@open-everywhere/provider-slack 0.1.4 → 0.2.1

package/NOTICE

@@ -8,10 +8,40 @@ This product is licensed under the Apache License, Version 2.0 (see LICENSE).
 Built on Vercel Eve (https://github.com/vercel/eve), licensed under the
 Apache License, Version 2.0.
 
-@open-everywhere/core also ships a patch that modifies Vercel Eve (the file in
-its patches/ directory), with the oe-eve-patch command that applies it to a
-consumer's own installed copy. The patch is licensed under the Apache License,
-Version 2.0. No modified Vercel Eve files are distributed.
+---
+
+Modifications to eve
+
+The @open-everywhere/core package distributes patches/eve+0.71.0.patch. That
+patch file is a modification of eve 0.71.0. Vercel licenses eve 0.71.0 under the
+Apache License, Version 2.0. The copyright notice of eve 0.71.0 reads
+"Copyright 2026 Vercel, Inc. and contributors". The Open Everywhere authors made
+the changes in the patch file.
+
+The patch modifies four files of eve 0.71.0:
+
+  dist/src/execution/web-fetch/request.js
+  dist/src/harness/tool-loop.js
+  dist/src/internal/authored-package-boundary.js
+  dist/src/protocol/message.d.ts
+
+Open Everywhere does not ship the eve package. eve is a peer dependency, so the
+consumer installs eve 0.71.0 from the registry. The patch file carries the
+modified portions of eve. The oe-eve-patch command, which
+@open-everywhere/core ships, applies them to the eve that the consumer
+installed. The command patches no file outside the consumer's own project. To
+restore an eve that holds an older Open Everywhere patch, it also writes to npm's
+cache and to a temporary directory.
+
+The attribution notice of eve 0.71.0 follows, as section 4(d) of the Apache
+License, Version 2.0 requires. The notices for eve's bundled code-mode runtime
+are not reproduced, because the patch modifies no part of that runtime.
+
+eve
+Copyright 2026 Vercel, Inc. and contributors
+
+This product includes software developed at Vercel, Inc.
+(https://vercel.com/).
 
 ---
 

package/README.md

@@ -15,7 +15,7 @@ asserts that **every** one of them is absent from `packages/core/agent`. For Sla
 ## Install
 
 ```sh
-npm i @open-everywhere/core @open-everywhere/provider-slack eve@0.54.3
+npm i @open-everywhere/core @open-everywhere/provider-slack eve@0.71.0
 npx oe-eve-patch
 ```
 

package/agent/app-manifest.ts

@@ -16,9 +16,16 @@
  *  operator, who has usually not deployed yet when they run it. */
 export const SLACK_DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
 
-/** The app name the manifest carries when the operator names none. */
+/** The app name the manifest carries when the operator names none AND the deployment configures no
+ *  `identity.name`. The same brand default core's `agentDisplayName()` falls back to. */
 export const SLACK_DEFAULT_APP_NAME = "Open Everywhere";
 
+/** The slash command's name when the caller passes none — the shipped `identity.commandName`. */
+const SLACK_DEFAULT_COMMAND_NAME = "oe";
+
+/** Slack's limit on a shortcut's name. A longer one fails at paste time. */
+export const SLACK_SHORTCUT_NAME_MAX = 24;
+
 /** Slack's limit on an app name (`display_information.name`). A longer name fails at paste time. */
 export const SLACK_APP_NAME_MAX = 35;
 
@@ -31,17 +38,44 @@ export function slackAppNameProblem(raw: string): string | undefined {
   return undefined;
 }
 
