@open-everywhere/provider-slack 0.7.0 → 0.8.0

package/agent/access/slack-attachment-fetch.ts

@@ -42,6 +42,7 @@ import {
   type EgressRefusalCause,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackBotToken } from "../setup/credentials.js";
+import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 // THE CREDENTIAL'S IDENTITY, FOR THE AUDIT ROW (OPE-1547) — the ref NAME, never the value. This is
 // the one host-side seam that attaches a credential, so before this ticket it was the one place
@@ -140,7 +141,7 @@ export async function fetchSlackAttachment(ctx: BindableContext, ref: TrustedSla
   // referenced here; the row carries the ref name only, which is the identity an operator looks up.
   // `route` is the dispatch route — it was called `via` until OPE-1547, the same field name the
   // SANDBOX plane used for the stamping connection.
-  const row = (outcome: "allowed" | "failed", extra: Record<string, unknown> = {}): Record<string, unknown> => ({
+  const row = (outcome: "allowed" | "failed", extra: AuditDetail = {}): AuditDetail => ({
     ...hostCallAuditFields({
       host: safe.url.hostname,
       verb: ATTACHMENT_VERB,

package/agent/app-manifest.ts

@@ -150,7 +150,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             description: `${appName} control-plane commands (stop, status, budget) — no model turn.`,
             // Every subcommand `parseOeCommandTokens` accepts (packages/core/agent/commands/core.ts).
             // scripts/slack-app-manifest-test.ts fails if one is missing here.
-            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | watch [more | less | none] | help",
+            usage_hint: "stop | status | budget [raise <usd> | clear] | rate <n> | optout [on | off] | watch [more | less | none] | cover [on | off] | suggest [on | off] | help",
             should_escape: false,
           },
         ],
@@ -243,6 +243,17 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             // knows. Without it the canvas refresh fails with `missing_scope`, logged and audited
             // per channel, and memory itself is unaffected.
             "canvases:write",
+            // canvases.sections.lookup — find a memory canvas made before the `memory_canvas` row
+            // existed, by the marker line it carries (OPE-2587, core channels/slack-canvas-list.ts
+            // `memoryCanvasAmong`). Without it such a canvas held only as a channel tab is not found:
+            // its refresh and take-down record `failed` and `clear-failed`, and nothing is overwritten.
+            "canvases:read",
+            // slackLists.items.list / .create / .update — the agent's own List writes (OPE-2521,
+            // core tools/update_list.ts): it reads a List's rows to match one by name, then adds or
+            // changes rows on a person's approval. `canvases:write` above also covers the agent's own
+            // canvas writes (canvases.create, canvases.edit; core tools/write_canvas.ts).
+            "lists:read",
+            "lists:write",
             // The side panel (OPE-2457): Slack requires it for `app_context_changed`, the event whose
             // subscription makes Slack attach the viewed room to each side-panel `message.im`.
             "assistant:write",
@@ -271,6 +282,8 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
           //   channel_shared → channels:read, groups:read (re-run the memory canvas gate, OPE-2451)
           //   user_change → users:read (automatic offboarding on a deactivated member, OPE-2423)
           //   app_context_changed → assistant:write (the side panel's viewed room, OPE-2457)
+          //   agent_session_stopped → chat:write (Slack's native Stop button on an agent session,
+          //     OPE-2519; Slack shows the button only to an app subscribed to it)
           // scripts/slack-app-manifest-test.ts derives the handled set from the code and fails if
           // this list drops one (OPE-2223).
           bot_events: [
@@ -286,6 +299,7 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "channel_shared",
             "user_change",
             "app_context_changed",
+            "agent_session_stopped",
           ],
         },
         // The INTERACTIVITY Request URL — the SAME public route Event Subscriptions uses. Every

