@open-everywhere/provider-slack 0.5.0 → 0.7.0

package/agent/app-manifest.ts

@@ -62,6 +62,24 @@ export interface SlackAppManifestOptions {
    * The MCP toggle itself (the app config's Agents section) has no manifest field, so it stays a click.
    */
   readonly personalMcp?: boolean;
+  /**
+   * The side panel's suggested prompts (OPE-2457) — the `slack.suggestedPrompts` setting, which the
+   * caller reads (this module imports nothing). Absent or empty ⇒ the manifest offers none. The setup
+   * CLI passes none: it runs before the app's settings resolve, and the post-deploy re-paste from the
+   * ops tool or `/setup` carries them.
+   */
+  readonly suggestedPrompts?: readonly { readonly title: string; readonly message: string }[];
+}
+
+/** Slack's limit on `features.agent_view.agent_description` (the manifest reference: 300). */
+export const SLACK_AGENT_DESCRIPTION_MAX = 300;
+
+/** The side panel's one-line description. Names the configured agent, never the brand on its own. */
+function slackAgentDescription(appName: string): string {
+  return `Ask ${appName} beside anything you are reading in Slack. It is your own direct-message conversation, with the same rules as a DM.`.slice(
+    0,
+    SLACK_AGENT_DESCRIPTION_MAX,
+  );
 }
 
 /** The path the person's OAuth sign-in returns to — core's `OE_OAUTH_CALLBACK_PATH`
@@ -104,6 +122,19 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
         // it delivers `app_home_opened` (below), and the front route publishes the page
         // (channels/slack-home.ts).
         app_home: { home_tab_enabled: true, messages_tab_enabled: true, messages_tab_read_only_enabled: false },
+        // THE SIDE PANEL (OPE-2457) — Slack's agent experience. With `agent_view` on, a person can
+        // open the app's Messages tab beside any channel, and what they send there is an ordinary
+        // `message.im` to their own DM seat (channels/slack-side-panel.ts). `agent_view`, not the
+        // older `assistant_view`: Slack's manifest reference says a NEW app can only use `agent_view`.
+        // 🔴 FOR AN EXISTING APP THE SWITCH IS ONE-WAY: Slack cannot move an app from `assistant_view`
+        // back, and its people need a hard refresh. An app that never had `assistant_view` (every
+        // install of this manifest before OPE-2457) has nothing to switch from.
+        agent_view: {
+          agent_description: slackAgentDescription(appName),
+          ...(opts.suggestedPrompts && opts.suggestedPrompts.length > 0
+            ? { suggested_prompts: opts.suggestedPrompts.map((p) => ({ title: p.title, message: p.message })) }
+            : {}),
+        },
         bot_user: { display_name: appName, always_online: true },
         // The "/oe" ZERO-INFERENCE control command (agent/commands/core.ts). Declared here rather
         // than left to a manual setup step because one of its subcommands is `/oe stop` (OPE-418),
@@ -119,7 +150,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             description: `${appName} control-plane commands (stop, status, budget) — no model turn.`,
             // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
             // scripts/slack-app-manifest-test.ts fails if one is missing here.
-            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | help",
+            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | watch [more | less | none] | help",
             should_escape: false,
           },
         ],
@@ -212,6 +243,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // knows. Without it the canvas refresh fails with `missing_scope`, logged and audited
             // per channel, and memory itself is unaffected.
             "canvases:write",
+            // The side panel (OPE-2457): Slack requires it for `app_context_changed`, the event whose
+            // subscription makes Slack attach the viewed room to each side-panel `message.im`.
+            "assistant:write",
             // Slack requires this bot scope on an app whose people connect to Slack's MCP server
             // (OPE-2421). Declared only when the app declares "search Slack as you".
             ...(personalMcp ? [SLACK_MCP_BOT_SCOPE] : []),
@@ -236,6 +270,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           //   app_home_opened → no scope (the Home tab page, OPE-2451)
           //   channel_shared → channels:read, groups:read (re-run the memory canvas gate, OPE-2451)
           //   user_change → users:read (automatic offboarding on a deactivated member, OPE-2423)
+          //   app_context_changed → assistant:write (the side panel's viewed room, OPE-2457)
           // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
           // this list drops one (OPE-2223).
           bot_events: [
@@ -250,6 +285,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "app_home_opened",
             "channel_shared",
             "user_change",
+            "app_context_changed",
           ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every