-/** Options for {@link slackAppManifestTemplate}. */
+/** Options for {@link slackAppManifestTemplate}. This module imports nothing, so the caller reads
+ *  the deployment's settings and passes them in (OPE-2334): `agent/ops.ts` and the `/setup` page
+ *  read core's resolvers, and the setup CLI reads the app's own settings file. */
 export interface SlackAppManifestOptions {
-  /** The app name and the bot user's display name. Default {@link SLACK_DEFAULT_APP_NAME}. A
-   *  second install in one workspace needs its own name, or the two apps look the same. */
+  /** An EXPLICIT app name (`--app-name`, the ops tool's `appName`, the `/setup` form). It wins
+   *  over {@link agentName}. A second install in one workspace needs its own name, or the two apps
+   *  look the same. */
   readonly appName?: string;
+  /** The deployment's configured name — the `identity.name` setting. It names the app, the bot user,
+   *  the shortcuts and the command description when no explicit {@link appName} is given. Absent ⇒
+   *  {@link SLACK_DEFAULT_APP_NAME}. */
+  readonly agentName?: string;
+  /** The slash command's name without the slash — the `identity.commandName` setting. Absent ⇒
+   *  {@link SLACK_DEFAULT_COMMAND_NAME}. */
+  readonly commandName?: string;
+}
+
+/** The app name a manifest carries: the explicit name, else the configured name, else the default.
+ *  A configured name past Slack's limit is cut to fit, because Slack refuses the whole paste. */
+export function slackManifestAppName(opts: SlackAppManifestOptions = {}): string {
+  const explicit = opts.appName?.trim();
+  if (explicit) return explicit;
+  const configured = opts.agentName?.trim();
+  if (configured) return configured.slice(0, SLACK_APP_NAME_MAX).trim();
+  return SLACK_DEFAULT_APP_NAME;
+}
+
+/** A shortcut name that names the app, or the neutral form when the name does not fit. */
+function shortcutName(prefix: string, appName: string, neutral: string): string {
+  const named = `${prefix} ${appName}`;
+  return named.length <= SLACK_SHORTCUT_NAME_MAX ? named : neutral;
 }
 
 /** A ready-to-paste Slack app manifest (Slack's "create from manifest" flow) with the scope/event
  *  set docs/deploy/surfaces/slack.md walks through by hand. */
 export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): string {
-  const appName = opts.appName?.trim() || SLACK_DEFAULT_APP_NAME;
+  const appName = slackManifestAppName(opts);
+  const commandName = opts.commandName?.trim() || SLACK_DEFAULT_COMMAND_NAME;
   return JSON.stringify(
     {
       display_information: { name: appName },
@@ -60,9 +94,10 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // configures SEPARATELY from the Events request URL above.
         slash_commands: [
           {
-            command: "/oe",
+            // The `identity.commandName` setting (OPE-2334). The route checks the same name.
+            command: `/${commandName}`,
             url: `https://${SLACK_DEPLOY_HOST_PLACEHOLDER}/eve/v1/slack/commands`,
-            description: "Open Everywhere control-plane commands (stop, status, budget) — no model turn.",
+            description: `${appName} control-plane commands (stop, status, budget) — no model turn.`,
             // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
             // scripts/slack-app-manifest-test.ts fails if one is missing here.
             usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | help",
@@ -80,13 +115,13 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // receives, so renaming one here changes only the trigger name the model is told about.
         shortcuts: [
           {
-            name: "Send to Open Everywhere",
+            name: shortcutName("Send to", appName, "Send to the agent"),
             type: "message",
             callback_id: "oe_message_shortcut",
             description: "Wake the agent on this message.",
           },
           {
-            name: "Ask Open Everywhere",
+            name: shortcutName("Ask", appName, "Ask the agent"),
             type: "global",
             callback_id: "oe_global_shortcut",
             description: "Wake the agent in a DM.",

package/agent/channels/slack-commands.ts

@@ -38,6 +38,7 @@ import { slackSigningSecret } from "../setup/credentials.js";
 import {
   bindFrom,
   runOeCommand,
+  oeSlash,
   parseSlackCommandText,
   resolvePartition,
   getOperationalStore,
@@ -204,13 +205,16 @@ export default defineChannel({
       }
 