package/agent/channels/slack-agent-session.ts

@@ -0,0 +1,249 @@
+// THE SLACK AGENT SESSION (OPE-2519) — Slack's native Stop, the session title, and the "needs you" state.
+//
+// Slack's agent experience shows each conversation with the app as an AGENT SESSION, keyed by the
+// channel and the thread root (docs.slack.dev/ai/agent-sessions, re-read 2026-10-14). A session has a
+// lifecycle status (`processing`, `active`, `suspended`, `closed`) and a title. This file owns the three
+// things OE does with it:
+//
+//   • STOP. While a session is `processing`, Slack shows a Stop button, but only to an app that
+//     subscribes to `agent_session_stopped`. A press arrives as that event. It takes the SAME cancel
+//     path as the ✋ reaction and `/oe stop` (`cancelAnchoredTurn`): no session is minted, no model is
+//     called, nothing is spent. Slack does not move the status itself, so the route sets `active`.
+//   • TITLE. A top-level message the person sends in their DM with the app opens a new conversation,
+//     and gets a short title from the words the person TYPED (`authoredText`). The lines of a
+//     forwarded or quoted message are another conversation's words, so they never title it. The host
+//     derives the title in code: no model writes it. Slack applies a `title` only when the call
+//     CREATES the session, so a title the person typed over ours is never overwritten. A thread reply,
+//     a shortcut and a group DM get no title.
+//   • STATE. Core's turn-anchor hook sets the session `processing` when a turn starts, and at the park
+//     `suspended` when the turn reported through `update_status` that it waits on a person
+//     (`needs_input` or `blocked`), else `active` (channels/surface-session-state.ts). This file
+//     registers the Slack setter: it names the session from the delivery's auth attributes. The
+//     person's next message sets `processing`, then parks `active` unless it reports again that it
+//     waits on the person. A job's result wake names no session, so its turn sets no state.
+//   • A FORWARDED JOB's WAIT (OPE-2536). A job the DM seat forwards to the work session can end waiting
+//     on the person: it asked a question in the room (`ask_room`), or it needs their own sign-in. The
+//     work session has no `update_status`, so the host sets the session `suspended` at the job's
+//     settlement (core channels/work-surface-wait.ts). This file registers the PIN for that: the
+//     session's id and the three attributes that name it again, kept on the job.
+//
+// WHICH SESSIONS. Only the person's 1:1 DM with the app (the Messages tab and the side panel), where
+// Slack lists the person's agent sessions. The DM door stamps the session's thread root on the wake's
+// auth (`agent_session_ts`): a top-level message opens its own session, keyed by its own `ts`, and a
+// thread reply belongs to its thread's session. A channel thread gets no state from OE.
+//
+// Every call here is best-effort. A workspace without Slack's agent features answers an error, which
+// is logged and changes nothing else.
+
+import {
+  cancelAnchoredTurn,
+  resolvePartition,
+  turnAnchorKey,
+  turnChannelKey,
+  type AttachSessionForCancel,
+  type CancelResult,
+  type SurfaceSessionPinner,
+  type SurfaceSessionSetter,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { bindableForSlackIds, slackForm, type SlackEventEnvelope } from "./slack-events.js";
+
+/** Slack's event for a press of the session's Stop button. */
+export const AGENT_SESSION_STOPPED_EVENT = "agent_session_stopped";
+
+/** The longest title OE sets. Slack accepts 200 characters; a session list shows far fewer. */
+export const SLACK_SESSION_TITLE_MAX = 60;
+
+/** The session states OE sets. */
+export type SlackSessionStatus = "processing" | "active" | "suspended";
+
+/** The auth attribute the DM door stamps with the session's thread root (slack-front.ts `scheduleDmWake`). */
+const AGENT_SESSION_TS_ATTRIBUTE = "agent_session_ts";
+
+/** The form-call seam: `slackForm` in production, a recorder in the tests. */
+export type SlackFormCall = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
+
+// --- the title ------------------------------------------------------------------------------------
+
+/** Slack's three escaped characters, decoded. */
+function decodeSlackEntities(text: string): string {
