@open-everywhere/provider-slack 0.6.0 → 0.7.0

package/agent/app-manifest.ts

@@ -150,7 +150,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             description: `${appName} control-plane commands (stop, status, budget) — no model turn.`,
             // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
             // scripts/slack-app-manifest-test.ts fails if one is missing here.
-            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | help",
+            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | watch [more | less | none] | help",
             should_escape: false,
           },
         ],

package/agent/channels/slack-bot-ask.ts

@@ -0,0 +1,101 @@
+// SLACK'S ARM OF CHIEF-OF-STAFF DELEGATION (OPE-2426) — the probe that proves an ask to another bot, and
+// the facts the front route hands core for an inbound bot message. Core holds the policy
+// (core/agent/channels/bot-ask.ts); this file only reads Slack.
+//
+// THE PROBE reads three facts with the BOT token, never a model string:
+//   1. the ask message itself (`conversations.replies` on its ts). The bot token reads it only when this
+//      app is in the channel, and the app must be in the channel to receive the other bot's reply at all.
+//      So an unreadable message is a refusal that says "invite the agent";
+//   2. its author is the person who asks, and its own text @mentions the named bot;
+//   3. the named account is a bot (`users.info` `is_bot`), and not this app itself (`auth.test`). An
+//      unknown own identity refuses: it cannot prove "not this app".
+// Any failed call refuses (`unreadable`). The probe never throws.
+
+import type { BotAskProbe, BotAskProbeAnswer, BotReplyFacts } from "@open-everywhere/core/agent/adapter-api.js";
+import { encodeSlackForm } from "./slack-web-api.js";
+import type { ParsedMessageEvent } from "./slack-events.js";
+
+/** The Slack calls the probe makes (injectable for the unit test). */
+export interface SlackBotAskDeps {
+  /** One Web API call with the bot token; resolves the parsed body, or undefined on a transport failure. */
+  readonly call: (method: string, body: Record<string, string>) => Promise<Record<string, unknown> | undefined>;
+  /** This app's own bot user id and bot id (`auth.test`), best-effort. */
+  readonly self: () => Promise<{ readonly userId?: string; readonly botId?: string }>;
+}
+
+type SlackMessage = { readonly ts?: unknown; readonly thread_ts?: unknown; readonly user?: unknown; readonly text?: unknown };
+
+/** Does the text @mention this user id (`<@U123>` or `<@U123|name>`)? PURE. */
+export function mentionsUser(text: string, userId: string): boolean {
+  return text.includes(`<@${userId}>`) || text.includes(`<@${userId}|`);
+}
+
+/** Build Slack's probe. */
+export function slackBotAskProbe(deps: SlackBotAskDeps): BotAskProbe {
+  return async (q): Promise<BotAskProbeAnswer> => {
+    try {
+      const [platform, teamId] = q.workspaceKey.split("/");
+      if (platform !== "slack" || !teamId) return { ok: false, reason: "unreadable" };
+      const replies = await deps.call("conversations.replies", { channel: q.channel, ts: q.messageTs, limit: "1", inclusive: "true" });
+      const messages = replies?.ok === true && Array.isArray(replies.messages) ? (replies.messages as SlackMessage[]) : [];
+      const msg = messages.find((m) => m.ts === q.messageTs);
+      if (!msg) return { ok: false, reason: "unreadable" };
+      if (msg.user !== q.personId) return { ok: false, reason: "not-yours" };
+      const text = typeof msg.text === "string" ? msg.text : "";
+      if (!mentionsUser(text, q.bot)) return { ok: false, reason: "bot-not-named" };
+      const self = await deps.self().catch(() => ({}) as { userId?: string; botId?: string });
+      // FAIL-CLOSED: without this app's own user id, a mention of this app cannot be told from another bot's.
+      if (self.userId === undefined) return { ok: false, reason: "unreadable" };
+      if (self.userId === q.bot) return { ok: false, reason: "self" };
+      const info = await deps.call("users.info", { user: q.bot });
+      const user = info?.ok === true && info.user && typeof info.user === "object" ? (info.user as Record<string, unknown>) : undefined;
+      if (!user) return { ok: false, reason: "unreadable" };
+      if (user.is_bot !== true) return { ok: false, reason: "not-a-bot" };
+      const profile = user.profile && typeof user.profile === "object" ? (user.profile as Record<string, unknown>) : {};
+      const botId = typeof profile.bot_id === "string" && profile.bot_id.length > 0 ? profile.bot_id : undefined;
+      if (botId !== undefined && self.botId !== undefined && botId === self.botId) return { ok: false, reason: "self" };
+      const label = [user.real_name, profile.display_name, user.name].find((v) => typeof v === "string" && v.trim().length > 0) as string | undefined;
+      return {
+        ok: true,
+        threadTs: typeof msg.thread_ts === "string" && msg.thread_ts.length > 0 ? msg.thread_ts : q.messageTs,
+        botUserId: q.bot,
+        ...(botId === undefined ? {} : { botId }),
+        ...(label === undefined ? {} : { botLabel: label }),
+        askText: text,
+      };
+    } catch {
+      return { ok: false, reason: "unreadable" };
+    }
+  };
+}
+
+/** The live deps: `slackForm` with the bot token, and the front route's cached `auth.test`. */
+export function liveSlackBotAskDeps(
+  form: (method: string, body: string) => Promise<Record<string, unknown> | undefined>,
+  self: () => Promise<{ readonly userId?: string; readonly botId?: string }>,
+): SlackBotAskDeps {
+  return { call: (method, body) => form(method, encodeSlackForm(body)), self };
+}
+
+/** Is this parsed message a candidate for the asked-thread exception at all? A cheap, pure pre-filter, so a
+ *  human message never pays a store read. PURE. */
+export function botReplyCandidate(ev: ParsedMessageEvent): boolean {
+  return (Boolean(ev.botId) || ev.subtype === "bot_message") && ev.threadTs !== undefined && ev.threadTs !== ev.ts;
+}
+
+/** Core's facts for one parsed Slack message. PURE. */
+export function slackBotReplyFacts(ev: ParsedMessageEvent, org: string, self: { readonly userId?: string; readonly botId?: string }): BotReplyFacts {
+  return {
+    org,
+    platform: "slack",
+    workspace: ev.teamId,
+    channel: ev.channelId,
+    threadTs: ev.threadTs,
+    messageTs: ev.ts,
+    authorUserId: ev.userId,
+    authorBotId: ev.botId,
+    subtype: ev.subtype,
+    ...(self.userId === undefined ? {} : { selfUserId: self.userId }),
+    ...(self.botId === undefined ? {} : { selfBotId: self.botId }),
+  };
+}