package/agent/channels/slack-bot-ask.ts

@@ -0,0 +1,101 @@
+// SLACK'S ARM OF CHIEF-OF-STAFF DELEGATION (OPE-2426) — the probe that proves an ask to another bot, and
+// the facts the front route hands core for an inbound bot message. Core holds the policy
+// (core/agent/channels/bot-ask.ts); this file only reads Slack.
+//
+// THE PROBE reads three facts with the BOT token, never a model string:
+//   1. the ask message itself (`conversations.replies` on its ts). The bot token reads it only when this
+//      app is in the channel, and the app must be in the channel to receive the other bot's reply at all.
+//      So an unreadable message is a refusal that says "invite the agent";
+//   2. its author is the person who asks, and its own text @mentions the named bot;
+//   3. the named account is a bot (`users.info` `is_bot`), and not this app itself (`auth.test`). An
+//      unknown own identity refuses: it cannot prove "not this app".
+// Any failed call refuses (`unreadable`). The probe never throws.
+
+import type { BotAskProbe, BotAskProbeAnswer, BotReplyFacts } from "@open-everywhere/core/agent/adapter-api.js";
+import { encodeSlackForm } from "./slack-web-api.js";
+import type { ParsedMessageEvent } from "./slack-events.js";
+
+/** The Slack calls the probe makes (injectable for the unit test). */
+export interface SlackBotAskDeps {
+  /** One Web API call with the bot token; resolves the parsed body, or undefined on a transport failure. */
+  readonly call: (method: string, body: Record<string, string>) => Promise<Record<string, unknown> | undefined>;
+  /** This app's own bot user id and bot id (`auth.test`), best-effort. */
+  readonly self: () => Promise<{ readonly userId?: string; readonly botId?: string }>;
+}
+
+type SlackMessage = { readonly ts?: unknown; readonly thread_ts?: unknown; readonly user?: unknown; readonly text?: unknown };
+
+/** Does the text @mention this user id (`<@U123>` or `<@U123|name>`)? PURE. */
+export function mentionsUser(text: string, userId: string): boolean {
+  return text.includes(`<@${userId}>`) || text.includes(`<@${userId}|`);
+}
+
+/** Build Slack's probe. */
+export function slackBotAskProbe(deps: SlackBotAskDeps): BotAskProbe {
+  return async (q): Promise<BotAskProbeAnswer> => {
+    try {
+      const [platform, teamId] = q.workspaceKey.split("/");
+      if (platform !== "slack" || !teamId) return { ok: false, reason: "unreadable" };
+      const replies = await deps.call("conversations.replies", { channel: q.channel, ts: q.messageTs, limit: "1", inclusive: "true" });
+      const messages = replies?.ok === true && Array.isArray(replies.messages) ? (replies.messages as SlackMessage[]) : [];
+      const msg = messages.find((m) => m.ts === q.messageTs);
+      if (!msg) return { ok: false, reason: "unreadable" };
+      if (msg.user !== q.personId) return { ok: false, reason: "not-yours" };
+      const text = typeof msg.text === "string" ? msg.text : "";
+      if (!mentionsUser(text, q.bot)) return { ok: false, reason: "bot-not-named" };
+      const self = await deps.self().catch(() => ({}) as { userId?: string; botId?: string });
+      // FAIL-CLOSED: without this app's own user id, a mention of this app cannot be told from another bot's.
+      if (self.userId === undefined) return { ok: false, reason: "unreadable" };
+      if (self.userId === q.bot) return { ok: false, reason: "self" };
+      const info = await deps.call("users.info", { user: q.bot });
+      const user = info?.ok === true && info.user && typeof info.user === "object" ? (info.user as Record<string, unknown>) : undefined;
+      if (!user) return { ok: false, reason: "unreadable" };
+      if (user.is_bot !== true) return { ok: false, reason: "not-a-bot" };
+      const profile = user.profile && typeof user.profile === "object" ? (user.profile as Record<string, unknown>) : {};
+      const botId = typeof profile.bot_id === "string" && profile.bot_id.length > 0 ? profile.bot_id : undefined;
+      if (botId !== undefined && self.botId !== undefined && botId === self.botId) return { ok: false, reason: "self" };
+      const label = [user.real_name, profile.display_name, user.name].find((v) => typeof v === "string" && v.trim().length > 0) as string | undefined;
+      return {
+        ok: true,
+        threadTs: typeof msg.thread_ts === "string" && msg.thread_ts.length > 0 ? msg.thread_ts : q.messageTs,
+        botUserId: q.bot,
+        ...(botId === undefined ? {} : { botId }),
+        ...(label === undefined ? {} : { botLabel: label }),
+        askText: text,
+      };
+    } catch {
+      return { ok: false, reason: "unreadable" };
+    }
+  };
+}
+
+/** The live deps: `slackForm` with the bot token, and the front route's cached `auth.test`. */
+export function liveSlackBotAskDeps(
+  form: (method: string, body: string) => Promise<Record<string, unknown> | undefined>,
+  self: () => Promise<{ readonly userId?: string; readonly botId?: string }>,
+): SlackBotAskDeps {
+  return { call: (method, body) => form(method, encodeSlackForm(body)), self };
+}
+
+/** Is this parsed message a candidate for the asked-thread exception at all? A cheap, pure pre-filter, so a
+ *  human message never pays a store read. PURE. */
+export function botReplyCandidate(ev: ParsedMessageEvent): boolean {
+  return (Boolean(ev.botId) || ev.subtype === "bot_message") && ev.threadTs !== undefined && ev.threadTs !== ev.ts;
+}
+
+/** Core's facts for one parsed Slack message. PURE. */
+export function slackBotReplyFacts(ev: ParsedMessageEvent, org: string, self: { readonly userId?: string; readonly botId?: string }): BotReplyFacts {
+  return {
+    org,
+    platform: "slack",
+    workspace: ev.teamId,
+    channel: ev.channelId,
+    threadTs: ev.threadTs,
+    messageTs: ev.ts,
+    authorUserId: ev.userId,
+    authorBotId: ev.botId,
+    subtype: ev.subtype,
+    ...(self.userId === undefined ? {} : { selfUserId: self.userId }),
+    ...(self.botId === undefined ? {} : { selfBotId: self.botId }),
+  };
+}