       const command = formField(params, "command");
-      if (command !== "/oe") {
-        // Defensive, not a security gate: this route is dedicated to "/oe" — the Slack app's
+      // The command's name is the `identity.commandName` setting (OPE-2334), the same value the
+      // manifest declares, so a renamed command is answered here rather than refused.
+      const expected = oeSlash();
+      if (command !== expected) {
+        // Defensive, not a security gate: this route is dedicated to the one command — the Slack app's
         // Slash Command config should only ever point ONE command at it. Anything else is a
         // misconfiguration (a second command aimed at the same URL); answer politely instead
         // of a bare 404/500 so it's obvious in Slack what to fix.
-        log(`unexpected slash command "${command ?? "?"}" hit the /oe route — check the Slack app's Slash Command config`);
-        return ephemeralResponse('This endpoint only handles "/oe" — check your Slack app\'s Slash Command configuration.');
+        log(`unexpected slash command "${command ?? "?"}" hit the ${expected} route — check the Slack app's Slash Command config`);
+        return ephemeralResponse(`This endpoint only handles "${expected}" — check your Slack app's Slash Command configuration.`);
       }
 
       const cmd = parseSlackCommandText(formField(params, "text"));
@@ -223,7 +227,7 @@ export default defineChannel({
         // (e.g. proposing from a DM with no explicit scope) — surface it verbatim. Never let a
         // thrown error escape as a 500; Slack's slash-command UX for that is an ugly
         // "operation_timeout"/dispatch_failed toast.
-        log(`"/oe" command failed softly: ${String(err)}`);
+        log(`"${expected}" command failed softly: ${String(err)}`);
         return ephemeralResponse(`Couldn't complete that: ${err instanceof Error ? err.message : String(err)}`);
       }
     }),

package/agent/channels/slack-events.ts

@@ -3682,33 +3682,91 @@ export function fetchChannelDisplayName(channelId: string): Promise<string | und
   return p;
 }
 