+  return text.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+
+/**
+ * The session title for a conversation that opens with `text`, or undefined when nothing readable is
+ * left. Pure. It keeps the first non-empty line, renders a link as its label, a channel as `#name`, and
+ * drops a member or group mention (no raw id reaches the title). It strips `*`, `~` and backticks, and
+ * keeps `_`, so an identifier such as `oe_config` stays intact. A long line is cut at a word and ends
+ * with `…`.
+ */
+export function slackSessionTitle(text: string | undefined): string | undefined {
+  if (typeof text !== "string") return undefined;
+  const rendered = text
+    // A member mention, with or without a label: dropped.
+    .replace(/<@[A-Z0-9]+(?:\|[^>]*)?>/g, " ")
+    // A channel mention: its name when Slack sent one, else dropped.
+    .replace(/<#[A-Z0-9]+\|([^>]+)>/g, "#$1")
+    .replace(/<#[A-Z0-9]+>/g, " ")
+    // A special or group mention (`<!here>`, `<!subteam^S1|@team>`): dropped.
+    .replace(/<![^>]*>/g, " ")
+    // A link: its label, else the address.
+    .replace(/<[^>|]+\|([^>]+)>/g, "$1")
+    .replace(/<([^>]+)>/g, "$1");
+  const line = decodeSlackEntities(rendered)
+    .split(/\r?\n/)
+    .map((l) => l.replace(/[*~`]+/g, "").replace(/\s+/g, " ").trim())
+    .find((l) => l.length > 0);
+  if (line === undefined) return undefined;
+  if (line.length <= SLACK_SESSION_TITLE_MAX) return line;
+  const head = line.slice(0, SLACK_SESSION_TITLE_MAX - 1);
+  const cut = head.lastIndexOf(" ");
+  return `${(cut >= SLACK_SESSION_TITLE_MAX / 2 ? head.slice(0, cut) : head).trimEnd()}…`;
+}
+
+// --- the status call -------------------------------------------------------------------------------
+
+/** One `agents.sessions.setStatus` call. */
+export interface SlackSessionStatusCall {
+  readonly channelId: string;
+  /** The session's thread root. */
+  readonly threadTs: string;
+  readonly status: SlackSessionStatus;
+  /** Applied only when this call creates the session. */
+  readonly title?: string;
+}
+
+/** The form body of {@link SlackSessionStatusCall}. Pure. */
+export function slackSessionStatusForm(call: SlackSessionStatusCall): string {
+  const body = new URLSearchParams({ channel_id: call.channelId, thread_ts: call.threadTs, status: call.status });
+  if (call.title !== undefined && call.title.length > 0) body.set("title", call.title);
+  return body.toString();
+}
+
+/** Set a session's status (and, on creation, its title). True when Slack answered `ok`. Never throws. */
+export async function setSlackSessionStatus(call: SlackSessionStatusCall, form: SlackFormCall = slackForm): Promise<boolean> {
+  try {
+    const res = await form("agents.sessions.setStatus", slackSessionStatusForm(call));
+    if (res?.ok === true) return true;
+    console.warn(`[open-everywhere:slack-session] agents.sessions.setStatus ${call.status} was not applied (${call.channelId}/${call.threadTs}): ${String(res?.error ?? "no answer")}`);
+    return false;
+  } catch (err) {
+    console.warn(`[open-everywhere:slack-session] agents.sessions.setStatus ${call.status} failed (${call.channelId}/${call.threadTs}): ${String(err)}`);
+    return false;
+  }
+}
+
+/**
+ * The session a delivery's auth attributes name, or undefined for none. Only a delivery the DM door
+ * stamped (`agent_session_ts`) names one: a shortcut, a group DM and every channel carry no stamp, so
+ * they never set a session's state, even on a threaded message. Pure.
+ */
+export function slackAgentSessionOf(attributes: Readonly<Record<string, unknown>>): { readonly channelId: string; readonly threadTs: string } | undefined {
+  if (attributes.channel_type !== "im") return undefined;
+  const channelId = attributes.channel_id;
+  const stamped = attributes[AGENT_SESSION_TS_ATTRIBUTE];
+  if (typeof channelId !== "string" || channelId.length === 0 || typeof stamped !== "string" || stamped.length === 0) return undefined;
+  return { channelId, threadTs: stamped };
+}
+
+/**
+ * The Slack pinner (OPE-2536): the session a delivery names, as the setter's own id and the three
+ * attributes that name it again. A forwarded job keeps this, so its settlement can set the session
+ * `suspended` long after the delivery's auth is gone. Ids only, never text. Pure.
+ */
+export const slackSurfaceSessionPin: SurfaceSessionPinner = (attributes) => {
+  const session = slackAgentSessionOf(attributes);
