differs by channel type because Slack's answer does:
+ *   • a `channel` or `group` carries `is_member`, which is exactly "is this app in the room" — the
+ *     fact `conversations.history` enforces when it refuses a non-member with `not_in_channel`. A
+ *     public channel the app never joined answers `is_member: false` on a lookup that otherwise
+ *     SUCCEEDS, so `trustChecked` alone would admit it;
+ *   • an `im` or `mpim` carries no `is_member`, so this arm rests on an INFERENCE, not on a checked
+ *     fact: Slack is documented to answer `conversations.info` for a DM only to an app that is in
+ *     it, and a room the app cannot see answers `channel_not_found` — which reaches here as no
+ *     channel object at all, hence no `trustChecked`. STILL UNMEASURED (OPE-1447), in the same sense
+ *     `shortcutWakeKey`'s trigger-id assumption is: no offline tier can drive a live
+ *     `conversations.info` against a DM the app is not in. A 2026-09-08 attempt got as far as a
+ *     `channel_not_found` for a non-member caller, which POINTS the right way but proves nothing:
+ *     neither e2e Slack token holds `im:read`, so the member CONTROL could not be driven, and
+ *     `channel_not_found` without it may be the no-scope answer rather than the no-membership one.
+ *     Settling it needs one probe under the app's own BOT token, on a ship soak. If the inference is
+ *     wrong, this arm admits that DM's files. The channel/group arm below does not depend on it;
+ *   • anything else — a failed probe, a missing token, an unrecognised channel type — is NO.
+ *
+ * The Slack shortcut route reads it (OPE-1442): Slack delivers a `message_action` for a room the
+ * app is not in, so this is what keeps the target message's FILES from being fetched with the bot
+ * token out of a room the agent's own channel reads refuse.
+ */
+export function appCanReadConversation(facts) {
+    if (facts.trustChecked !== true)
+        return false;
+    if (facts.channelType === "im" || facts.channelType === "mpim")
+        return true;
+    return facts.appInChannel === true;
+}
+/** Slack channel_type / id → session mode (channel | dm | mpim). */
+export function slackMode(channelType, channelId) {
+    if (channelType === "im")
+        return "dm";
+    if (channelType === "mpim")
+        return "mpim";
+    if (channelType === "channel" || channelType === "group")
+        return "channel";
+    // No type captured — the `D` id prefix reliably marks a DM; otherwise assume a channel.
+    if (channelId && channelId.startsWith("D"))
+        return "dm";
+    return "channel";
+}
+/**
+ * Slack facts → visibility. FAIL CLOSED: anything we can't positively confirm as
+ * a public channel is treated as `private`, so a surface's learnings never leak
+ * up to shared memory on an under-specified event. (A correctly-wired channel
+ * always sets is_private, so the fail-closed branch is the misconfigured/unknown
+ * case, where private is the safe default.)
+ */
+export function slackVisibility(channelType, isPrivate, mode) {
+    if (isPrivate === "true")
+        return "private";
+    if (isPrivate === "false")
+        return "public";
+    // DMs / group-DMs are never "public" surfaces.
+    if (mode === "dm" || mode === "mpim")
+        return "private";
+    if (channelType === "channel")
+        return "public"; // an explicit public channel
+    return "private"; // unknown -> fail closed
+}
+/**
+ * Slack sharing facts → trust. FAIL CLOSED for shared memory: a positively
+ * externally-shared channel (`is_ext_shared="true"`) is `external`; so is a channel we
+ * never managed to check (`trust_checked` not "true") — because on a real Slack channel
+ * we always attempt conversations.info, so an absent check means the lookup failed and
+ * we can't vouch for the membership.
+ *
+ * 🔴 A GROUP DM READS THE PLATFORM'S POSITIVE EXTERNAL SIGNAL, EXACTLY AS A CHANNEL DOES
+ * (OPE-1486, Tommy's 2026-09-07 ruling). A group DM is a shared room with several people in it,
+ * so `binding.trust` on an mpim is the DEMOTION half of the member plane's G4b vouch
+ * (access/member-plane.ts `roomVouchedInternalFrom`): the operator's declaration vouches the room
+ * at any rung, and the platform's `is_ext_shared` is what forbids that declaration re-promoting a
+ * Slack Connect group DM. Returning a blanket `internal` here made that demotion unreachable, so a
+ * cross-org group DM was vouched under a workspace-wide `internal` line.