+/** Slack error codes that mean this app STRUCTURALLY cannot read a room's roster (OPE-2306): a scope
+ *  the install does not hold, a room it cannot see, a permission or Grid grant it lacks. A retry
+ *  cannot change them, so the roster is `unobservable` and the observed-guest legs stay inert. Every
+ *  other non-ok code is `failed` ON PURPOSE (fail closed): an unlisted steady-state code makes the
+ *  connector-disclosure floor refuse until it is added here. */
+const SLACK_ROSTER_UNOBSERVABLE_ERRORS: ReadonlySet<string> = new Set([
+  "missing_scope",
+  "channel_not_found",
+  "not_in_channel",
+  "method_not_supported_for_channel_type",
+  "no_permission",
+  "team_access_not_granted",
+]);
+
+/** The unresolved state of a non-ok Slack answer. No answer at all (a network failure, an exhausted
+ *  429 retry, no bot token: slackForm returns `undefined`) is `failed`, and so is an unknown code. */
+function slackRosterFailureState(res: Record<string, unknown> | undefined): "unobservable" | "failed" {
+  return typeof res?.error === "string" && SLACK_ROSTER_UNOBSERVABLE_ERRORS.has(res.error) ? "unobservable" : "failed";
+}
+
 /**
  * Live Slack roster for a governance channel's floor tripwire (OPE-110, access/audience-floor.ts).
- * Two fail-closed Slack reads: conversations.info (is_private + externally-shared bit) and
- * conversations.members (member ids). The bot's own user id is excluded so the agent doesn't count
- * as a non-admin member. FAIL CLOSED: any failed/absent lookup ⇒ `resolved: false` ⇒ the floor can
- * never arm. `hasGuest` uses the channel's externally-shared bit as the available external signal;
+ * Up to three Slack reads: conversations.info (is_private + externally-shared bit),
+ * conversations.members (member ids) and auth.test (the bot's own user id). The roster excludes the
+ * bot's own user id, so the agent doesn't count as a non-admin member. A failed conversations.info
+ * or conversations.members read, a members list of a NON-SHARED channel longer than one page, or a
+ * thrown error returns `resolved: false`, with an `unresolvedState` (OPE-2306). A transient failure
+ * is `failed`: a non-ok answer outside SLACK_ROSTER_UNOBSERVABLE_ERRORS, no answer, a thrown error, a
+ * conversations.info answer with no channel object. A steady state is `unobservable`: a code in that
+ * set, or a non-shared members list longer than one page. A failed auth.test does not unresolve the roster: the roster stays resolved and counts the bot as a
+ * non-admin member, so the governance channel does not arm. `resolved: false` is closed for the
+ * governance tripwire: the floor computes to `guest`, so the channel can never arm. It is
+ * also closed for the clicker floor's beneficiary leg, which refuses on it (`unattested-room`). It
+ * is closed for the connector-disclosure floor when it is `failed`: that floor refuses until the
+ * roster resolves (OPE-2306). It is NOT closed for the observed-guest legs of the triggered-fire
+ * disclosure floor, the card-disclosure floor and the approval-card clicker floor, nor for the
+ * connector-disclosure floor on an `unobservable` roster. Those refuse only an OBSERVED guest, so
+ * they stay INERT (access/audience-floor.ts, the polarity rule). Core memoizes a `resolved: false`
+ * answer for UNRESOLVED_ROSTER_TTL_MS (30 s) only, not for the full memo TTL (OPE-2150), so one
+ * failed read disarms the inert legs, and refuses the connector-disclosure floor, for at most that
+ * short window.
+ * `hasGuest` uses the channel's externally-shared bit as the available external signal;
  * per-member guest classification rides the guest-detection work (design §2/§10 fragile-point #1) and
  * is a future tightening, not a loosening (an internal-only private channel already needs every
  * member on the roster to arm). Governance channels are small by config lint, so a single members
- * page suffices; a channel larger than one page fails closed on the (unset) cursor rather than
- * silently attesting a partial roster.
+ * page suffices. A NON-SHARED channel larger than one page returns `resolved: false` rather than a
+ * partial roster: the governance channel does not arm, and the disclosure floors stay inert
+ * (`unobservable`: the member list is incomplete and a retry gets the same page count). An
+ * EXTERNALLY-SHARED channel larger than one page resolves with `hasGuest: true` and an empty member
+ * list, without a read of the other pages (OPE-2311). The floor counts the channel's shared bit as
+ * a guest present, the same signal the one-page path uses (the bit includes a pending external
+ * invitation and an Enterprise Grid org share). So the floor is `guest` and the observed-guest legs
+ * of every consumer refuse.
  */
 export async function slackGovernanceRoster(channelId: string): Promise<RoomRoster | undefined> {
   try {
     const info = await slackForm("conversations.info", `channel=${encodeURIComponent(channelId)}`);
-    if (info?.ok !== true) return { humanMemberIds: [], resolved: false, isPrivate: false, hasGuest: false };
+    if (info?.ok !== true) {
+      return { humanMemberIds: [], resolved: false, unresolvedState: slackRosterFailureState(info), isPrivate: false, hasGuest: false };
+    }
     const facts = channelFactsFromInfo(info);
     const members = await slackForm("conversations.members", `channel=${encodeURIComponent(channelId)}&limit=200`);
     if (members?.ok !== true || !Array.isArray(members.members)) {
-      return { humanMemberIds: [], resolved: false, isPrivate: false, hasGuest: false };
+      return { humanMemberIds: [], resolved: false, unresolvedState: slackRosterFailureState(members), isPrivate: false, hasGuest: false };
     }
     const cursor = (members.response_metadata as { next_cursor?: string } | undefined)?.next_cursor;
     if (cursor && cursor.length > 0) {
-      // More than one page: a governance channel this large is off-policy (lint caps channel COUNT,
-      // not membership, but a >200-member "admin" room is a smell) — fail closed rather than attest a
-      // partial roster as if it were the whole audience.
-      return { humanMemberIds: [], resolved: false, isPrivate: false, hasGuest: false };
+      // More than one page. An externally-shared channel needs no member list: the floor counts the
+      // shared bit as a guest present, as the one-page path does (OPE-2311). So the roster resolves
+      // with `hasGuest: true` and an EMPTY member list, never a partial one. The floor is `guest` for every consumer, and
+      // the observed-guest legs refuse. The share bit is a steady state, so the full memo TTL is fine.
+      if (facts.trustChecked === true && facts.isExternal === true) {
+        return { humanMemberIds: [], resolved: true, isPrivate: facts.isPrivate === true, hasGuest: true };
+      }
+      // An ok conversations.info with no channel object is an odd answer, not a steady state: it is
+      // `failed`, as on the one-page path below.
+      if (facts.trustChecked !== true) {
+        return { humanMemberIds: [], resolved: false, unresolvedState: "failed", isPrivate: false, hasGuest: false };
+      }
+      // A non-shared channel this large: do not attest a partial roster as if it were the whole
+      // audience (a >200-member "admin" room is off-policy anyway). An unresolved roster keeps the
+      // governance channel disarmed, but it leaves the disclosure floors INERT, not closed
+      // (access/audience-floor.ts, the polarity rule). `unobservable` (OPE-2306): a retry gets the
+      // same page count.
+      return { humanMemberIds: [], resolved: false, unresolvedState: "unobservable", isPrivate: false, hasGuest: false };
     }
     const auth = await slackForm("auth.test", "");
     const botId = auth?.ok === true && typeof auth.user_id === "string" ? auth.user_id : undefined;
@@ -3718,11 +3776,13 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
     return {
       humanMemberIds,
       resolved: facts.trustChecked === true, // conversations.info authoritative
+      // An ok conversations.info with no channel object is an odd answer, not a steady state.
+      ...(facts.trustChecked === true ? {} : { unresolvedState: "failed" as const }),
       isPrivate: facts.isPrivate === true,
       hasGuest: facts.isExternal === true,
     };
   } catch {
-    return { humanMemberIds: [], resolved: false, isPrivate: false, hasGuest: false };
+    return { humanMemberIds: [], resolved: false, unresolvedState: "failed", isPrivate: false, hasGuest: false };
   }
 }
 