+  if (!session) return undefined;
+  return {
+    id: `${session.channelId}:${session.threadTs}`,
+    attributes: { channel_id: session.channelId, channel_type: "im", [AGENT_SESSION_TS_ATTRIBUTE]: session.threadTs },
+  };
+};
+
+/** The Slack setter core's turn-anchor hook calls (registered in register.ts). */
+export function slackSurfaceSessionSetter(form: SlackFormCall = slackForm): SurfaceSessionSetter {
+  return async (attributes, status) => {
+    const session = slackAgentSessionOf(attributes);
+    if (!session) return undefined;
+    await setSlackSessionStatus({ ...session, status }, form);
+    return `${session.channelId}:${session.threadTs}`;
+  };
+}
+
+// --- the Stop button -------------------------------------------------------------------------------
+
+/** One press of the Stop button, as the route reads it. */
+export interface ParsedSessionStop {
+  readonly channelId: string;
+  /** The session's thread root. */
+  readonly threadTs: string;
+  /** Who pressed Stop. */
+  readonly userId: string;
+  /** From the `event_callback` envelope: Slack does not put it in the event. */
+  readonly teamId?: string;
+  readonly eventTs?: string;
+}
+
+/** Parse an `agent_session_stopped` envelope, or null for anything else. Pure. */
+export function parseAgentSessionStopped(envelope: SlackEventEnvelope): ParsedSessionStop | null {
+  if (envelope?.type !== "event_callback") return null;
+  const e = envelope.event as Record<string, unknown> | undefined;
+  if (!e || e.type !== AGENT_SESSION_STOPPED_EVENT) return null;
+  const channelId = typeof e.channel === "string" ? e.channel : "";
+  const threadTs = typeof e.thread_ts === "string" ? e.thread_ts : "";
+  const userId = typeof e.user === "string" ? e.user : "";
+  if (!channelId || !threadTs || !userId) return null;
+  const teamId = typeof envelope.team_id === "string" && envelope.team_id.length > 0 ? envelope.team_id : undefined;
+  return {
+    channelId,
+    threadTs,
+    userId,
+    ...(teamId ? { teamId } : {}),
+    ...(typeof e.event_ts === "string" ? { eventTs: e.event_ts } : {}),
+  };
+}
+
+/** A 1:1 DM channel id. Only there does the stop fall back to the channel's newest turn. */
+function isDmChannel(channelId: string): boolean {
+  return channelId.startsWith("D");
+}
+
+/** What the Stop route needs. */
+export interface SessionStopDeps {
+  /** eve's I/O-free cancel door, the same one the ✋ arm uses. */
+  readonly attachSession: AttachSessionForCancel;
+  /** The cancel path. Absent means the live `cancelAnchoredTurn`. */
+  readonly cancel?: typeof cancelAnchoredTurn;
+  /** The status call. Absent means the live {@link setSlackSessionStatus}. */
+  readonly setStatus?: (call: SlackSessionStatusCall) => Promise<boolean>;
+}
+
+/**
+ * Stop the turn a Stop press names, then set the session `active`.
+ *
+ * The turn is found by the session's thread first (the key the ✋ arm uses for a thread root). In the
+ * person's 1:1 DM it falls back to the DM's newest turn, because a top-level DM message keys its turn by
+ * the channel alone. In a shared channel it does not fall back: there the newest turn can belong to
+ * another thread, and cancelling nothing beats cancelling a guess. The status is set whatever the
+ * cancel answers, because a session left `processing` keeps its spinner for an hour. Never throws.
+ */
+export async function routeAgentSessionStop(ev: ParsedSessionStop, deps: SessionStopDeps): Promise<CancelResult> {
+  const p = resolvePartition(bindableForSlackIds({ teamId: ev.teamId, channelId: ev.channelId, userId: ev.userId }));
+  const anchorKey = turnAnchorKey("slack", ev.channelId, ev.threadTs);
+  const channelKey = isDmChannel(ev.channelId) ? turnChannelKey("slack", ev.channelId) : undefined;
+  let result: CancelResult;
+  try {
+    result = await (deps.cancel ?? cancelAnchoredTurn)({
+      org: p.org,
+      platform: "slack",
+      workspace: p.workspace,
+      requestedBy: ev.userId,
+      via: "stop-button",
+      query: { ...(anchorKey ? { anchorKey } : {}), ...(channelKey ? { channelKey } : {}) },
+      attachSession: deps.attachSession,
+    });
+  } catch (err) {
+    result = { outcome: "error", message: `stop failed: ${String(err)}` };
+  }
+  await (deps.setStatus ?? setSlackSessionStatus)({ channelId: ev.channelId, threadTs: ev.threadTs, status: "active" }).catch(() => false);
+  return result;
+}