+ *
+ * 🔴 THE mpim DEMOTION IS POSITIVE-ONLY — the channel's `trust_checked` fail-close does NOT apply
+ * to it, and that asymmetry is the ruling rather than an oversight. A group DM has no shared-memory
+ * silo to protect (it is DM-family), and its `conversations.info` needs the separate `mpim:read`
+ * scope, so failing an unchecked mpim closed would demote every group DM in a workspace that never
+ * granted that scope — a deployment-wide regression bought for no signal. What demotes an mpim is
+ * evidence, never the absence of it. 🔴 THE LIMIT THAT BUYS: a workspace WITHOUT `mpim:read` resolves
+ * neither fact, so a Slack Connect group DM there is still vouched under a coarse declaration. The
+ * runbook (docs/deploy/surfaces/slack.md) states that precondition to the operator.
+ *
+ * `binding.trust` on an mpim has READERS BEYOND G4b, and every one of them TIGHTENS on this
+ * demotion: the role resolve falls to the `public` domain, domain skills drop, and the
+ * access-request, agent-create and identity-link paths refuse. None widens, and memory is untouched
+ * — a group DM reads no shared silo at any trust (memory/resolve.ts).
+ *
+ * A 1:1 DM never reaches the sharing question at all: `bindSlack` binds a `dm` from the PARTNER's
+ * verified trust, so `mode === "dm"` here answers the personal silo's `internal` unchanged.
+ */
+export function slackTrust(isExternal, trustChecked, mode) {
+    if (mode === "dm")
+        return "internal"; // personal silo; the partner's trust is bindSlack's own read
+    if (isExternal === "true")
+        return "external"; // Slack Connect / shared / org-shared — a group DM too
+    if (mode === "mpim")
+        return "internal"; // DM-family: demoted by evidence only, never by its absence
+    if (trustChecked !== "true")
+        return "external"; // never confirmed → fail closed
+    return "internal";
+}
+function slackAuthOf(ctx) {
+    return ctx.session?.auth?.current ?? ctx.session?.auth?.initiator ?? null;
+}
+function slackAttr(a, keys) {
+    if (!a)
+        return undefined;
+    for (const k of keys) {
+        const v = a[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+        if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+            return v[0];
+    }
+    return undefined;
+}
+// Auth principalId, treating empty string as absent so it falls through to the user_id
+// attribute rather than binding a blank id.
+function slackAuthPrincipalId(ctx) {
+    const pid = slackAuthOf(ctx)?.principalId;
+    return pid && pid.length > 0 ? pid : undefined;
+}
+// Eve's own auth identities (e.g. the approval-resume step's ctx, rebuilt from the
+// approval click rather than our wake stamp) carry the composite "slack:<team>:<user>"
+// AuthKey form, where buildSlackAuth stamps the RAW user id. Every scopeKey (grants,
+// partition, memory) is keyed on the raw id, so a composite resolving here splits the
+// caller's identity across the approval boundary (live 2026-07-21: the post-approval
+// connector gate refused "ungranted" — scopeKey dm:slack:T…:U… vs the granted dm:U…).
+// Raw Slack ids never contain ":", so collapsing to the last segment is loss-free.
+function rawSlackPrincipal(pid) {
+    if (!pid || !pid.startsWith("slack:"))
+        return pid;
+    const last = pid.slice(pid.lastIndexOf(":") + 1);
+    return last.length > 0 ? last : undefined;
+}
+export const bindSlack = (ctx) => {
+    const a = slackAuthOf(ctx)?.attributes;
+    const channelId = slackAttr(a, ["channel_id", "channelId"]);
+    const channelType = slackAttr(a, ["channel_type", "channelType"]);
+    const isPrivate = slackAttr(a, ["is_private", "isPrivate"]);
+    const mode = slackMode(channelType, channelId);
+    // For a DM, trust = the verified PARTNER trust (users.info, stowed by slack.ts). Absent →
+    // undefined → bindFrom fails the DM closed. For a channel, the conversations.info verdict.
+    const dmRaw = slackAttr(a, ["dm_partner_trust", "dmPartnerTrust"]);
+    const dmPartnerTrust = dmRaw === "internal" || dmRaw === "external" ? dmRaw : undefined;
+    return {
+        workspace: slackAttr(a, ["team_id", "teamId"]),
+        // The ENTERPRISE rung above the workspace (OPE-1508). Present only on an Enterprise Grid event
+        // whose envelope carried `enterprise_id`, so an ordinary install contributes nothing and its
+        // trust walk is unchanged. Core spells it and composes `slack/<enterpriseId>`; one declaration
+        // at that key vouches every workspace in the Grid, and the workspace's own line still wins.