package/agent/channels/slack-front.ts

@@ -119,6 +119,7 @@ import {
   tailAuthorGrain,
   dmWindowRegistryKey,
   approvalCardRespondVia,
+  stampSurfaceEventVerified,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   renderWakeMessage,
@@ -559,6 +560,9 @@ export interface FrontOptions {
   readonly now?: () => number;
   /** Durable first-sighting check (true = proceed). Defaults to the operational store. */
   readonly markEventSeen?: (org: string, key: string, atIso: string) => Promise<boolean>;
+  /** The durable "a signed event was verified" stamp (OPE-2242), called only after a verify
+   *  passes. Defaults to core's `stampSurfaceEventVerified("slack")`. */
+  readonly stampEventVerified?: () => Promise<unknown>;
   /** Is ambient-supervisor mode enabled for this channel's domain? (sync config lookup.)
    *  Defaults to the live domain resolver (memory/domain.ts). Fail-closed off: when this
    *  returns false the unowned-message dispatch is BYTE-IDENTICAL to today's name-drop path. */
@@ -572,7 +576,7 @@ export interface FrontOptions {
    * tests can stub it without the propose/store/executor machinery it drags in.
    *
    * 🔴 IT TAKES THE ROUTE'S `waitUntil` (OPE-1709), for the same reason the Discord front's
-   * approval branch does: "Approve for session" releases the sibling cards the grant already
+   * approval branch does: "Approve for this routine" releases the sibling cards the grant already
    * covers, and each release runs a real `execute`. That work belongs off the interactivity
    * response path. The handler falls back to its old awaited shape when this is absent, which is
    * exactly what a stub that ignores the second argument gets. */
@@ -1017,6 +1021,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   // the same property read it always was for every pre-OPE-2231 deployment.
   const resolveSigningSecret = async (): Promise<string | undefined> => opts.signingSecret ?? (await slackSigningSecret());
   const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
+  const stampEventVerified = opts.stampEventVerified ?? (() => stampSurfaceEventVerified("slack"));
   // OPE-589 leg D: reuse the taint-marking member probe (slack-events.ts `slackClickerIsGuest`,
   // itself `slackAuthorIsMember` inverted). Same `users.info` call and cache the channel-taint leg
   // already pays for, so a clicker who recently posted a message in the same workspace is often a
@@ -1082,6 +1087,19 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     if (!verifySlackSignature(rawBody, req.headers, requestSigningSecret, now())) {
       return new Response("unauthorized", { status: 401 });
     }
+    // 🔴 THE DURABLE PROOF THAT THIS GATE ACCEPTED A SIGNED DELIVERY (OPE-2242), and it sits HERE —
+    // after the verify, before any classification — on purpose. Every Slack delivery crosses this
+    // line, whatever its envelope, its domain topology or its turn's outcome, so `eventsVerified` on
+    // the status route no longer depends on a session row whose key may carry no platform marker.
+    // It is a TRACKED write (`holdRouteWork`), not a `waitUntil` of its own: it rides whatever
+    // background work this delivery registers, so the existing registration counts do not change. A
+    // NATIVE FORWARD also AWAITS it (`forwardNative` below), because a forward can register no
+    // background work at all — eve answers the install-time `url_verification` challenge inline — and
+    // an unheld write there can be frozen after the 200 and lost. The debounce makes that await a
+    // real write at most once an hour per process; every other await resolves at once. On the other
+    // doors the write stays best-effort when the delivery registers nothing. It is fail-soft in core,
+    // so it never fails the delivery.
+    const stamped = holdRouteWork(stampEventVerified().catch(() => undefined));
     const decision = classifyEnvelope(rawBody, req.headers.get("content-type") ?? "");
 