package/agent/channels/slack-attachments.ts

@@ -33,6 +33,7 @@ import {
   registerAttachmentResolver,
   AttachmentOversizeError,
   type SlackAttachmentRow,
+  type BindableContext,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { fetchSlackAttachment } from "../access/slack-attachment-fetch.js";
 
@@ -135,6 +136,24 @@ export async function resolveSlackAttachmentDurable(fileId: string, org?: string
   }
 }
 
+/**
+ * The size-guarded byte pull over a TRUSTED `url_private`: the bot-token, host-pinned fetch, then the Content-Length
+ * pre-check (rejects with {@link AttachmentOversizeError} phase "declared" BEFORE the body is read), then the post-read
+ * cap (phase "actual"). Two callers: the guarded resolver below, and the voice-clip loader (slack-voice-clips.ts),
+ * which reads a clip off the event that woke the agent. Both pass an event-supplied URL, never a model string.
+ */
+export async function pullSlackAttachmentBytes(ctx: BindableContext, ref: { readonly urlPrivate: string; readonly id?: string }, maxBytes: number): Promise<Uint8Array> {
+  const res = await fetchSlackAttachment(ctx, ref);
+  if (!res.ok) throw new Error(`fetching the upload failed (HTTP ${res.status})`);
+  // Content-Length pre-check off the declared length — reject before reading the body.
+  const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+  if (Number.isFinite(declared) && declared > maxBytes) throw new AttachmentOversizeError(declared, "declared", maxBytes);
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  // Post-read cap — a chunked response can exceed the (possibly-absent) Content-Length.
+  if (bytes.byteLength > maxBytes) throw new AttachmentOversizeError(bytes.byteLength, "actual", maxBytes);
+  return bytes;
+}
+
 /**
  * Register Slack as an attachment-plane resolver (channels/attachments.ts) — the neutral seam
  * describe_image consults so its contract carries no per-platform union arm. The resolver wraps the
@@ -169,17 +188,7 @@ export function registerSlackAttachmentResolver(): void {
         ref: `slack-file:${attachmentId}`,
         mimeType: rec.mimeType,
         name: rec.name,
-        async pull({ maxBytes }) {
-          const res = await fetchSlackAttachment(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId });
-          if (!res.ok) throw new Error(`fetching the upload failed (HTTP ${res.status})`);
-          // Content-Length pre-check off the declared length — reject before reading the body.
-          const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
-          if (Number.isFinite(declared) && declared > maxBytes) throw new AttachmentOversizeError(declared, "declared", maxBytes);
-          const bytes = new Uint8Array(await res.arrayBuffer());
-          // Post-read cap — a chunked response can exceed the (possibly-absent) Content-Length.
-          if (bytes.byteLength > maxBytes) throw new AttachmentOversizeError(bytes.byteLength, "actual", maxBytes);
-          return bytes;
-        },
+        pull: ({ maxBytes }) => pullSlackAttachmentBytes(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId }, maxBytes),
       };
     },
   });

package/agent/channels/slack-commands.ts

@@ -42,13 +42,17 @@ import {
   oeSlash,
   parseSlackCommandText,
   resolvePartition,
+  auditSurfaceModeFrom,
   getOperationalStore,
   admittedTenantsFromConfig,
   unadmittedTenantLog,
   UNADMITTED_TENANT_DROP_REASON,
   type BindableContext,
+  type SurfaceBinding,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackTenantAdmission } from "./slack-tenant-fence.js";
+import { slackAuthorIsMember, slackChannelFactsFor } from "./slack-events.js";
+import { slackMode } from "./slack-identity.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:slack-commands] ${msg}`);
@@ -64,6 +68,21 @@ function formField(params: URLSearchParams, name: string): string | undefined {
   return v && v.length > 0 ? v : undefined;
 }
 