package/agent/channels/slack-commands.ts

@@ -36,6 +36,7 @@ import { defineChannel, POST } from "eve/channels";
 import { verifySlackSignature } from "./slack-front.js";
 import { slackSigningSecret } from "../setup/credentials.js";
 import {
+  commandFailureText,
   bindFrom,
   runOeCommand,
   oeSlash,
@@ -223,12 +224,12 @@ export default defineChannel({
         const reply = await runOeCommand(cmd, binding, { attachSession });
         return ephemeralResponse(reply);
       } catch (err) {
-        // runOeCommand's budget-raise/clear branches can throw a user-facing validation error
-        // (e.g. proposing from a DM with no explicit scope) — surface it verbatim. Never let a
-        // thrown error escape as a 500; Slack's slash-command UX for that is an ugly
-        // "operation_timeout"/dispatch_failed toast.
+        // A PersonFacingError is already worded for the person — it renders as-is. Anything else
+        // (a store or network failure, a planner's model-facing refusal) renders the generic line,
+        // and its message goes to the log only (OPE-2486). Never let a thrown error escape as a
+        // 500; Slack's slash-command UX for that is an ugly "operation_timeout"/dispatch_failed toast.
         log(`"${expected}" command failed softly: ${String(err)}`);
-        return ephemeralResponse(`Couldn't complete that: ${err instanceof Error ? err.message : String(err)}`);
+        return ephemeralResponse(commandFailureText(err));
       }
     }),
   ],