     /**
@@ -1117,7 +1135,11 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
      * EVERY native forward is wrapped for the same reason the attachment fence is: an `im` message
      * forwards natively too, so a rung carried on the mention path alone would be half a rung.
      */
-    const forwardNative = (): Promise<Response> =>
+    const forwardNative = async (): Promise<Response> => {
+      await stamped;
+      return forwardNativeNow();
+    };
+    const forwardNativeNow = (): Promise<Response> =>
       withForwardedSlackEnvelope(forwardedEnvelopeOf(rawBody), () => {
         const fenced = stripUnfencedSlackAttachments(rawBody);
         const ts = req.headers.get(SLACK_TIMESTAMP_HEADER);
@@ -2036,7 +2058,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       //
       // 🔴 `args.waitUntil` RIDES ALONG (OPE-1709), and it is the HELD one (see the route hold
       // above), so the deferred work is quiesced before the delivery's own promise resolves. What
-      // it moves off this path is the session-grant release: an "Approve for session" click on a
+      // it moves off this path is the session-grant release: an "Approve for this routine" click on a
       // fan-out decides and EXECUTES the sibling cards the grant already covers, and that loop has
       // no business inside Slack's three-second interactivity budget.
       if (await handleApproval(decision.payload, { waitUntil: args.waitUntil })) {