+/** What the route learned about a command's trust before it binds. `dmPartnerTrust` is the invoker's own
+ *  verdict in a 1:1 DM. `room` is a channel's `conversations.info` verdict, present whenever Slack answered
+ *  it, whoever typed the command. `invokerMember` is present only when `users.info` CONFIRMED the invoker a
+ *  member (see {@link slashRoomVerdict}). The person's binding stamps `room` only beside `invokerMember`;
+ *  the room's binding stamps it alone (OPE-2588). */
+export interface SlashTrustFacts {
+  readonly dmPartnerTrust?: "internal" | "external";
+  readonly room?: { readonly extShared: boolean };
+  readonly invokerMember?: true;
+}
+
+/** Which verdict a slash binding resolves: the PERSON's (the room's verdict folded with the invoker
+ *  check, which every member gate reads) or the ROOM's alone (which the room's budget reads). */
+export type SlashTrustLeg = "person" | "room";
+
 /** Build the BindableContext the identity seam (bindFrom/bindSlack) expects from Slack's
  *  slash-command form fields. Slack's slash-command payload carries no `channel_type` /
  *  `is_private` bit (unlike an app_mention/message event) — `bindSlack`'s existing fallbacks
@@ -76,16 +95,36 @@ function formField(params: URLSearchParams, name: string): string | undefined {
  *  reads — so a Grid declared once now answers here the same way it answers at every other door,
  *  instead of resolving as though the line were absent.
  *
- *  🔴 STATE ITS REACH EXACTLY, because this door is narrower than the wake doors. For a CHANNEL
- *  command it does NOT change `binding.trust`: this payload carries no `conversations.info` verdict,
- *  so `slackTrust(undefined, undefined, "channel")` fails closed to `external`, and `bindFrom` takes
- *  that raw verdict ahead of any vouch. So a channel `/oe` stays `trust: "external"` with the rung
- *  and without it, and the budget scope `domainNameForScope` picks is unchanged. The rung reaches
- *  `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), where the mapper leaves trust
- *  undefined and the vouch is what answers. Spread conditionally, like every other door: a
- *  single-workspace install stamps nothing. */
-export function bindableForSlashCommand(params: URLSearchParams): BindableContext {
+ *  🔴 STATE ITS REACH EXACTLY. For a CHANNEL command the rung does NOT change `binding.trust`: the
+ *  room's own verdict answers there (see below), and `bindFrom` takes that raw verdict ahead of any
+ *  vouch. The rung reaches `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), and only
+ *  when the invoker probe gave no verdict: the mapper then leaves trust undefined and the vouch
+ *  answers (see below). Spread conditionally, like every other door: a single-workspace install
+ *  stamps nothing.
+ *
+ *  🔴 A CHANNEL COMMAND CARRIES THE ROOM'S OWN VERDICT (OPE-2579). Slack's slash payload carries no
+ *  sharing bit, so before this every channel `/oe` bound `slackTrust(undefined, undefined,
+ *  "channel")`, which fails closed to `external`. A member in an internal channel was then refused
+ *  `/oe suggest on` as an outsider. The route now passes {@link slashRoomVerdict}'s answer as
+ *  `is_ext_shared` + `trust_checked`, the two attributes a channel message stamps from the same
+ *  TTL-cached `conversations.info`. So a channel command reads the room's `internal` or `external` as a
+ *  message in that room does. On the `person` leg (the default) the verdict is stamped only for an
+ *  invoker `users.info` confirms a member. On the `room` leg it is stamped for anybody, because that
+ *  leg answers the room's budget, not a member gate (OPE-2588, {@link bindSlashCommand}). No verdict
+ *  stamps nothing, and the command stays fail-closed `external`.
+ *
+ *  🔴 A DM COMMAND CARRIES THE INVOKER'S OWN VERDICT (OPE-2579). In a 1:1 DM the invoker IS the
+ *  partner, and the route passes {@link slashInvokerDmTrust}'s answer as `dm_partner_trust`, the
+ *  attribute the chat DM leg stamps from the same `users.info` probe. Before this, a workspace vouch
+ *  alone answered a DM command, so a guest or a Connect stranger in their DM with the app read
+ *  `internal` here while the same person read `external` in a DM turn. A verdict outranks the vouch
+ *  in both directions, exactly as in a DM turn: a guest reads `external` under a workspace vouch, and
+ *  a confirmed member reads `internal` with no declaration at all. No verdict leaves the attribute
+ *  unset and the binding resolves as before. This reaches every `/oe` command typed in a DM, not
+ *  only `watch`. */
+export function bindableForSlashCommand(params: URLSearchParams, invoker?: SlashTrustFacts, leg: SlashTrustLeg = "person"): BindableContext {
   const enterpriseId = formField(params, "enterprise_id");
+  const room = invoker?.room && (leg === "room" || invoker.invokerMember === true) ? invoker.room : undefined;
   return {
     channel: { kind: "slack" },
     session: {
@@ -95,6 +134,8 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
             team_id: formField(params, "team_id") ?? "",
             channel_id: formField(params, "channel_id") ?? "",
             ...(enterpriseId ? { enterprise_id: enterpriseId } : {}),
+            ...(invoker?.dmPartnerTrust ? { dm_partner_trust: invoker.dmPartnerTrust } : {}),
+            ...(room ? { is_ext_shared: String(room.extShared), trust_checked: "true" } : {}),
           },
           principalId: formField(params, "user_id") ?? "",
           principalType: "slack-user",
@@ -104,6 +145,120 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
   };
 }
 