package/agent/channels/slack-commands.ts

@@ -36,6 +36,7 @@ import { defineChannel, POST } from "eve/channels";
 import { verifySlackSignature } from "./slack-front.js";
 import { slackSigningSecret } from "../setup/credentials.js";
 import {
+  commandFailureText,
   bindFrom,
   runOeCommand,
   oeSlash,
@@ -223,12 +224,12 @@ export default defineChannel({
         const reply = await runOeCommand(cmd, binding, { attachSession });
         return ephemeralResponse(reply);
       } catch (err) {
-        // runOeCommand's budget-raise/clear branches can throw a user-facing validation error
-        // (e.g. proposing from a DM with no explicit scope) — surface it verbatim. Never let a
-        // thrown error escape as a 500; Slack's slash-command UX for that is an ugly
-        // "operation_timeout"/dispatch_failed toast.
+        // A PersonFacingError is already worded for the person — it renders as-is. Anything else
+        // (a store or network failure, a planner's model-facing refusal) renders the generic line,
+        // and its message goes to the log only (OPE-2486). Never let a thrown error escape as a
+        // 500; Slack's slash-command UX for that is an ugly "operation_timeout"/dispatch_failed toast.
         log(`"${expected}" command failed softly: ${String(err)}`);
-        return ephemeralResponse(`Couldn't complete that: ${err instanceof Error ? err.message : String(err)}`);
+        return ephemeralResponse(commandFailureText(err));
       }
     }),
   ],

package/agent/channels/slack-events.ts

@@ -17,6 +17,7 @@
 // envelope reaches `routeMessageEvent`. Until then this is unit-tested but unmounted.
 
 import { slackContinuationToken } from "eve/channels/slack";
+import { parseSlackAppContext, type SlackAppContextRoom } from "./slack-side-panel.js";
 import { callSlackWebApi } from "./slack-web-api.js";
 import { slackBotToken } from "../setup/credentials.js";
 import { RateLimitExhaustedError } from "@open-everywhere/core/agent/adapter-api.js";
@@ -265,6 +266,10 @@ export interface ParsedMessageEvent {
    *  the wake envelope so the agent knows an image exists and can `describe_image` it. Empty/
    *  absent when the message carries no files. Never the bytes — just id/name/mimetype/url. */
   readonly attachments?: readonly WakeAttachment[];
+  /** The room the person was viewing in the side panel (OPE-2457), from the event's `app_context`.
+   *  UNVERIFIED — slack-side-panel.ts `sidePanelViewedRoom` gates it before any use. Absent on every
+   *  event that carries no channel entity, which is every non-panel message. */
+  readonly appContext?: SlackAppContextRoom;
 }
 
 /** Parse Slack's `files[]` (on a message event's inner message) into attachment references.
@@ -710,6 +715,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   const teamId = envelope.team_id ?? (typeof e.team === "string" ? e.team : undefined);
   const enterpriseId = slackEnterpriseIdFromEnvelope(envelope);
   const attachments = parseSlackFiles(inner.files);
+  const appContext = parseSlackAppContext(e);
   // TRUSTED PROVENANCE: record each IMAGE attachment's url_private under its Slack file id so
   // describe_image's `attachmentId` path (via the attachment plane's Slack resolver) can resolve the
   // model-named id → this event's url_private and fetch it with the bot token
@@ -738,6 +744,8 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
     // Image/file attachments (docs Part B) — read off the same inner message the text came
     // from (so an edit's post-edit files win). Absent for the common no-file message.
     attachments,
+    // The side panel's viewed room (OPE-2457) rides the OUTER event, never an edit's inner message.
+    ...(appContext === undefined ? {} : { appContext }),
   };
 }
 