package/agent/channels/slack-task-card.ts

@@ -0,0 +1,182 @@
+// THE TASK CARD'S CONFIDENTIALITY SEAM (OPE-2255).
+//
+// eve 0.69 posts a live TASK CARD for every turn that starts a task: one message per turn, one row
+// per task, updated in place. OE adopts eve's own card (Tommy's principle: native first), so this
+// file draws nothing itself. Every card still comes from eve's `renderDefaultSlackTaskCard` through
+// `next`. This file only changes the VIEW that eve draws from.
+//
+// WHY A SEAM. An agent task's row title is the worker BRIEF (`<agent>: <brief>`, or the brief alone
+// for a call to the agent's own copy). The model writes that brief from the whole session context.
+// On a unified domain seat, that context can hold another conversation, for example a DM. eve gates
+// only a failure line and a blocker's label on the room's audience, and eve's `private` audience
+// covers private channels and group DMs too, which have several readers. The title, the
+// notification `text` (`Working on 1 task: <the whole brief>`, not cut) and a completed row's
+// `Done in Xs: <first sentence of the worker's reply>` reach a public channel unchanged
+// (OPE-2246 Q7, measured on a real `actions.requested`).
+//
+// THE RULE. OE cannot trace the provenance of one model-written string. So the rule is on the ROOM,
+// and it fails closed:
+//   * A task row shows its own title only in a 1:1 DM whose only human is the turn's own caller.
+//   * In every other room (a public channel, a private channel, a group DM, an unknown room) the row
+//     shows a generic label made from the task's NAME only. The name is code, not model text. A
+//     blocked row there keeps only the KIND of its blocker (`Waiting for a response`), never the
+//     request's prompt or the connection's name.
+//   * A completed row NEVER shows the worker's result excerpt, in any room. That excerpt bypasses
+//     `approvals/review-surface.ts`, which frames a delegated verdict as a model opinion. eve keeps
+//     the `Done in Xs` line, so the card still says the task finished.
+// eve builds the notification `text` from the row titles, so the same redaction covers it.
+//
+// WHY A SESSION STATE SLOT. The `taskCard` hook is pure and synchronous, and its view carries no room.
+// The view's `turnId` is no key either: eve numbers turns per session (`turn_<sequence>`), so two
+// sessions in one process share turn ids. eve dispatches each session event inside that session's
+// eve context, and `withTaskCards` writes the card inside the same dispatch. So each tracked event
+// handler below records the room in a `defineState` slot, which is keyed to the session and
+// durable, and the `taskCard` link reads back the LATEST room this session recorded. Most writes
+// follow the handler of their own event. One does not: on `task.started`, eve's `closeSettledCard`
+// writes the closing card BEFORE the handler runs, so that write reads the room an earlier event of
+// the session recorded. That is safe because a session's channel and its DM partner do not change.
+// No slot, or no eve context, reads as a shared room: the card then shows the generic label. It
+// never shows the brief by accident.
+
+import { defineState } from "eve/context";
+import type {
+  SlackEventContext,
+  SlackRenderer,
+  SlackRendererEvents,
+  SlackTaskCard,
+  TaskCardTask,
+  TaskCardView,
+} from "eve/channels/slack";
+
+/** The room a task card lands in. Only `direct-message` shows a task's own title. */
+export type TaskCardRoom = "direct-message" | "shared";
+
+/** The label for a call to the agent's own copy, whose eve name (`agent`) says nothing to a reader. */
+export const GENERIC_SELF_TASK_LABEL = "Delegated task";
+
+/** eve's tool name for a call to the agent's own copy (`tools/framework/agent-contract.js`). */
+const AGENT_SELF_TOOL_NAME = "agent";
+
+/** The facts the room decision reads: the card's target channel and the turn caller's auth. */
+export interface TaskCardRoomFacts {
+  /** eve's channel state: the channel the card posts to, and the room's audience. */
+  readonly state: { readonly channelId?: string | null; readonly audience?: string | null };
+  /** The turn caller's auth attributes, as OE's `buildSlackAuth` writes them. */
+  readonly attributes?: Readonly<Record<string, unknown>> | null;
+}
+
+/**
+ * Decide the room. A 1:1 DM needs all three facts: the caller's auth says `channel_type: "im"`, the
+ * auth names the SAME channel the card posts to, and eve does not call the room public. Anything
+ * else, a missing fact included, is a shared room. Pure and total.
+ */
+export function taskCardRoomOf(facts: TaskCardRoomFacts | null | undefined): TaskCardRoom {