package/agent/channels/slack-events.ts

@@ -3552,17 +3552,20 @@ async function fetchChannelTranscript(channelId: string): Promise<string | undef
 // `handle` = the person's SELF-SET display name (Tag treats the handle as the better human-address
 // signal). Both are UNTRUSTED, attacker-controllable profile content — the wake renderer XML-escapes
 // them wherever they land in the envelope frame.
-const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string } | undefined>>();
-export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string } | undefined> {
+const userProfileCache = new Map<string, Promise<{ name?: string; handle?: string; email?: string } | undefined>>();
+export function fetchUserProfileNames(userId: string): Promise<{ name?: string; handle?: string; email?: string } | undefined> {
   let p = userProfileCache.get(userId);
   if (!p) {
     p = (async () => {
       const info = await slackForm("users.info", `user=${encodeURIComponent(userId)}`);
       if (info?.ok !== true) return undefined;
-      const user = info.user as { profile?: { display_name?: string; real_name?: string }; real_name?: string; name?: string } | undefined;
+      const user = info.user as { profile?: { display_name?: string; real_name?: string; email?: string }; real_name?: string; name?: string } | undefined;
       const handle = user?.profile?.display_name?.trim() || undefined;
       const name = user?.profile?.real_name?.trim() || user?.real_name?.trim() || user?.name?.trim() || undefined;
-      return { name, handle };
+      // The workspace-verified address, present only under the `users:read.email` scope (OPE-2482): the
+      // identifier a person can check beside a self-set name.
+      const email = user?.profile?.email?.trim() || undefined;
+      return { name, handle, ...(email ? { email } : {}) };
     })();
     userProfileCache.set(userId, p);
   }

package/agent/channels/slack-friendly-names.ts

@@ -0,0 +1,55 @@
+// slack-friendly-names — the Slack name resolver for the friendly-names guard (OPE-2482).
+//
+// The guard (core `channels/friendly-outbound.ts`) asks this resolver for a display name before it
+// renders a raw Slack id in text a person reads. A member id answers the person's display name, a
+// channel id answers `#name`, and the workspace id answers the install's recorded team name. Every
+// lookup rides a cache that already exists (`users.info`, `conversations.info`), so a name costs one
+// Slack call per id per instance. Any failure answers undefined: the id then renders as a mention or
+// plain words, never as itself.
+
+import type { FriendlyNameResolver } from "@open-everywhere/core/agent/adapter-api.js";
+import { fetchChannelDisplayName, fetchUserDisplayName } from "./slack-events.js";
+import { slackInstallState } from "../setup/install-state.js";
+
+/** The lookups the resolver uses. Live code passes none; a test injects each. */
+export interface SlackFriendlyNameDeps {
+  readonly userName?: (id: string) => Promise<string | undefined>;
+  readonly channelName?: (id: string) => Promise<string | undefined>;
+  readonly teamName?: (id: string) => Promise<string | undefined>;
+}
+
+// The install record is read at most once per TEAM_NAME_TTL_MS, and only a FOUND name is kept: a post
+// path must not read the store per message, and a deployment that installs (or renames its workspace)
+// after boot must still be named without a restart.
+const TEAM_NAME_TTL_MS = 30 * 60_000;
+let teamNameMemo: { readonly teamId: string; readonly name: string; readonly at: number } | undefined;
+
+/** The workspace name, when the recorded install is that workspace. */
+async function liveTeamName(id: string): Promise<string | undefined> {
+  if (teamNameMemo && teamNameMemo.teamId === id && Date.now() - teamNameMemo.at < TEAM_NAME_TTL_MS) return teamNameMemo.name;
+  const install = await slackInstallState().catch(() => undefined);
+  if (install?.teamId === id && install.teamName) {
+    teamNameMemo = { teamId: id, name: install.teamName, at: Date.now() };
+    return install.teamName;
+  }
+  return undefined;
+}
+
+/** Build the Slack resolver. */
+export function slackFriendlyNameResolver(deps: SlackFriendlyNameDeps = {}): FriendlyNameResolver {
+  return async (id) => {
+    if (/^[UW]/.test(id)) {
+      const name = await (deps.userName ?? fetchUserDisplayName)(id);
+      return name ? { label: name, kind: "person" } : undefined;
+    }
+    if (/^[CG]/.test(id)) {
+      const name = await (deps.channelName ?? fetchChannelDisplayName)(id);
+      return name ? { label: `#${name.replace(/^#/, "")}`, kind: "channel" } : undefined;
+    }
+    if (/^T/.test(id)) {
+      const name = await (deps.teamName ?? liveTeamName)(id);
+      return name ? { label: name, kind: "server" } : undefined;
+    }
+    return undefined;
+  };
+}