+        trustEnterprise: slackAttr(a, ["enterprise_id", "enterpriseId"]),
+        surface: channelId,
+        mode,
+        visibility: slackVisibility(channelType, isPrivate, mode),
+        trust: mode === "dm" ? dmPartnerTrust : slackTrust(slackAttr(a, ["is_ext_shared", "isExtShared"]), slackAttr(a, ["trust_checked", "trustChecked"]), mode),
+        trustVerified: mode === "dm" ? dmPartnerTrust !== undefined : undefined,
+        principalId: rawSlackPrincipal(slackAuthPrincipalId(ctx)) ?? slackAttr(a, ["user_id", "userId"]),
+        // Routine post-back targets the channel (a fresh message), not an old thread.
+        target: channelId ? { channelId } : undefined,
+        // Eve's adapter sets thread_ts to the triggering message's own ts when it isn't a
+        // thread reply, so a channel mention always carries the thread its reply lands in.
+        // The unified divert forwards the RAW event auth, which for a top-level mention has
+        // no thread_ts — its anchor rides the oe_reply_anchor stamp instead (unified-window.ts
+        // OE_REPLY_ANCHOR_ATTR), so approval cards/post_file/notices thread under the mention
+        // on the divert path exactly as they do natively (live-found 2026-07-19: J3's card
+        // posted to the channel root). The wake ORIGIN stays anchor-free — §S2/ownership
+        // still read a top-level wake as top-level.
+        threadTs: slackAttr(a, ["thread_ts", "threadTs"]) ?? slackAttr(a, ["oe_reply_anchor", "oeReplyAnchor"]),
+    };
+};
+//# sourceMappingURL=slack-identity.js.map

package/dist/agent/channels/slack-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-identity.js","sourceRoot":"","sources":["../../../agent/channels/slack-identity.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yFAAyF;AACzF,mGAAmG;AACnG,iGAAiG;AACjG,oFAAoF;AACpF,yFAAyF;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,4CAA4C,CAAC;AA0CpD,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,MAAM,UAAU,GAA2B;QACzC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,OAAO,EAAE,KAAK,CAAC,MAAM;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ;QAAE,UAAU,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1D,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;IACnE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1F,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/F,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,cAAc;QAAE,UAAU,CAAC,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC;IAC7E,mGAAmG;IACnG,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,8FAA8F;IAC9F,0FAA0F;IAC1F,sGAAsG;IACtG,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACtJ,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACxG,CAAC;AAyCD,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAA0B,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAI,QAA4C,EAAE,EAAW;IACrG,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA4D;IACrG,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAkBD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,CAA0B;IACpD,MAAM,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,EAAE,GAAI,EAA8B,CAAC,eAAe,CAAC,CAAC;IAC5D,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B,EAAE,YAAgC;IAChG,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,0DAA0D;IAC/F,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACnD,OAAO,CACL,sBAAsB,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,KAAK,UAAU,CACpH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa,EAAE,cAAuB;IACzE,MAAM,CAAC,GAAI,IAAkD,EAAE,IAAI,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,8BAA8B;IACtG,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,+EAA+E;IAC/E,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,0DAA0D;IAC1D,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,mGAAmG;IACnG,6BAA6B;IAC7B,MAAM,YAAY,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,cAAc,CAAC;IAChH,MAAM,iBAAiB,GAAG,YAAY,IAAI,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC;IACnE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,GAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,cAAc,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,MAAM,EAAE,GAAI,IAAqD,EAAE,OAAO,CAAC;IAC3E,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC,YAAY,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,UAAU,GAAG,OAAO,CACxB,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,uBAAuB,CAAC,CAC7F,CAAC;IACF,IAAI,WAA+B,CAAC;IACpC,IAAI,EAAE,CAAC,OAAO,CAAC;QAAE,WAAW,GAAG,IAAI,CAAC;SAC/B,IAAI,EAAE,CAAC,SAAS,CAAC;QAAE,WAAW,GAAG,MAAM,CAAC;SACxC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC;QAAE,WAAW,GAAG,OAAO,CAAC;SAC9D,IAAI,EAAE,CAAC,YAAY,CAAC;QAAE,WAAW,GAAG,SAAS,CAAC;IACnD,8FAA8F;IAC9F,yFAAyF;IACzF,+FAA+F;IAC/F,oEAAoE;IACpE,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,wFAAwF;IACxF,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC,WAAW,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,qFAAqF;IACrF