@@ -1058,6 +1066,10 @@ export interface SlackWakeOpts {
    *  (channels/seat-catch-up.ts `catchUpUnavailableReason`). Rendered as a trusted `<system-note>`;
    *  unset ⇒ no note, which is every Slack wake, because Slack registers a fetch. */
   readonly catchUpUnavailable?: string;
+  /** OE's own trusted note for this wake (`<system-note>`): fixed words around host-checked ids only.
+   *  Set by the DM door alone — the side panel's viewed room and the person's opt-out
+   *  (slack-side-panel.ts `slackDmSystemNote`). Unset ⇒ no note, byte-identical to before. */
+  readonly systemNote?: string;
   /**
    * THE NAME-DROP HYDRATION, ON THE SEAT ROAD (OPE-1725). The surrounding conversation
    * {@link routeNameDropEvent} fetches for a name-drop, as RAW {@link ContextLine}s — renderWake
@@ -1142,6 +1154,7 @@ function slackJudgedWake(
     ...(addressing === "name-drop" ? { nameDrop: { followUp: "follows-on-reply" as const } } : {}),
     // The catch-up bound, stated on the wake that could not take one ({@link SlackWakeOpts.catchUpUnavailable}).
     ...(opts.catchUpUnavailable !== undefined ? { catchUpUnavailable: opts.catchUpUnavailable } : {}),
+    ...(opts.systemNote !== undefined ? { systemNote: opts.systemNote } : {}),
     // The name-drop hydration's side-channel slot ({@link SlackWakeOpts.contextLines}). Spread
     // conditionally so a wake that states none carries no key at all — the shape every
     // characterization golden was taken against.
@@ -3539,17 +3552,20 @@ async function fetchChannelTranscript(channelId: string): Promise<string | undef
 // `handle` = the person's SELF-SET display name (Tag treats the handle as the better human-address
 // signal). Both are UNTRUSTED, attacker-controllable profile content — the wake renderer XML-escapes
 // them wherever they land in the envelope frame.
-const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string } | undefined>>();
-export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string } | undefined> {
+const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string; email?: string } | undefined>>();
+export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string; email?: string } | undefined> {
   let p = userProfileCache.get(userId);
   if (!p) {
     p = (async () => {
       const info = await slackForm("users.info", `user=${encodeURIComponent(userId)}`);
       if (info?.ok !== true) return undefined;
-      const user = info.user as { profile?: { display_name?: string; real_name?: string }; real_name?: string; name?: string } | undefined;
+      const user = info.user as { profile?: { display_name?: string; real_name?: string; email?: string }; real_name?: string; name?: string } | undefined;
       const handle = user?.profile?.display_name?.trim() || undefined;
       const name = user?.profile?.real_name?.trim() || user?.real_name?.trim() || user?.name?.trim() || undefined;
-      return { name, handle };
+      // The workspace-verified address, present only under the `users:read.email` scope (OPE-2482): the
+      // identifier a person can check beside a self-set name.
+      const email = user?.profile?.email?.trim() || undefined;
+      return { name, handle, ...(email ? { email } : {}) };
     })();
     userProfileCache.set(userId, p);
   }

package/agent/channels/slack-friendly-names.ts

@@ -0,0 +1,55 @@
+// slack-friendly-names — the Slack name resolver for the friendly-names guard (OPE-2482).
+//
+// The guard (core `channels/friendly-outbound.ts`) asks this resolver for a display name before it
+// renders a raw Slack id in text a person reads. A member id answers the person's display name, a
+// channel id answers `#name`, and the workspace id answers the install's recorded team name. Every
+// lookup rides a cache that already exists (`users.info`, `conversations.info`), so a name costs one
+// Slack call per id per instance. Any failure answers undefined: the id then renders as a mention or
+// plain words, never as itself.
+
+import type { FriendlyNameResolver } from "@open-everywhere/core/agent/adapter-api.js";
+import { fetchChannelDisplayName, fetchUserDisplayName } from "./slack-events.js";
+import { slackInstallState } from "../setup/install-state.js";
+
+/** The lookups the resolver uses. Live code passes none; a test injects each. */
+export interface SlackFriendlyNameDeps {
+  readonly userName?: (id: string) => Promise<string | undefined>;
+  readonly channelName?: (id: string) => Promise<string | undefined>;
+  readonly teamName?: (id: string) => Promise<string | undefined>;
+}
+
+// The install record is read at most once per TEAM_NAME_TTL_MS, and only a FOUND name is kept: a post
+// path must not read the store per message, and a deployment that installs (or renames its workspace)
+// after boot must still be named without a restart.
+const TEAM_NAME_TTL_MS = 30 * 60_000;
+let teamNameMemo: { readonly teamId: string; readonly name: string; readonly at: number } | undefined;
+
+/** The workspace name, when the recorded install is that workspace. */
+async function liveTeamName(id: string): Promise<string | undefined> {
+  if (teamNameMemo && teamNameMemo.teamId === id && Date.now() - teamNameMemo.at < TEAM_NAME_TTL_MS) return teamNameMemo.name;
+  const install = await slackInstallState().catch(() => undefined);
+  if (install?.teamId === id && install.teamName) {
+    teamNameMemo = { teamId: id, name: install.teamName, at: Date.now() };
+    return install.teamName;
+  }
+  return undefined;
+}
+
+/** Build the Slack resolver. */
+export function slackFriendlyNameResolver(deps: SlackFriendlyNameDeps = {}): FriendlyNameResolver {
+  return async (id) => {
+    if (/^[UW]/.test(id)) {
+      const name = await (deps.userName ?? fetchUserDisplayName)(id);
+      return name ? { label: name, kind: "person" } : undefined;
+    }
+    if (/^[CG]/.test(id)) {
+      const name = await (deps.channelName ?? fetchChannelDisplayName)(id);
+      return name ? { label: `#${name.replace(/^#/, "")}`, kind: "channel" } : undefined;
+    }
+    if (/^T/.test(id)) {
+      const name = await (deps.teamName ?? liveTeamName)(id);
+      return name ? { label: name, kind: "server" } : undefined;
+    }
+    return undefined;
+  };
+}

