@open-everywhere/provider-slack 0.1.2 → 0.1.4

package/agent/access/slack-attachment-fetch.ts

@@ -41,6 +41,7 @@ import {
   type EgressDispatch,
   type EgressRefusalCause,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackBotToken } from "../setup/credentials.js";
 
 // THE CREDENTIAL'S IDENTITY, FOR THE AUDIT ROW (OPE-1547) — the ref NAME, never the value. This is
 // the one host-side seam that attaches a credential, so before this ticket it was the one place
@@ -126,7 +127,8 @@ export async function fetchSlackAttachment(ctx: BindableContext, ref: TrustedSla
     });
     throw new Error(`describe_image: refusing to send the Slack bot token to non-Slack host "${safe.url.hostname}".`);
   }
-  const token = process.env.SLACK_BOT_TOKEN;
+  // Resolved, not read off the env (OPE-2231) — the token may live in the credential store.
+  const token = await slackBotToken();
   if (!token) {
     throw new Error("describe_image: SLACK_BOT_TOKEN is not set — the bot token is required to download a Slack attachment.");
   }

package/agent/app-manifest.ts

@@ -1,18 +1,18 @@
 // THE Slack app manifest — one definition, three readers (OPE-1603).
 //
-// This file is the only place the manifest exists. The install wizard's Slack step
+// This file is the only place the manifest exists. The setup check's Slack step
 // (packages/create/src/steps/slack.ts) prints it, the ops MCP tool `surface_manifest` serves it
 // with this deployment's host substituted, and `scripts/slack-scope-audit-test.ts` parses the bot
-// scope array below against the runbook's documented scopes. It used to live in the wizard, where
+// scope array below against the runbook's documented scopes. It used to live in the setup CLI, where
 // the ops server could not reach it at all.
 //
-// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The install wizard depends on the bundle for this
+// 🔴 THIS MODULE IMPORTS NOTHING, DELIBERATELY. The setup CLI depends on the bundle for this
 // document alone, so a leaf module costs it no transitive weight — not the adapter-api barrel, not
 // eve, not the Slack Web API client. `agent/ops.ts` does the typed registration; this file holds
 // only the vendor's own knowledge.
 
 /** The token the request URLs carry where the deployment's own host belongs. The ops plane
- *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the wizard leaves it for the
+ *  substitutes it (packages/core/agent/ops/surface-manifest.ts); the setup check leaves it for the
  *  operator, who has usually not deployed yet when they run it. */
 export const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
 
@@ -22,7 +22,7 @@ export const SLACK_DEFAULT_APP_NAME = "Open Everywhere";
 /** Slack's limit on an app name (`display_information.name`). A longer name fails at paste time. */
 export const SLACK_APP_NAME_MAX = 35;
 
-/** Why `raw` cannot name the Slack app, or `undefined` when it can. The install wizard's
+/** Why `raw` cannot name the Slack app, or `undefined` when it can. The setup CLI's
  *  `--app-name` reads this; the ops tool applies core's generic check with {@link SLACK_APP_NAME_MAX}. */
 export function slackAppNameProblem(raw: string): string | undefined {
   const name = raw.trim();
@@ -38,8 +38,8 @@ export interface SlackAppManifestOptions {
   readonly appName?: string;
 }
 