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAC7H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAmB;IACxD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;AACrC,CAAC;AAWD,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,WAA+B,EAAE,SAA6B;IACtF,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC3E,wFAAwF;IACxF,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,WAA+B,EAC/B,SAA6B,EAC7B,IAAiB;IAEjB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC3C,+CAA+C;IAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,6BAA6B;IAC7E,OAAO,SAAS,CAAC,CAAC,yBAAyB;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,UAAU,CACxB,UAA8B,EAC9B,YAAgC,EAChC,IAAiB;IAEjB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC,CAAC,6DAA6D;IACnG,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,uDAAuD;IACrG,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,4DAA4D;IACpG,IAAI,YAAY,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,gCAAgC;IAChF,OAAO,UAAU,CAAC;AACpB,CAAC;AASD,SAAS,WAAW,CAAC,GAAoB;IACvC,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,CAAY,EAAE,IAAuB;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,4CAA4C;AAC5C,SAAS,oBAAoB,CAAC,GAAoB;IAChD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;IAC1C,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,uFAAuF;AACvF,qFAAqF;AACrF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAmB,CAAC,GAAG,EAAe,EAAE;IAC5D,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IACvC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,MAAM,cAAc,GAAsB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC9C,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAChE,OAAO,EAAE,SAAS;QAClB,IAAI;QACJ,UAAU,EAAE,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC;QACzD,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC;QACzJ,aAAa,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;QACvE,WAAW,EAAE,iBAAiB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChG,8EAA8E;QAC9E,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,kFAAkF;QAClF,mFAAmF;QACnF,oFAAoF;QACpF,uFAAuF;QACvF,sFAAsF;QACtF,mFAAmF;QACnF,iFAAiF;QACjF,4CAA4C;QAC5C,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;KACxG,CAAC;AACJ,CAAC,CAAC"}

package/dist/agent/channels/slack-input-response.d.ts

@@ -0,0 +1,26 @@
+import type { SlackInputResponseContext, SlackInputResponseResult, SlackInputResponseSubmission } from "eve/channels/slack";
+import { type IngressSpendGateInput, type InputResponseAdmission, type InputResponseScope, type SpendGateDecision } from "@open-everywhere/core/agent/adapter-api.js";
+export interface SlackInputResponseDeps {
+    /** The core admission. Injected in tests; the live default is the shared decision. */
+    readonly admit?: (scope: InputResponseScope) => Promise<InputResponseAdmission>;
+    /** Render the refusal to the answerer alone. Live default is `chat.postEphemeral` in the thread. */
+    readonly notify?: (userId: string, text: string) => Promise<void>;
+    /**
+     * Positive per-answerer guest verdict for leg B (OPE-589). Live default is `slackClickerIsGuest`
+     * (channels/slack-events.ts). `undefined` is ALWAYS inert.
+     */
+    readonly guestVerdict?: (userId: string, teamId: string | undefined) => Promise<boolean | undefined>;
+    /** The shared spend-admission decision (OPE-588). Injected in tests; the live default is
+     *  `ingressSpendGate` (spend/ingress-gate.ts) — the SAME function every ordinary ingress door
+     *  consults. */
+    readonly spendGate?: (input: IngressSpendGateInput) => Promise<SpendGateDecision>;
+}
+/**
+ * Admit or refuse one eve-owned HITL answer submitted through Slack interactivity.
+ *
+ * Returns eve's own default result (`{ auth: ctx.defaultAuth }`) on an allow, so an admitted answer
+ * is byte-identical to today's behaviour. Returns `null` on a refusal, which leaves the request
+ * PENDING — eve has no cancel on this seam (see the core module's residual note).
+ */
+export declare function admitSlackInputResponse(ctx: SlackInputResponseContext, submission: SlackInputResponseSubmission, deps?: SlackInputResponseDeps): Promise<SlackInputResponseResult>;
+//# sourceMappingURL=slack-input-response.d.ts.map

package/dist/agent/channels/slack-input-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-input-response.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-input-response.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAML,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AA0BpD,MAAM,WAAW,sBAAsB;IACrC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAChF,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACrG;;oBAEgB;IAChB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACnF;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,yBAAyB,EAC9B,UAAU,EAAE,4BAA4B,EACxC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAuDnC"}

package/dist/agent/channels/slack-input-response.js

@@ -0,0 +1,127 @@
+// THE SLACK ARM OF THE HITL-ANSWER ADMISSION (OPE-574).