package/agent/channels/slack-front.ts

@@ -120,7 +120,16 @@ import {
   tailAuthorGrain,
   dmWindowRegistryKey,
   stampSurfaceEventVerified,
+  readPersonOptOut,
+  auditPersonOptOutRefusal,
+  PERSON_OPT_OUT_SHORTCUT_NOTICE,
+  PERSON_OPT_OUT_UNREADABLE_NOTICE,
+  type PersonOptOutState,
+  admitAskedBotReply,
+  deploymentOrg,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { botReplyCandidate, slackBotReplyFacts } from "./slack-bot-ask.js";
+import { sidePanelViewedRoom, slackDmSystemNote } from "./slack-side-panel.js";
 import {
   renderWakeMessage,
   slackChannelFactsFor,
@@ -219,7 +228,10 @@ export type FrontDecision =
   /** An `oe_home:` click on the Home tab (OPE-2451) — ours: run a button, or open an item's modal. */
   | { readonly kind: "home-click"; readonly reason: string; readonly click: ParsedHomeClick }
   /** A submission of the Home tab's own modal (OPE-2451) — ours: run the action, republish the page. */
-  | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission };
+  | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission }
+  /** An `app_context_changed` (OPE-2457) — ours, and nothing to do. The subscription exists only so
+   *  Slack attaches the viewed room to each side-panel `message.im`; the change itself wakes nothing. */
+  | { readonly kind: "context-change"; readonly reason: string };
 