package/agent/channels/slack-front.ts

@@ -125,7 +125,10 @@ import {
   PERSON_OPT_OUT_SHORTCUT_NOTICE,
   PERSON_OPT_OUT_UNREADABLE_NOTICE,
   type PersonOptOutState,
+  admitAskedBotReply,
+  deploymentOrg,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { botReplyCandidate, slackBotReplyFacts } from "./slack-bot-ask.js";
 import { sidePanelViewedRoom, slackDmSystemNote } from "./slack-side-panel.js";
 import {
   renderWakeMessage,
@@ -634,6 +637,10 @@ export interface FrontOptions {
   readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
   readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
   readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+  /** OPE-2426 — the asked-thread exception for a bot-authored thread reply. Returns the relay to run (the
+   *  reply goes to the asker's DM, never to this channel's seat), or null to fall through to the ordinary
+   *  bot-author drop. Injected in tests; the live default is core's `admitAskedBotReply`. */
+  readonly admitBotReply?: (ev: ParsedMessageEvent, self: { readonly userId?: string; readonly botId?: string }) => Promise<{ readonly relay: () => Promise<unknown> } | null>;
   /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
    *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
   readonly recheckChannelCanvas?: (input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => Promise<unknown>;
@@ -1085,6 +1092,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   const homeClicked = opts.handleHomeClick ?? ((click: ParsedHomeClick) => handleHomeClick(click, liveSlackHomeDeps()));
   const recheckCanvas = opts.recheckChannelCanvas ?? ((input: { org: string; teamId: string; channelId: string; trigger: "member-joined" | "channel-shared"; joinedUserId?: string }) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
   const homeSubmitted = opts.handleHomeSubmission ?? ((submission: ParsedHomeSubmission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
+  const admitBotReply = opts.admitBotReply ?? ((ev: ParsedMessageEvent, self: { readonly userId?: string; readonly botId?: string }) => admitAskedBotReply(slackBotReplyFacts(ev, deploymentOrg(), self), ev.authoredText));
   const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey: string) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
   const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
   const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
@@ -2490,9 +2498,30 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     if (!ev) return OK();
     persistAttachments(ev); // durable upload registry (task #107) — so a delegated worker can read this message's files
 
+    // 🔴 THE ASKED-THREAD EXCEPTION (OPE-2426): the only road by which another bot's message WAKES the
+    // agent on a real deployment. (An attributable bot's earlier post can still enter a woken seat's
+    // backscroll as context-only awareness: slack-wake-backscroll.ts `isBackscrollVisible`.) The other bot admissions are the test-bed e2e driver settings (OPE-1023):
+    // `wake.driverAllowlist` on the engagement and mention doors, channel messages included, and
+    // `wake.e2eDrivers` on the DM door and the seat's own reads. A real deployment leaves both empty. A bot's reply in a thread where the person's DM asked THAT bot, inside the window, is
+    // relayed to the person's DM and stops here: it never wakes this channel's seat, and the host posts
+    // nothing in the thread. Every other bot message — a top-level post, a thread nobody asked it in, a
+    // different bot, a late reply, an edit — gets null and falls through to the ordinary bot-author drop
+    // below, unchanged. It runs BEFORE mention suppression, so a reply that also @mentions the agent is
+    // still relayed. Its `app_mention` twin is dropped as a bot author further down: by
+    // `shouldSupervisorWake` on the single-window road, or by the native mention handler (slack.ts). The relay
+    // claims each message once, so a retried event relays nothing twice.
+    const identity = await getBotIdentity();
+    if (botReplyCandidate(ev)) {
+      const admitted = await admitBotReply(ev, identity).catch(() => null);
+      if (admitted) {
+        args.waitUntil(admitted.relay().then((route) => console.log(`[open-everywhere:slack-front] asked-thread bot reply ${ev.channelId}/${ev.threadTs}: relayed to the asker's DM (${String(route)})`)));
+        return OK();
+      }
+    }
+
     // Mention-sibling suppression — see {@link mentionSiblingSuppressed} for the whole rule and for
     // why an EDIT is exempt from it.
-    const { userId: botUserId } = await getBotIdentity();
+    const { userId: botUserId } = identity;
     if (mentionSiblingSuppressed({ authoredText: ev.authoredText, ...(ev.subtype === undefined ? {} : { subtype: ev.subtype }), ...(botUserId === undefined ? {} : { botUserId }) })) {
       return OK();
     }