+//
+// eve's Slack channel accepts an answer to any parked `ask_question` / session-limit prompt from
+// whoever pressed the widget, with no check at all: `defaultOnInputResponse(ctx){return{auth:
+// ctx.defaultAuth}}`. Authoring `onInputResponse` replaces that default with OE code. The decision
+// itself lives in core (approvals/input-response-floor.ts) so the Teams arm reaches the same
+// verdict; this file is the Slack-shaped edge — resolve the partition, hand the facts over, render
+// the refusal.
+//
+// 🔴 FAIL-OPEN ON A THROW, deliberately. eve logs a thrown hook and treats it as REJECTION
+// (`slack/input-response.js` catches and returns `null`), so a transient store or roster blip
+// inside our code would silently make every question unanswerable — the exact outcome the
+// clicker floor's own catch exists to prevent. Anything unexpected therefore returns eve's own
+// default result and says so in the log; only a real verdict refuses.
+//
+// The refusal is EPHEMERAL, not a thread post. The card is still live for someone who may answer,
+// and a public "you may not answer" note in the room adds nothing the answerer does not already
+// need to know. This mirrors the Discord approval refusal (an ephemeral), not the Slack approval
+// refusal (a thread note, which exists there because the CARD is public and its state matters to
+// the room).
+//
+// LEG B HAS TEETH HERE (OPE-589) — the core header's "Slack cannot [answer B]" is now stale. This
+// module reuses `slackClickerIsGuest` (channels/slack-events.ts) — `slackAuthorIsMember`, the SAME
+// `users.info` call OPE-466 already makes to mark a non-member's chat message, inverted to a guest
+// verdict. The clicker floor's own leg D (approvals/flow.ts's `handleApprovalPayload`) reuses the
+// SAME function, so the two planes cannot drift on what "positively a guest" means. An unresolvable
+// probe returns `undefined` and the leg stays INERT, exactly as it did before.
+//
+// 🔴 SPEND GATE (OPE-588), FIRST — ahead of the room/guest admission below. This click RESUMES a
+// parked turn: a decision to spend more, taken through a button, on a scope nobody asked whether it
+// could afford. Every ordinary ingress door consults the ONE shared spend gate before it dispatches
+// a turn (spend/ingress-gate.ts); eve's own interactivity route calls `onInputResponse` and then
+// `.respond()` directly, with no call site of that gate anywhere on the seam — verified against the
+// installed eve/dist. `ingressSpendGate` fails open on a broken check and fails closed (visible
+// refusal, door `"answer"`) on a definite over-cap, the same posture the DM/channel doors already
+// hold. A decline returns eve's own reject-the-answer `null`, so the request stays PENDING — the
+// same outcome a room/guest refusal already leaves.
+import { admitInputResponse, ingressSpendGate, resolvePartition, SLACK_SPEND_BADGES, } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackClickerIsGuest } from "./slack-events.js";
+/**
+ * The RAW `team_id` off the interaction's own auth attributes — never `resolvePartition`'s
+ * `workspace` field (OPE-589 review fix). `resolvePartition` degrades an unnamed workspace to the
+ * `UNNAMED_TENANT` placeholder ("dev"), which is harmless where `workspace` only ever fed a
+ * surfaceKey lookup, but the guest-verdict probe below compares it against Slack's REAL `team_id`
+ * (`partnerFactsFromInfo`'s `ownWorkspace` check) — a placeholder there does not mean "no team", it
+ * means "a team literally named dev", and would falsely fail that comparison and refuse a genuine
+ * member. Reading the wire attribute directly keeps "no team known" as `undefined`. The probe then
+ * answers that absence from the operator's register alone (OPE-1508): a declared workspace or Grid
+ * still clears leg B, and an undeclared one is a GUEST, because absence infers non-member. Only an
+ * unreadable `users.info` leaves leg B inert. This is
+ * the same shape `flow.ts`'s `handleApprovalPayload` already reads off the raw Slack
+ * payload for the SAME probe on the approval-click side. LOCAL COPY of the attribute read (the
+ * `slack-identity.ts` header states the precedent): a three-line structural read over the public
+ * auth shape, not worth a barrel export.
+ */
+function slackAuthTeamId(auth) {
+    const v = auth.attributes?.["team_id"];
+    if (typeof v === "string" && v.length > 0)
+        return v;
+    if (Array.isArray(v) && typeof v[0] === "string" && v[0].length > 0)
+        return v[0];
+    return undefined;
+}
+/**
+ * Admit or refuse one eve-owned HITL answer submitted through Slack interactivity.