 /**
  * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
@@ -446,6 +458,13 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     if (open) return { kind: "home-open", reason: "app_home_opened (home tab) — publish the person's page", open };
     return { kind: "forward", reason: "app_home_opened for a tab other than home — nothing to publish" };
   }
+  if (eventType === "app_context_changed") {
+    // THE SIDE PANEL (OPE-2457). Slack fires this each time the person moves the panel to another
+    // room. The room that matters arrives on the `message.im` they then send (`app_context`), so a
+    // change alone wakes nothing — but it is acknowledged HERE rather than forwarded, because a
+    // forward costs eve a parse and a re-verify for every click the person makes in Slack.
+    return { kind: "context-change", reason: "app_context_changed — the room rides the next side-panel message; nothing to wake" };
+  }
   if (eventType === "user_change") {
     // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
     return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
@@ -618,6 +637,10 @@ export interface FrontOptions {
   readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
   readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
   readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+  /** OPE-2426 — the asked-thread exception for a bot-authored thread reply. Returns the relay to run (the
+   *  reply goes to the asker's DM, never to this channel's seat), or null to fall through to the ordinary
+   *  bot-author drop. Injected in tests; the live default is core's `admitAskedBotReply`. */
+  readonly admitBotReply?: (ev: ParsedMessageEvent, self: { readonly userId?: string; readonly botId?: string }) => Promise<{ readonly relay: () => Promise<unknown> } | null>;
   /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
    *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
   readonly recheckChannelCanvas?: (input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => Promise<unknown>;
@@ -667,6 +690,13 @@ export interface FrontOptions {
    *  governance DM-delivery arm. Defaults to the live call; FAIL-CLOSED: undefined ⇒ the shortcut
    *  wakes nothing and says so, never a wake in a guessed room. Injectable for tests. */
   readonly openDirectMessageChannel?: (userId: string) => Promise<string | undefined>;
+  /** The person opt-out read (OPE-2436): may the agent act on this person's content? Defaults to
+   *  core's `readPersonOptOut`, which is fail-CLOSED (an unreadable store reads as opted out).
+   *  Injectable for tests. */
+  readonly personOptOutFor?: (org: string, principalId: string) => Promise<PersonOptOutState>;
+  /** Tell one person, privately in their own DM, why a shortcut they pressed did nothing (OPE-2436).
+   *  Best-effort. Defaults to `conversations.open` + `chat.postMessage`. Injectable for tests. */
+  readonly postPrivateNotice?: (userId: string, text: string) => Promise<void>;
   /** The trigger author's two membership facts, from ONE `users.info` probe — the exact pair every
    *  wake route in slack-events.ts resolves. Two readers: the native `app_mention` forward's
    *  external-policy gate, which calls it only when that policy is not inert (so a deployment on the
@@ -1062,10 +1092,18 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const homeClicked = opts.handleHomeClick ?? ((click: ParsedHomeClick) => handleHomeClick(click, liveSlackHomeDeps()));
   const recheckCanvas = opts.recheckChannelCanvas ?? ((input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
   const homeSubmitted = opts.handleHomeSubmission ?? ((submission: ParsedHomeSubmission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
+  const admitBotReply = opts.admitBotReply ?? ((ev: ParsedMessageEvent, self: { readonly userId?: string; readonly botId?: string }) => admitAskedBotReply(slackBotReplyFacts(ev, deploymentOrg(), self), ev.authoredText));
   const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
   const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
   const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
   const openDirectMessageChannel = opts.openDirectMessageChannel ?? liveOpenDirectMessageChannel;
+  const personOptOutFor = opts.personOptOutFor ?? readPersonOptOut;
+  const postPrivateNotice =
+    opts.postPrivateNotice ??
+    (async (userId: string, text: string) => {
+      const dm = await openDirectMessageChannel(userId);
+      if (dm) await slackForm("chat.postMessage", new URLSearchParams({ channel: dm, text }).toString());
+    });
   const resolveDmSeat = opts.resolveDmSeat ?? ((org, dm, atIso) => liveGetOrCreateDmSeat(org, dm, atIso));
   const touchDmSeatFn = opts.touchDmSeatFn ?? liveTouchDmSeat;
   const dmPartnerTrustFor = opts.dmPartnerTrustFor ?? liveDmPartnerTrust;
@@ -1572,9 +1610,25 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // by design (the seat is one long-lived session over the whole DM, so replaying history a live
       // session already holds would duplicate it) — the tail is exactly the case that reasoning does
       // not cover, because a rotation is when the session stops holding it.
+      // THE SIDE PANEL (OPE-2457) AND THE PERSON OPT-OUT (OPE-2436) — two host facts for a 1:1 DM, in
+      // one trusted note. The viewed room passes every strictest-default gate first
+      // (slack-side-panel.ts); the opt-out tells the seat not to promise memory the write road will
+      // refuse anyway. A group DM states neither: it has no single person, and no panel.
+      const systemNote = isGroup
+        ? undefined
+        : slackDmSystemNote({
+            viewedRoom: await sidePanelViewedRoom({
+              room: ev.appContext,
+              teamId: ev.teamId,
+              partnerTrust,
+              channelInternal: async (id) => (await channelFactsFor(id)).internal === true,
+            }),
+            personOptOut: ev.userId ? await personOptOutFor(p.org, ev.userId) : undefined,
+          });
       const message = renderWakeMessage(ev, () => atIso, {
         dm: true,
         trust: wakeTrust,
+        ...(systemNote === undefined ? {} : { systemNote }),
         // The FENCE BACKSTOP for the whole DM family (OPE-1486) — the SAME refutation the taint stamp
         // and the policy gate read, so the three cannot disagree about one author. On a 1:1 it is a
         // no-op in practice (a refuted partner is already `unauth`, and `unauth` is already fenced);
@@ -1912,6 +1966,32 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // Keyed on the click, not the message — a person may invoke the same shortcut on the same
       // message twice on purpose, and only Slack's redelivery of ONE click is a duplicate.
       if (!(await notYetSeenKey(shortcutWakeKey(sc), sev))) return new Response(null, { status: 200 });
+      // 🔴 THE PERSON OPT-OUT (OPE-2436). A message shortcut hands the agent somebody's message to act
+      // on — summarise it, answer it, file it. When the message's AUTHOR opted out of agent actions on
+      // their content and somebody ELSE pressed the button, nothing wakes: one refusal row, and a
+      // private line to the person who pressed it. The author's own shortcut on their own message is
+      // their own request, so it wakes as before. The read is fail-closed (core `readPersonOptOut`).
+      const shortcutAuthor = sc.kind === "message" ? sc.message?.userId : undefined;
+      if (shortcutAuthor && shortcutAuthor !== sc.userId) {
+        const p = resolvePartition(bindableFor(sev));
+        const authorOptOut = await personOptOutFor(p.org, shortcutAuthor);
+        if (authorOptOut.optedOut) {
+          console.log(`[open-everywhere:slack-front] message shortcut "${sc.callbackId}" in ${shortcutChannelId}: refused — the message's author opted out`);
+          args.waitUntil(
+            Promise.allSettled([
+              auditPersonOptOutRefusal(
+                { org: p.org, platform: p.platform, workspace: p.workspace, surface: p.surface, principalKey: shortcutAuthor },
+                "message-shortcut",
+                { requestedBy: sc.userId, storeReadable: authorOptOut.readable },
+              ),
+              // An unreadable store is the fail-closed GUESS, never the author's decision, so the presser
+              // is not told the author asked for anything.
+              postPrivateNotice(sc.userId, authorOptOut.readable ? PERSON_OPT_OUT_SHORTCUT_NOTICE : PERSON_OPT_OUT_UNREADABLE_NOTICE),
+            ]),
+          );
+          return new Response(null, { status: 200 });
+        }
+      }
       // BOTH halves of the attachment registry, seeded ONLY on a click that reaches a DISPATCHER —
       // the in-memory one for this process's seat, the durable one for a delegated worker in
       // another. (A dispatcher can still refuse further down, as `routeSupervisorEvent`'s own
@@ -2319,6 +2399,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return OK();
     }
 