+  const channelId = facts?.state?.channelId;
+  const attrs = facts?.attributes;
+  if (typeof channelId !== "string" || channelId === "" || attrs === null || attrs === undefined) return "shared";
+  if (attrs.channel_type !== "im") return "shared";
+  if (attrs.channel_id !== channelId) return "shared";
+  if (facts?.state?.audience === "public") return "shared";
+  return "direct-message";
+}
+
+/** A task's generic label: its name in words, never its brief or its tool's start label. */
+export function genericTaskLabel(task: Pick<TaskCardTask, "kind" | "name">): string {
+  if (task.kind === "agent" && task.name === AGENT_SELF_TOOL_NAME) return GENERIC_SELF_TASK_LABEL;
+  // eve's own `displayTitle` shape: the last `__` segment, words split on case, `_` and `-`.
+  const segment = task.name.split("__").findLast((s) => s !== "") ?? task.name;
+  const words = segment
+    .replace(/([a-z0-9])([A-Z])/gu, "$1 $2")
+    .split(/[\s_-]+/u)
+    .filter((w) => w !== "")
+    .map((w) => (w.length > 1 && w === w.toUpperCase() ? w : w.toLowerCase()));
+  if (words.length === 0) return GENERIC_SELF_TASK_LABEL;
+  const text = words.join(" ");
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+
+/**
+ * The view eve draws for this room. Every row loses its result excerpt. In a shared room every row
+ * also loses its title for the generic label, and a blocked row loses its blocker's label. A pure
+ * function: the input view is never changed.
+ */
+export function confidentialTaskCardView(view: TaskCardView, room: TaskCardRoom): TaskCardView {
+  const tasks = view.tasks.map((task): TaskCardTask => {
+    const { summary: _summary, blockedOn, ...rest } = task;
+    if (room === "direct-message") return blockedOn === undefined ? rest : { ...rest, blockedOn };
+    const redacted: TaskCardTask = { ...rest, title: genericTaskLabel(task) };
+    return blockedOn === undefined ? redacted : { ...redacted, blockedOn: { kind: blockedOn.kind } };
+  });
+  return { ...view, tasks };
+}
+
+const roomSlot = defineState<TaskCardRoom | null>("open-everywhere.slack-task-card-room", () => null);
+
+/** Record the room for this session's next card write. Outside an eve context it does nothing. */
+function recordTaskCardRoom(channel: Pick<SlackEventContext, "state">, ctx: unknown): void {
+  const attributes = (ctx as { session?: { auth?: { current?: { attributes?: Record<string, unknown> } | null } } } | undefined)
+    ?.session?.auth?.current?.attributes;
+  const state = channel.state as unknown as TaskCardRoomFacts["state"];
+  const room = taskCardRoomOf({ attributes, state });
+  try {
+    roomSlot.update(() => room);
+  } catch {
+    // No eve context: nothing to record. The card then reads no room and shows the generic label.
+  }
+}
+
+/** The room this session recorded, or `shared` when none is readable. */
+function readTaskCardRoom(): TaskCardRoom {
+  try {
+    return roomSlot.get() ?? "shared";
+  } catch {
+    return "shared";
+  }
+}
+
+/** The `taskCard` link: redact the view for the recorded room, then let eve draw its default card. */
+export function confidentialTaskCard(
+  view: TaskCardView,
+  next: (view: TaskCardView) => SlackTaskCard | null,
+  room: TaskCardRoom = readTaskCardRoom(),
+): SlackTaskCard | null {
+  return next(confidentialTaskCardView(view, room));
+}
+
+// The events after which eve writes a card: eve's `TRACKED_EVENTS` in
+// `public/channels/slack/task-card.js`, all eleven. `authorization.required` gets eve's private
+// delivery surface as its channel, which still carries the session's `state`.
+const RECORDING_EVENTS = [
+  "authorization.required",
+  "actions.requested",
+  "action.result",
+  "task.started",
+  "task.settled",
+  "input.requested",
+  "input.resolved",
+  "authorization.completed",
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+] as const;
+
+function recordingEvents(): SlackRendererEvents {
+  const events: Record<string, unknown> = {};
+  for (const name of RECORDING_EVENTS) {
+    events[name] = async (_data: unknown, channel: SlackEventContext, ctx: unknown, next: () => Promise<void>) => {
+      recordTaskCardRoom(channel, ctx);
+      await next();
+    };
+  }
+  return events as SlackRendererEvents;
+}
+
+/**
+ * The renderer link. Put it FIRST in the chain, so its handlers record the room before any later
+ * link, which may not call `next`, ends the chain. Each handler records and then calls `next`, so it
+ * changes no rendering of its own.
+ */
+export const taskCardConfidentiality: SlackRenderer = {
+  events: recordingEvents(),
+  taskCard: (view, next) => confidentialTaskCard(view, next),
+};