+ *
+ * Returns eve's own default result (`{ auth: ctx.defaultAuth }`) on an allow, so an admitted answer
+ * is byte-identical to today's behaviour. Returns `null` on a refusal, which leaves the request
+ * PENDING — eve has no cancel on this seam (see the core module's residual note).
+ */
+export async function admitSlackInputResponse(ctx, submission, deps = {}) {
+    const allow = { auth: ctx.defaultAuth };
+    try {
+        const bindable = {
+            channel: { kind: "slack" },
+            session: { auth: { current: ctx.defaultAuth } },
+        };
+        const p = resolvePartition(bindable);
+        const teamId = slackAuthTeamId(ctx.defaultAuth);
+        // SPEND GATE (OPE-588) — FIRST, ahead of the room/guest admission below (see the header note).
+        // A decline skips the guest probe entirely (over budget outranks identity) and returns eve's
+        // reject-the-answer `null`, leaving the request PENDING exactly like a room/guest refusal.
+        const spendGate = deps.spendGate ?? ingressSpendGate;
+        const spendVerdict = await spendGate({
+            bindable,
+            door: "answer",
+            principalId: submission.user.id,
+            workspaceRef: teamId ?? null,
+            badges: SLACK_SPEND_BADGES,
+            post: async (text) => {
+                await ctx.thread.postEphemeral(submission.user.id, text);
+            },
+        });
+        if (spendVerdict === "declined")
+            return null;
+        const guestVerdict = deps.guestVerdict ?? slackClickerIsGuest;
+        const answererIsGuest = await guestVerdict(submission.user.id, teamId).catch(() => undefined);
+        const verdict = await (deps.admit ?? admitInputResponse)({
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            surface: p.surface,
+            surfaceKey: p.surfaceKey,
+            principalId: submission.user.id,
+            responses: submission.inputResponses.length,
+            // Leg B (OPE-589): a POSITIVE per-answerer guest verdict from `slackAuthorIsMember`, or
+            // omitted when the probe could not answer — `undefined` never refuses.
+            ...(answererIsGuest === undefined ? {} : { answererIsGuest }),
+        });
+        if (verdict.ok)
+            return allow;
+        const notify = deps.notify ??
+            (async (userId, text) => {
+                await ctx.thread.postEphemeral(userId, text);
+            });
+        await notify(submission.user.id, verdict.notice).catch((err) => {
+            // The refusal still stands — the human just does not see why. One log line, never a throw.
+            console.error(`[open-everywhere:slack] HITL refusal notice failed to post: ${String(err)}`);
+        });
+        return null;
+    }
+    catch (err) {
+        console.error(`[open-everywhere:slack] HITL answer admission failed softly — accepting the answer: ${String(err)}`);
+        return allow;
+    }
+}
+//# sourceMappingURL=slack-input-response.js.map

package/dist/agent/channels/slack-input-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-input-response.js","sourceRoot":"","sources":["../../../agent/channels/slack-input-response.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,eAAe;AACf,EAAE;AACF,2FAA2F;AAC3F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,sEAAsE;AACtE,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,aAAa;AACb,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,+EAA+E;AAC/E,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,oGAAoG;AACpG,iGAAiG;AACjG,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,oDAAoD;AAOpD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,IAA8C;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAA8B,EAC9B,UAAwC,EACxC,IAAI,GAA2B,EAAE;IAEjC,MAAM,KAAK,GAA6B,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE;SAC7B,CAAC;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEhD,+FAA+F;QAC/F,6FAA6F;QAC7F,2FAA2F;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC;YACnC,QAAQ;YACR,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YAC/B,YAAY,EAAE,MAAM,IAAI,IAAI;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnB,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,CAAC;SACF,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;QAC9D,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,CAAC;YACvD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YAC/B,SAAS,EAAE,UAAU,CAAC,cAAc,CAAC,MAAM;YAC3C,wFAAwF;YACxF,uEAAuE;YACvE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;YACX,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAiB,EAAE;gBACrD,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtE,2FAA2F;YAC3F,OAAO,CAAC,KAAK,CAAC,+DAA+D,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uFAAuF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/channels/slack-mrkdwn.d.ts

@@ -0,0 +1,3 @@
+/** Convert model-authored markdown to Slack mrkdwn. */
+export declare function markdownToSlackMrkdwn(text: string): string;
+//# sourceMappingURL=slack-mrkdwn.d.ts.map

package/dist/agent/channels/slack-mrkdwn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-mrkdwn.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-mrkdwn.ts"],"names":[],"mappings":"AAsBA,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqC1D"}