+    if (decision.kind === "context-change") return OK();
+
     if (decision.kind === "user-change") {
       // AUTOMATIC OFFBOARDING (OPE-2423). The signature above has authenticated the envelope, so its
       // `team_id` is the workspace that delivered this report. Every other decision — the
@@ -2416,9 +2498,30 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     if (!ev) return OK();
     persistAttachments(ev); // durable upload registry (task #107) — so a delegated worker can read this message's files
 
+    // 🔴 THE ASKED-THREAD EXCEPTION (OPE-2426): the only road by which another bot's message WAKES the
+    // agent on a real deployment. (An attributable bot's earlier post can still enter a woken seat's
+    // backscroll as context-only awareness: slack-wake-backscroll.ts `isBackscrollVisible`.) The other bot admissions are the test-bed e2e driver settings (OPE-1023):
+    // `wake.driverAllowlist` on the engagement and mention doors, channel messages included, and
+    // `wake.e2eDrivers` on the DM door and the seat's own reads. A real deployment leaves both empty. A bot's reply in a thread where the person's DM asked THAT bot, inside the window, is
+    // relayed to the person's DM and stops here: it never wakes this channel's seat, and the host posts
+    // nothing in the thread. Every other bot message — a top-level post, a thread nobody asked it in, a
+    // different bot, a late reply, an edit — gets null and falls through to the ordinary bot-author drop
+    // below, unchanged. It runs BEFORE mention suppression, so a reply that also @mentions the agent is
+    // still relayed. Its `app_mention` twin is dropped as a bot author further down: by
+    // `shouldSupervisorWake` on the single-window road, or by the native mention handler (slack.ts). The relay
+    // claims each message once, so a retried event relays nothing twice.
+    const identity = await getBotIdentity();
+    if (botReplyCandidate(ev)) {
+      const admitted = await admitBotReply(ev, identity).catch(() => null);
+      if (admitted) {
+        args.waitUntil(admitted.relay().then((route) => console.log(`[open-everywhere:slack-front] asked-thread bot reply ${ev.channelId}/${ev.threadTs}: relayed to the asker's DM (${String(route)})`)));
+        return OK();
+      }
+    }
+
     // Mention-sibling suppression — see {@link mentionSiblingSuppressed} for the whole rule and for
     // why an EDIT is exempt from it.
-    const { userId: botUserId } = await getBotIdentity();
+    const { userId: botUserId } = identity;
     if (mentionSiblingSuppressed({ authoredText: ev.authoredText, ...(ev.subtype === undefined ? {} : { subtype: ev.subtype }), ...(botUserId === undefined ? {} : { botUserId }) })) {
       return OK();
     }