-/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the minimal
- *  scope/event set docs/deploy/surfaces/slack.md walks through by hand. */
+/** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the scope/event
+ *  set docs/deploy/surfaces/slack.md walks through by hand. */
 export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): string {
   const appName = opts.appName?.trim() || SLACK_DEFAULT_APP_NAME;
   return JSON.stringify(
@@ -62,8 +62,10 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           {
             command: "/oe",
             url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack/commands`,
-            description: "Open Everywhere control commands — status, budget, stop.",
-            usage_hint: "stop | status | budget",
+            description: "Open Everywhere control-plane commands (stop, status, budget) — no model turn.",
+            // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
+            // scripts/slack-app-manifest-test.ts fails if one is missing here.
+            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | help",
             should_escape: false,
           },
         ],
@@ -92,6 +94,13 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         ],
       },
       oauth_config: {
+        // THE OAUTH REDIRECT BACK TO THIS DEPLOYMENT (OPE-2231). `/setup` installs the app by sending
+        // the installer to Slack's authorize URL and taking the `code` on the way back, and Slack
+        // refuses a redirect to a URL the app does not DECLARE — so the agent-led install needs this
+        // line in the manifest, not just in the code that handles the callback. It is harmless on the
+        // hand-paste path: an app created from this manifest and installed from the Slack console
+        // never visits the URL.
+        redirect_urls: [`https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/setup/callback`],
         scopes: {
           bot: [
             "app_mentions:read",
@@ -119,10 +128,20 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // asked in an ordinary room is delivered to the requester's DM, never rendered there.
             "im:write",
             "groups:history",
+            // Group-DM messages — the scope `message.mpim` below needs (Slack's event reference).
+            "mpim:history",
             // The group-DM (`mpim`) half of `im:read` — same two calls, same call sites. Code-derived
             // rather than live-proven: the roster/disclosure paths are keyed on the room, and a
             // member-tier click or a card can land in a group DM exactly as it can in a 1:1.
             "mpim:read",
+            // files.getUploadURLExternal + files.completeUploadExternal — the `post_file` tool's
+            // upload flow (packages/core/agent/tools/post_file.ts). Without it every file post fails
+            // with `missing_scope`.
+            "files:write",
+            // The authenticated download of a Slack file's `url_private`
+            // (access/slack-attachment-fetch.ts fetchSlackAttachment), which `describe_image` uses to
+            // read an image a person posted. Slack serves that URL only to an app with this scope.
+            "files:read",
             "reactions:write",
             "reactions:read",
             "pins:read",
@@ -136,7 +155,26 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
       settings: {
         event_subscriptions: {
           request_url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack`,
-          bot_events: ["app_mention", "message.im", "reaction_added", "reaction_removed"],
+          // EVERY event the front route acts on (slack-front.ts classifyEnvelope), and each one's
+          // scope is in the bot list above, per Slack's event reference:
+          //   app_mention → app_mentions:read · message.im → im:history
+          //   message.channels → channels:history (an engaged thread's follow-up with no re-mention)
+          //   message.groups → groups:history (the same, in private channels)
+          //   message.mpim → mpim:history (group DMs; without it only an @mention there is heard)
+          //   member_joined_channel → channels:read, groups:read, mpim:read (the channel-join intro)
+          //   reaction_added, reaction_removed → reactions:read (reaction feedback)
+          // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
+          // this list drops one (OPE-2223).
+          bot_events: [
+            "app_mention",
+            "message.im",
+            "message.channels",
+            "message.groups",
+            "message.mpim",
+            "member_joined_channel",
+            "reaction_added",
+            "reaction_removed",
+          ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every
         // button click and every shortcut lands here, and the front route classifies which handler

package/agent/channels/slack-commands.ts

@@ -34,6 +34,7 @@
 
 import { defineChannel, POST } from "eve/channels";
 import { verifySlackSignature } from "./slack-front.js";
+import { slackSigningSecret } from "../setup/credentials.js";
 import {
   bindFrom,
   runOeCommand,
@@ -152,7 +153,10 @@ export default defineChannel({
     // keeps stop free and working while the scope is over its spend cap.
     POST(SLACK_COMMANDS_ROUTE, async (req, { attachSession, waitUntil }) => {
       const rawBody = await req.text();
-      if (!verifySlackSignature(rawBody, req.headers, process.env.SLACK_SIGNING_SECRET)) {
+      // Resolved, not read off the env (OPE-2231): a `/setup` run can have put the signing secret in
+      // the credential store, and `/oe stop` is the affordance a person reaches for when the agent is
+      // doing the wrong thing. An install where stop 401s is an install where stop is missing.
+      if (!verifySlackSignature(rawBody, req.headers, await slackSigningSecret())) {
         return new Response("unauthorized", { status: 401 });
       }
 