package/agent/channels/slack-memory-canvas.ts

@@ -40,6 +40,7 @@ import {
   domainsNamingSilo,
   getConfig,
   readDomainMemory,
+  memoryLineForReader,
   renderMemoryMarkdown,
   type Domain,
   type MemoryWriteEvent,
@@ -111,9 +112,10 @@ function memoryCanvasMarkdown(domain: Domain, groups: Parameters<typeof renderMe
   const name = agentDisplayName();
   const body = renderMemoryMarkdown(`What ${name} knows — ${domain.title ?? domain.name}`, groups, nowIso);
   const footer =
-    `\n---\n${name} keeps this canvas up to date from this domain's memory. ` +
-    `To correct or forget a line, ask ${name} in this channel. A direct edit to this canvas is replaced on the next memory change.\n`;
-  const text = defuseCanvasText(body);
+    `\n---\n${name} keeps this canvas up to date. To correct or forget a line, ask ${name} in this channel. ` +
+    `Edits made directly to this canvas get replaced.\n`;
+  // OPE-2486 — the memory provenance carriers read as plain words on a canvas a whole channel reads.
+  const text = defuseCanvasText(memoryLineForReader(body));
   const cut = text.length > CANVAS_MARKDOWN_MAX ? text.slice(0, CANVAS_MARKDOWN_MAX) + "\n\n_This canvas is full. Ask in this channel for the rest._\n" : text;
   return cut + footer;
 }
@@ -181,8 +183,8 @@ function withdrawnCanvasMarkdown(): string {
   const name = agentDisplayName();
   return (
     `# ${name}'s memory canvas was withdrawn\n\n` +
-    `This channel is shared outside the workspace, or one of its members is not a full member, so ${name} no longer shows a domain's memory here. ` +
-    `The memory itself is unchanged. Members can still ask ${name} about it where the domain's memory is readable.\n`
+    `This channel includes guests or people from outside your organisation, so ${name} no longer shows its memory here. ` +
+    `The memory itself is unchanged. Members can still ask ${name} about it in an internal channel.\n`
   );
 }
 

package/agent/channels/slack-web-api.ts

@@ -40,7 +40,7 @@
 // `channels/rate-limit-retry.js`. When the attempts run out the call throws `RateLimitExhaustedError`
 // — a NAMED failure. Non-429 responses are untouched.
 
-import { withRetryAfter, type RateLimitRetryOptions } from "@open-everywhere/core/agent/adapter-api.js";
+import { friendlySlackBody, withRetryAfter, type RateLimitRetryOptions } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackBotToken } from "../setup/credentials.js";
 
 /** Slack's Web API base. A trailing slash is required — `new URL(operation, base)` resolves the
@@ -172,7 +172,9 @@ export async function callSlackWebApi(
   // still throws when no token resolves, so no ordinary call can silently lose its authorization
   // header by forgetting to pass one.
   const token = input.unauthenticated === true ? undefined : await resolveBotToken(input.botToken);
-  const encoded = encodeSlackForm(input.body);
+  // THE FRIENDLY-NAMES GUARD (OPE-2482). A message method's text, blocks and attachments render every raw
+  // id as a mention, a name or plain words before the body is encoded. Every other method is unchanged.
+  const encoded = encodeSlackForm(await friendlySlackBody(input.operation, input.body));
   const url = new URL(input.operation, deps.apiBase ?? SLACK_API_BASE).toString();
   const send = (): Promise<Response> =>
     (deps.fetch ?? (globalThis.fetch as SlackFetchLike))(url, {

package/agent/channels/slack.ts

@@ -90,7 +90,7 @@ import {
   swallowRoomOp,
   domainRoster,
 } from "@open-everywhere/core/agent/adapter-api.js";
-import { withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
+import { TURN_FAILED_TEXT, withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
 import { loadConversationContext } from "./slack-context.js";
 import { slackSpendGate } from "./slack-spend-gate.js";
 import { slackTenantAdmission } from "./slack-tenant-fence.js";
@@ -1302,10 +1302,10 @@ const slackMentionChannel = slackChannel({
           }
           await setStatusReaction(channel.slack, "blocked", dmWakeThreadOverride(channel.state));
           try {
-            await postWakeText(
-              channel,
-              `:octagonal_sign: I hit an error while handling your request (${data.message}). Please try again or rephrase.`,
-            );
+            // OPE-2486 — the raw error text never reaches the room: the log line below carries it
+            // for an operator, and the person reads one plain line.
+            console.warn(`[open-everywhere:slack] turn failed: ${data.message}`);
+            await postWakeText(channel, `:octagonal_sign: ${TURN_FAILED_TEXT}`);
           } catch {
             /* best-effort */
           }
@@ -1319,7 +1319,8 @@ const slackMentionChannel = slackChannel({
           }
           await setStatusReaction(channel.slack, "blocked", dmWakeThreadOverride(channel.state));
           try {
-            await postWakeText(channel, `:octagonal_sign: Task failed: ${data.message}`);
+            console.warn(`[open-everywhere:slack] session failed: ${data.message}`);
+            await postWakeText(channel, `:octagonal_sign: ${TURN_FAILED_TEXT}`);
           } catch {
             /* best-effort */
           }