package/agent/channels/slack-home.ts

@@ -1,5 +1,5 @@
 // THE SLACK APP HOME TAB (OPE-2451) — the person's own page: what the agent remembers about them,
-// what their domains know, and (OPE-2456, later) their rules. Core owns the page model
+// what their domains know, and their rules (OPE-2456). Core owns the page model
 // (`home/home-view.ts`); this module is the Slack half: it parses the three Slack deliveries the
 // page needs, builds the VERIFIED viewer, renders Block Kit, and drives the dialogs.
 //
@@ -36,6 +36,8 @@ import {
   runHomeAction,
   SLACK_HOME_WIRE,
   type BindableContext,
+  type Domain,
+  type DomainMembershipProbe,
   type HomeBlock,
   type HomeDomainMembership,
   type HomeViewer,
@@ -252,6 +254,8 @@ function homeActionModal(input: {
   readonly itemText: string;
   readonly title: string;
   readonly yes: string;
+  /** What the confirmation does, from the section that owns the action. */
+  readonly note?: string;
 }): Record<string, unknown> {
   const quoted = escapeSlackText(clip(input.itemText, 2800));
   return {
@@ -274,7 +278,7 @@ function homeActionModal(input: {
           ]
         : [
             { type: "section", text: { type: "mrkdwn", text: `> ${quoted}` } },
-            { type: "context", elements: [{ type: "mrkdwn", text: "I remove this line from your memory everywhere it is stored. You cannot undo it." }] },
+            { type: "context", elements: [{ type: "mrkdwn", text: escapeSlackText(input.note ?? "I remove this line from your memory everywhere it is stored. You cannot undo it.") }] },
           ],
   };
 }
@@ -348,8 +352,14 @@ export async function buildSlackHomeViewer(ids: ParsedHomeInteraction, deps: Sla
   };
 }
 
-/** The domains a person belongs to through an internal channel. Fail-soft: a failed page ends the walk. */
-async function slackDomainMemberships(userId: string, workspaceKey: string, deps: SlackHomeDeps): Promise<HomeDomainMembership[]> {
+/** The domains a person belongs to through an internal channel. Fail-soft: a failed page ends the walk.
+ *  The Home tab lists a domain only when it has memory to show (`keep`). */
+async function slackDomainMemberships(
+  userId: string,
+  workspaceKey: string,
+  deps: SlackHomeDeps,
+  keep: (domain: Domain) => boolean = (d) => d.memory !== undefined,
+): Promise<HomeDomainMembership[]> {
   const domains = getConfig().loadDomains();
   const byDomain = new Map<string, HomeDomainMembership>();
   let cursor: string | undefined;
@@ -367,7 +377,7 @@ async function slackDomainMemberships(userId: string, workspaceKey: string, deps
       if (!channelId) continue;
       const surfaceKey = `${workspaceKey}/${channelId}`;
       const domain = domainForChannel(surfaceKey, domains);
-      if (!domain || domain.memory === undefined) continue;
+      if (!domain || !keep(domain)) continue;
       if (!(await deps.channelInternal(channelId))) continue;
       const existing = byDomain.get(domain.name);
       const room = { surfaceKey, nativeId: channelId };
@@ -379,6 +389,30 @@ async function slackDomainMemberships(userId: string, workspaceKey: string, deps
   return [...byDomain.values()];
 }
 
+/**
+ * THE DM QUESTION'S MEMBERSHIP PROBE (OPE-2452), registered as Slack's `DomainMembershipProbe`. The SAME
+ * trust gate the Home tab applies, applied to the person who asks from their DM: a full member of the
+ * workspace (`users.info`, fail-closed), and only the domain channels Slack confirms internal
+ * (`conversations.info`, fail-closed). Unlike the Home tab it keeps a domain with no memory: a domain
+ * with no silo still has a seat that can answer.
+ */
+export function slackDomainMembershipProbe(deps: SlackHomeDeps = liveSlackHomeDeps()): DomainMembershipProbe {
+  return async ({ principalId, workspaceKey }) => {
+    try {
+      const [platform, teamId] = workspaceKey.split("/");
+      if (platform !== "slack" || !teamId || principalId.length === 0) return { fullMember: false, rooms: [] };
+      if ((await deps.authorIsMember(principalId, teamId)) !== true) return { fullMember: false, rooms: [] };
+      const memberships = await slackDomainMemberships(principalId, workspaceKey, deps, () => true);
+      return {
+        fullMember: true,
+        rooms: memberships.flatMap((m) => m.rooms.map((r) => ({ domain: m.domain.name, surfaceKey: r.surfaceKey, origin: { platform: "slack" as const, channelId: r.nativeId } }))),
+      };
+    } catch {
+      return { fullMember: false, rooms: [] };
+    }
+  };
+}
+
 // ── THE THREE HANDLERS ──────────────────────────────────────────────────────────────────────────
 
 /** The audit action every publish attempt writes. Declared in core's registry (operational). */
@@ -449,6 +483,7 @@ export async function handleHomeClick(click: ParsedHomeClick, deps: SlackHomeDep
       itemText: located.text,
       title: located.action.confirm?.title ?? `${located.action.label}`,
       yes: located.action.confirm?.yes ?? "Save",
+      ...(located.action.confirm?.note !== undefined ? { note: located.action.confirm.note } : {}),
     }),
   });
   return res?.ok === true;