package/agent/channels/slack-events.ts

@@ -18,6 +18,7 @@
 
 import { slackContinuationToken } from "eve/channels/slack";
 import { callSlackWebApi } from "./slack-web-api.js";
+import { slackBotToken } from "../setup/credentials.js";
 import { RateLimitExhaustedError } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   resolvePartition,
@@ -3449,9 +3450,17 @@ const TRANSCRIPT_TOTAL_CHARS = 4000; // whole-block cap — the wake prompt stay
 // second fetch-Slack-with-a-bot-token helper (house pattern: one client, many callers).
 // `token` is the multi-bot seam (item 27): every Slack API call in the app funnels
 // through here, so tier-2 per-app token routing is one argument at this signature
-// instead of a hunt through every caller. Default = today's single-app env read.
-export async function slackForm(method: string, body: string, token: string | undefined = process.env.SLACK_BOT_TOKEN): Promise<Record<string, unknown> | undefined> {
-  if (!token) return undefined;
+// instead of a hunt through every caller.
+//
+// 🔴 THE DEFAULT IS RESOLVED, NOT AN ENV READ (OPE-2231). It used to default to
+// `process.env.SLACK_BOT_TOKEN` in the parameter list, which a default cannot be any more: the token
+// may live in the credential store, so resolving it is async. The resolution therefore moved into the
+// body. An explicitly-passed token (the multi-bot seam) still wins untouched; no caller in the tree
+// passes one today, which is why this is a default-shape change and not a behaviour change for any
+// existing call site.
+export async function slackForm(method: string, body: string, token?: string): Promise<Record<string, unknown> | undefined> {
+  const resolved = token ?? (await slackBotToken());
+  if (!resolved) return undefined;
   try {
     // Route through OE's `callSlackWebApi` (channels/slack-web-api.ts) — the ONE seam that carries
     // the 429/`Retry-After` backoff (OPE-1211). `body` is a pre-encoded form string on this seam, so
@@ -3459,7 +3468,7 @@ export async function slackForm(method: string, body: string, token: string | un
     // through as the bot token. Fail-soft to undefined is preserved: the guard above handles a
     // missing token, and any throw is swallowed below — an exhausted retry included.
     return (await callSlackWebApi({
-      botToken: token,
+      botToken: resolved,
       operation: method,
       body: Object.fromEntries(new URLSearchParams(body)),
     })) as Record<string, unknown>;

package/agent/channels/slack-front.ts

@@ -41,6 +41,7 @@
 
 import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
 import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
+import { slackSigningSecret } from "../setup/credentials.js";
 import { slackContinuationToken } from "eve/channels/slack";
 import { callSlackWebApi } from "./slack-web-api.js";
 import {
@@ -636,7 +637,7 @@ export interface FrontOptions {
   /** Open (or reuse) the 1:1 DM channel with a Slack member, returning its `D…` id — the landing
    *  place a GLOBAL shortcut wakes in (OPE-1376), since a global shortcut names no conversation.
    *  `conversations.open` is idempotent, so this is a resolve rather than a create. Needs the
-   *  `im:write` bot scope, which the runbook and the wizard manifest already require for the
+   *  `im:write` bot scope, which the runbook and the app manifest already require for the
    *  governance DM-delivery arm. Defaults to the live call; FAIL-CLOSED: undefined ⇒ the shortcut
    *  wakes nothing and says so, never a wake in a guessed room. Injectable for tests. */
   readonly openDirectMessageChannel?: (userId: string) => Promise<string | undefined>;
@@ -1006,7 +1007,15 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const fifo = opts.fifo ?? new ThreadFifo(recordWakeFailure);
   const getBotIdentity = opts.getBotIdentity ?? resolveBotIdentity;
   const now = opts.now ?? (() => Date.now());
-  const signingSecret = () => opts.signingSecret ?? process.env.SLACK_SIGNING_SECRET;
+  // THE SIGNING SECRET RESOLVES PER REQUEST, AND IT IS ASYNC SINCE OPE-2231. It used to be a
+  // property read on `process.env`; a `/setup` run can now have put it in the credential store
+  // instead, so the resolver may touch the vault. It is awaited ONCE at the top of
+  // `handleFrontRequest` and the VALUE is used by both readers below (the inbound verify and the
+  // native forward's re-sign) — one resolution per request, and the two can never disagree about
+  // which secret this request is being held to, which is what the re-sign depends on. A deployment
+  // with `SLACK_SIGNING_SECRET` set never reaches the store (the resolver is env-first), so this is
+  // the same property read it always was for every pre-OPE-2231 deployment.
+  const resolveSigningSecret = async (): Promise<string | undefined> => opts.signingSecret ?? (await slackSigningSecret());
   const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
   // OPE-589 leg D: reuse the taint-marking member probe (slack-events.ts `slackClickerIsGuest`,
   // itself `slackAuthorIsMember` inverted). Same `users.info` call and cache the channel-taint leg
@@ -1069,7 +1078,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
 