+/** How long each trust read (the invoker probe, the room read) may take before the route answers without
+ *  it. Slack wants its ack inside three seconds, and `slackForm`'s 429 backoff can wait longer than that. */
+const INVOKER_PROBE_MS = 1_500;
+
+/**
+ * The invoker's own membership verdict for a 1:1 DM command, in `dm_partner_trust`'s vocabulary, or
+ * `{}` when there is none to give (OPE-2579). It is the chat DM leg's reading of the same probe
+ * (slack-front.ts `liveDmPartnerTrust`): `slackAuthorIsMember` decides, so the two doors cannot
+ * drift on what a guest is. A channel or group DM asks nothing here: there the ROOM's verdict is the
+ * binding's trust, and {@link slashRoomVerdict} reads it.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. No user id, no bot token, a refused `users.info`, a transport
+ * failure or a probe slower than {@link INVOKER_PROBE_MS} all answer `{}`, which leaves the binding
+ * exactly as it resolved before this probe existed. An unanswered probe never invents a guest, and
+ * never invents a member.
+ */
+export async function slashInvokerDmTrust(
+  params: URLSearchParams,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<{ readonly dmPartnerTrust?: "internal" | "external" }> {
+  const userId = formField(params, "user_id");
+  if (!userId || slackMode(undefined, formField(params, "channel_id")) !== "dm") return {};
+  const member = await withinAckBudget(probe(userId, formField(params, "team_id")));
+  return member === undefined ? {} : { dmPartnerTrust: member ? "internal" : "external" };
+}
+
+/** The room facts {@link slashRoomVerdict} reads: `slackChannelFactsFor`'s shape, which every channel wake reads. */
+export type SlashRoomFacts = (channelId: string) => Promise<{ readonly channelType?: string; readonly extShared?: boolean; readonly trustChecked?: boolean }>;
+
+/**
+ * A CHANNEL command's room verdict and invoker check, or `{}` when there is no room verdict to give
+ * (OPE-2579). The room read is `slackChannelFactsFor`, the TTL-cached `conversations.info` every
+ * channel wake reads, so the command door and the message door cannot disagree about one room.
+ *
+ * 🔴 THE INVOKER LEG, AND IT FAILS CLOSED. A channel message keeps the room's verdict on the auth and marks
+ * a guest author on the side (slack-events.ts `slackWakeAuthorFacts`), because one guest's message must not
+ * demote the channel's memory for everybody. A command has no session to protect: its binding exists for
+ * one answer, and `/oe suggest on` and `/oe watch more|less` read `binding.trust` as "is this person a
+ * member". So the route folds the author leg into the binding's `trust`, the composition Discord and
+ * Teams make: `invokerMember` is set only when `users.info` CONFIRMS the invoker a member, and the
+ * person's binding stamps the room's verdict only beside it. A guest, a Slack Connect stranger, and a
+ * person the probe could not check (no `users:read`, a refusal, a timeout) all leave `trust` fail-closed
+ * `external`. The message door fails OPEN on an unanswered probe because it marks a turn. Here `trust`
+ * IS the member gate, and a channel has no declaration to fall back to the way a DM command does.
+ *
+ * 🔴 THE ROOM'S VERDICT IS RETURNED FOR EVERY INVOKER (OPE-2588). `/oe budget` names the room's budget,
+ * and a channel's turns are charged under the room's domain, whoever typed them. So {@link bindSlashCommand}
+ * binds the room's verdict alone into `roomTrust`, and the budget reads that. A guest's `trust` is
+ * unchanged, and `/oe budget` reads both to refuse a guest in an internal channel (commands/core.ts
+ * `budgetWithheldFrom`). `/oe cover on` refuses outside a DM before it reads trust.
+ *
+ * 🔴 ONLY A ROOM IN THE CHANNEL MODE IS STAMPED. A 1:1 DM has its own leg ({@link slashInvokerDmTrust}).
+ * A group DM, or a room whose type Slack did not report, stamps nothing, so its binding is unchanged.
+ * Stamping a sharing verdict on a group DM the binding still calls a channel would mix two modes' rules.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. A failed or refused `conversations.info`, a response without the check,
+ * or a read slower than {@link INVOKER_PROBE_MS} answers `{}`. The command then binds `external`, as
+ * before this read existed. The room read and the invoker probe run in parallel inside one ack budget.
+ */
+export async function slashRoomVerdict(
+  params: URLSearchParams,
+  roomFacts: SlashRoomFacts = slackChannelFactsFor,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<SlashTrustFacts> {
+  const channelId = formField(params, "channel_id");
+  if (!channelId || slackMode(undefined, channelId) === "dm") return {};
+  const userId = formField(params, "user_id");
+  const [facts, member] = await Promise.all([
+    withinAckBudget(roomFacts(channelId)),
+    userId ? withinAckBudget(probe(userId, formField(params, "team_id"))) : Promise.resolve(undefined),
+  ]);
+  if (!facts || facts.trustChecked !== true || typeof facts.extShared !== "boolean") return {};
+  if (facts.channelType !== "channel" && facts.channelType !== "group") return {};
+  return { room: { extShared: facts.extShared }, ...(member === true ? { invokerMember: true as const } : {}) };
+}
+
+/** Both legs, for whichever kind of room the command came from. Never throws. */
+export async function slashTrustFacts(params: URLSearchParams): Promise<SlashTrustFacts> {
+  return slackMode(undefined, formField(params, "channel_id")) === "dm" ? slashInvokerDmTrust(params) : slashRoomVerdict(params);
+}
+
+/**
+ * The slash command's binding, with the room's trust and the person's trust kept apart (OPE-2588).
+ *
+ * `trust` is the PERSON leg: the member gate `/oe suggest on`, `/oe watch more|less` and `/oe cover on`
+ * read. `roomTrust` is the ROOM leg: the same `bindFrom` walk over the room's verdict alone, so the
+ * declarations and the fail-closed default apply to it unchanged. `/oe budget` and the caps behind
+ * `raise` and `clear` read it through `roomTrustOf`. Before this the binding carried one value, so a
+ * guest in an internal channel read the external domain's budget while that channel's turns were
+ * charged under the internal domain. Now `/oe budget` refuses that guest, because a guest must not read
+ * an internal room's caps and spend (Tommy's ruling on #1431).
+ *
+ * In a DM both legs bind the same context, so the two values are equal. Every other field comes from
+ * the person's binding. The two bindings differ only in the two trust attributes, which move no key.
+ */
+export function bindSlashCommand(params: URLSearchParams, facts: SlashTrustFacts): SurfaceBinding {
+  const person = bindFrom(bindableForSlashCommand(params, facts, "person"));
+  const room = bindFrom(bindableForSlashCommand(params, facts, "room"));
+  return { ...person, roomTrust: room.trust };
+}
+
+/** `p`'s answer, or `undefined` when it throws or takes longer than {@link INVOKER_PROBE_MS}. */
+async function withinAckBudget<T>(p: Promise<T>): Promise<T | undefined> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<undefined>((resolve) => {
+    timer = setTimeout(() => resolve(undefined), INVOKER_PROBE_MS);
+  });
+  try {
+    return await Promise.race([p.catch(() => undefined), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * Make a refused slash command OBSERVABLE, the same way `slack.ts`'s `auditWakeDropped` makes a
  * refused wake observable: the webhook function's console output never reaches `vercel logs`, so
@@ -123,16 +278,18 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
  */
 async function auditCommandDropped(teamId: string | undefined, channelId: string | undefined, reason: string, enterpriseId?: string): Promise<void> {
   try {
-    const p = resolvePartition({
+    const bindable = {
       channel: { kind: "slack" },
       session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-    } as BindableContext);
+    } as BindableContext;
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action: "surface.wake_dropped",
       detail: { reason, door: "slash-command", channel: channelId ?? null, team: teamId ?? null, enterprise: enterpriseId ?? null },
     });
@@ -142,6 +299,9 @@ async function auditCommandDropped(teamId: string | undefined, channelId: string
 }
 