   async function handleFrontRequest(req: Request, args: RouteHandlerArgs): Promise<Response> {
     const rawBody = await req.text();
-    if (!verifySlackSignature(rawBody, req.headers, signingSecret(), now())) {
+    const requestSigningSecret = await resolveSigningSecret();
+    if (!verifySlackSignature(rawBody, req.headers, requestSigningSecret, now())) {
       return new Response("unauthorized", { status: 401 });
     }
     const decision = classifyEnvelope(rawBody, req.headers.get("content-type") ?? "");
@@ -1086,8 +1096,12 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
      *
      * 🔴 THE RE-SIGN IS WHAT MAKES A REWRITE POSSIBLE. The inner handler re-verifies the Slack
      * signature over the body it receives, so a changed body needs a signature over those bytes. The
-     * secret is the one this route just VERIFIED the inbound signature with, so a deployment where
-     * the two secrets disagree would have 401'd above rather than reaching here.
+     * secret is the one this route just VERIFIED the inbound signature with, and eve resolves through
+     * the SAME seam (OPE-2231: `channels/slack.ts` hands `slackChannel` a `webhookVerifier` built on
+     * `setup/credentials.ts`), so there is no path on which the two can disagree about which secret
+     * this request is held to. Before that wiring there WAS one — eve fell back to
+     * `process.env.SLACK_SIGNING_SECRET` while this route read the credential store — and a
+     * store-configured deployment 401'd in the inner handler after passing here.
      *
      * FAIL-SOFT TO TODAY'S BEHAVIOUR. If the body carried nothing to strip (the common path), or the
      * signature cannot be reminted (no secret, no timestamp header), the ORIGINAL bytes and headers
@@ -1107,7 +1121,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       withForwardedSlackEnvelope(forwardedEnvelopeOf(rawBody), () => {
         const fenced = stripUnfencedSlackAttachments(rawBody);
         const ts = req.headers.get(SLACK_TIMESTAMP_HEADER);
-        const secret = signingSecret();
+        // The SAME value the inbound signature was just verified against — see the resolver above.
+        const secret = requestSigningSecret;
         if (fenced === rawBody || !ts || !secret) {
           return innerHandler(new Request(req.url, { method: "POST", headers: req.headers, body: rawBody }), args);
         }

package/agent/channels/slack-read.ts

@@ -13,6 +13,7 @@
 // fallback the Slack channel itself uses.
 
 import { callSlackWebApi } from "./slack-web-api.js";
+import { slackBotToken } from "../setup/credentials.js";
 import {
   auditChannelReadRefusal,
   bindFrom,
@@ -101,14 +102,19 @@ interface SlackReadResponse {
  * Low-level POST to a (read-only) Slack Web API method with the bot token, via OE's
  * `callSlackWebApi` (form-encoded — Slack's JSON support is partial: `conversations.replies`/
  * `history` want form). Throws on a missing token or a non-ok Slack response so the tool
- * surfaces a real error. The explicit env pre-check keeps the actionable "not set" message
+ * surfaces a real error. The explicit pre-check keeps the actionable "not set" message
  * (the seam itself throws a terser "SLACK_BOT_TOKEN is required.").
+ *
+ * 🔴 THE PRE-CHECK ASKS THE RESOLVER, NOT `process.env` (OPE-2231). It used to read the env var
+ * directly, which became a false negative the moment `/setup` could put the token in the credential
+ * store instead: the tools would refuse with "not set" on a deployment that holds a perfectly good
+ * stored token. Same message, same actionable text, asked of the one thing that knows.
  */
 export async function callSlackRead(operation: string, params: Record<string, string | number | boolean>): Promise<SlackReadResponse> {
-  if (!process.env.SLACK_BOT_TOKEN) {
+  if (!(await slackBotToken())) {
     throw new Error("SLACK_BOT_TOKEN is not set — the Slack read tools need the bot token to call the Web API.");
   }
-  // botToken omitted → the seam resolves it from SLACK_BOT_TOKEN (same fallback as before).
+  // botToken omitted → the seam resolves it the same way this pre-check just did.
   const json = (await callSlackWebApi({ botToken: undefined, operation, body: params })) as SlackReadResponse;
   // DEFINITIVE (OPE-821): Slack answers HTTP 200 with `ok:false` when it READ the request and
   // refused it, so the call had no effect. `react` is the caller that acts on this — a refused

package/agent/channels/slack-setup-page.ts

@@ -0,0 +1,20 @@
+// Deployment mount for the agent-led Slack setup page (OPE-2231); the behaviour lives in
+// agent/setup/page.ts. Three routes, and all three fail closed (404) until the credential vault is
+// armed AND no Slack install is recorded — a deployment past setup serves nothing here.
+
+import { defineChannel, GET, POST } from "eve/channels";
+import {
+  SLACK_SETUP_CALLBACK_PATH,
+  SLACK_SETUP_PATH,
+  handleSlackSetupCallback,
+  handleSlackSetupGet,
+  handleSlackSetupPost,
+} from "../setup/page.js";
+
+export default defineChannel({
+  routes: [
+    GET(SLACK_SETUP_PATH, async (req) => handleSlackSetupGet(req)),
+    POST(SLACK_SETUP_PATH, async (req) => handleSlackSetupPost(req)),
+    GET(SLACK_SETUP_CALLBACK_PATH, async (req) => handleSlackSetupCallback(req)),
+  ],
+});

package/agent/channels/slack-web-api.ts

@@ -23,7 +23,8 @@
 //   • Form encoding. Slack's JSON support is partial (`conversations.replies`/`history` want form),
 //     so form is the only safe default. A null or undefined value is dropped; a string, number or
 //     boolean is stringified; anything else is JSON-encoded.
-//   • Token resolution. An explicit token wins, otherwise `SLACK_BOT_TOKEN`. Neither ⇒ throw
+//   • Token resolution. An explicit token wins, otherwise the deployment's resolved bot token
+//     (`SLACK_BOT_TOKEN`, then the credential store — OPE-2231). Neither ⇒ throw
 //     `SLACK_BOT_TOKEN is required.` — the same message and the same fail-loud posture. ONE
 //     DELIBERATE NARROWING: eve's `SlackBotToken` also accepts a function (the secret-manager and
 //     rotation form). No caller in this repo passes one, so this seam takes a string. Widening it
@@ -40,6 +41,7 @@
 // — a NAMED failure. Non-429 responses are untouched.
 
 import { withRetryAfter, type RateLimitRetryOptions } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackBotToken } from "../setup/credentials.js";
 
 /** Slack's Web API base. A trailing slash is required — `new URL(operation, base)` resolves the
  *  operation against the LAST path segment otherwise. */
@@ -129,9 +131,17 @@ const PROBE_OPERATIONS: ReadonlySet<string> = new Set(["auth.test", "conversatio
 const PROBE_MAX_ATTEMPTS = 2;
 const PROBE_CAP_MS = 2_000;
 
-/** An explicit token, else `SLACK_BOT_TOKEN`. Throws eve's exact message when neither is set. */
-function resolveBotToken(botToken: string | undefined): string {
-  const token = botToken ?? process.env.SLACK_BOT_TOKEN;
+/**
+ * An explicit token, else the deployment's resolved bot token (env first, then the credential store
+ * — `agent/setup/credentials.ts`). Throws eve's exact message when neither is set.
+ *
+ * 🔴 ASYNC SINCE OPE-2231, and the awaits are the whole change at the call site. The token used to be
+ * a property read; it can now come from the encrypted vault, because `/setup` captures it there. The
+ * resolver memoises a store hit per process, and a deployment with `SLACK_BOT_TOKEN` set never
+ * reaches the store at all, so the hot path for every pre-OPE-2231 deployment is unchanged.
+ */
+async function resolveBotToken(botToken: string | undefined): Promise<string> {
+  const token = botToken ?? (await slackBotToken());
   if (!token) throw new Error("SLACK_BOT_TOKEN is required.");
   return token;
 }
@@ -144,16 +154,33 @@ function resolveBotToken(botToken: string | undefined): string {
  * outlasts the bounded attempts.
  */
 export async function callSlackWebApi(
-  input: { readonly botToken?: string; readonly operation: string; readonly body: unknown },
+  input: {
+    readonly botToken?: string;
+    readonly operation: string;
+    readonly body: unknown;
+    /** Send NO `Authorization` header. The one legitimate use is `oauth.v2.access`, which Slack
+     *  authenticates by client credentials in the body — see the note at the resolution below. */
+    readonly unauthenticated?: boolean;
+  },
   deps: SlackWebApiDeps = {},
 ): Promise<SlackWebApiResponse> {
-  const token = resolveBotToken(input.botToken);
+  // THE ONE OPERATION WITH NO BEARER TOKEN TO RESOLVE (OPE-2231). `oauth.v2.access` is
+  // authenticated by the app's client credentials IN THE BODY, and it is the call that MINTS the bot
+  // token — so demanding one to make it is a chicken-and-egg, and passing the client secret as a
+  // bearer would be a different, wrong credential in the `Authorization` header. `unauthenticated`
+  // is therefore an explicit opt-out rather than a token that happens to be absent: the DEFAULT path
+  // still throws when no token resolves, so no ordinary call can silently lose its authorization
+  // header by forgetting to pass one.
+  const token = input.unauthenticated === true ? undefined : await resolveBotToken(input.botToken);
   const encoded = encodeSlackForm(input.body);
   const url = new URL(input.operation, deps.apiBase ?? SLACK_API_BASE).toString();
   const send = (): Promise<Response> =>
     (deps.fetch ?? (globalThis.fetch as SlackFetchLike))(url, {
       body: encoded,
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/x-www-form-urlencoded" },
+      headers: {
+        ...(token === undefined ? {} : { authorization: `Bearer ${token}` }),
+        "content-type": "application/x-www-form-urlencoded",
+      },
       method: "POST",
     });
 