 function ephemeralResponse(text: string): Response {
+  // OPE-2490: an empty reply means the command's card posted in this channel and IS the answer. An
+  // empty 200 acknowledges the command, and Slack then shows nothing beside the card.
+  if (text.length === 0) return new Response(null, { status: 200 });
   return new Response(JSON.stringify({ response_type: "ephemeral", text }), {
     status: 200,
     headers: { "content-type": "application/json" },
@@ -219,7 +379,7 @@ export default defineChannel({
       }
 
       const cmd = parseSlackCommandText(formField(params, "text"));
-      const binding = bindFrom(bindableForSlashCommand(params));
+      const binding = bindSlashCommand(params, await slashTrustFacts(params));
       try {
         const reply = await runOeCommand(cmd, binding, { attachSession });
         return ephemeralResponse(reply);

package/agent/channels/slack-context.ts

@@ -38,11 +38,6 @@ import { loadThreadContextMessages } from "eve/channels/slack";
 import type { SlackMessage } from "eve/channels/slack";
 import { MAX_MESSAGES, renderContext, type ContextLine } from "@open-everywhere/core/agent/adapter-api.js";
 
-// Re-export the shared render + line shape so slack-wake-backscroll.ts (which imports them from
-// here) keeps compiling unchanged after the extraction, and any future Slack consumer has one
-// import site. The mapping (`linesFromMessages`) is defined below — it's Slack-message-shaped.
-export { renderContext, type ContextLine };
-
 // When the rendered slice fills MAX_MESSAGES exactly, there's very likely more history above
 // it (both fetchers below request MAX_MESSAGES-worth from Slack, so filling the cap usually
 // means older messages were left out) — tell the model this is a bounded slice, not the whole