package/agent/channels/slack.ts

@@ -11,11 +11,13 @@
 // a random status VERB per update ("Tinkering…"), configurable per org/domain — see
 // statusVerb() below.
 //
-// Credentials: omitted here, so eve falls back to SLACK_BOT_TOKEN /
-// SLACK_SIGNING_SECRET (see .env.example). Swap the credential broker later without
-// touching identity. Capturing channel_type/is_private is a RAW-fact job; the
+// Credentials: supplied to eve (OPE-2231), as a VERIFIER and a token FUNCTION rather than two
+// strings — agent/setup/eve-credentials.ts. Both resolve env-first and then this deployment's
+// encrypted credential store, which is where a `/setup` run puts them. They used to be omitted, which
+// left eve reading `process.env` on a path OE no longer does. Capturing channel_type/is_private is a RAW-fact job; the
 // security-critical interpretation (fail-closed to private) lives in the binding.
 
+import { SLACK_EVE_CREDENTIALS } from "../setup/eve-credentials.js";
 import {
   slackChannel,
   type SlackContext,
@@ -764,6 +766,12 @@ export async function admitInbound(
 // session).
 const slackMentionChannel = slackChannel({
   route: INTERNAL_SLACK_ROUTE,
+  // 🔴 EVE RESOLVES THROUGH THE SAME SEAM OE DOES (OPE-2231), and this line is not optional. Eve's
+  // POST handler re-verifies the Slack signature and resolves its own bot token; with no `credentials`
+  // it read both from `process.env` and nowhere else. Once `/setup` could put them in the credential
+  // store instead, that made a store-configured deployment one where OE's verification passed and
+  // eve's 401'd — nothing acked, nothing woken. See agent/setup/eve-credentials.ts.
+  credentials: SLACK_EVE_CREDENTIALS,
   // 🔴 QUEUE, NEVER STEER (OPE-412). eve's own default is `steer`, and a steer delivery carrying
   // a message CANCELS the turn in flight — rolling session history back to the last completed
   // model call while that call's tool side effects (posts, PRs, writes) stay real and unrecorded.

package/agent/contributions.ts

@@ -28,5 +28,6 @@ export const CONTRIBUTIONS = {
     // ── channels ─────────────────────────────────────────────────────────────────────────────────
     { kind: "channel", name: "slack", module: "agent/channels/slack.js", summary: "The Slack surface. Wires Slack's webhook → an OpenEverywhere session, and — the point of the \"Slack-binding\" slice — populates the session auth context with the REAL Slack identity (team/channel/user…" },
     { kind: "channel", name: "slack-commands", module: "agent/channels/slack-commands.js", summary: "The Slack SLASH-COMMAND ingestion surface for \"/oe\" — the zero-inference control-plane escape hatch (backlog item 23): pure logic, instant code-rendered responses, NO model turn, so it keeps…" },
+    { kind: "channel", name: "slack-setup-page", module: "agent/channels/slack-setup-page.js", summary: "The agent-led Slack setup page (OPE-2231) — `GET`/`POST /setup` create the Slack app from the shipped manifest with one pasted app configuration token, and `GET /setup/callback` takes the OAuth install's bot token. All three 404 until the credential vault is armed AND no install is recorded." },
   ],
 } as const;