@open-everywhere/provider-slack 0.7.0 → 0.8.1

package/agent/channels/slack-commands.ts

@@ -42,13 +42,17 @@ import {
   oeSlash,
   parseSlackCommandText,
   resolvePartition,
+  auditSurfaceModeFrom,
   getOperationalStore,
   admittedTenantsFromConfig,
   unadmittedTenantLog,
   UNADMITTED_TENANT_DROP_REASON,
   type BindableContext,
+  type SurfaceBinding,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { slackTenantAdmission } from "./slack-tenant-fence.js";
+import { slackAuthorIsMember, slackChannelFactsFor } from "./slack-events.js";
+import { slackMode } from "./slack-identity.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:slack-commands] ${msg}`);
@@ -64,6 +68,21 @@ function formField(params: URLSearchParams, name: string): string | undefined {
   return v && v.length > 0 ? v : undefined;
 }
 
+/** What the route learned about a command's trust before it binds. `dmPartnerTrust` is the invoker's own
+ *  verdict in a 1:1 DM. `room` is a channel's `conversations.info` verdict, present whenever Slack answered
+ *  it, whoever typed the command. `invokerMember` is present only when `users.info` CONFIRMED the invoker a
+ *  member (see {@link slashRoomVerdict}). The person's binding stamps `room` only beside `invokerMember`;
+ *  the room's binding stamps it alone (OPE-2588). */
+export interface SlashTrustFacts {
+  readonly dmPartnerTrust?: "internal" | "external";
+  readonly room?: { readonly extShared: boolean };
+  readonly invokerMember?: true;
+}
+
+/** Which verdict a slash binding resolves: the PERSON's (the room's verdict folded with the invoker
+ *  check, which every member gate reads) or the ROOM's alone (which the room's budget reads). */
+export type SlashTrustLeg = "person" | "room";
+
 /** Build the BindableContext the identity seam (bindFrom/bindSlack) expects from Slack's
  *  slash-command form fields. Slack's slash-command payload carries no `channel_type` /
  *  `is_private` bit (unlike an app_mention/message event) — `bindSlack`'s existing fallbacks
@@ -76,16 +95,36 @@ function formField(params: URLSearchParams, name: string): string | undefined {
  *  reads — so a Grid declared once now answers here the same way it answers at every other door,
  *  instead of resolving as though the line were absent.
  *
- *  🔴 STATE ITS REACH EXACTLY, because this door is narrower than the wake doors. For a CHANNEL
- *  command it does NOT change `binding.trust`: this payload carries no `conversations.info` verdict,
- *  so `slackTrust(undefined, undefined, "channel")` fails closed to `external`, and `bindFrom` takes
- *  that raw verdict ahead of any vouch. So a channel `/oe` stays `trust: "external"` with the rung
- *  and without it, and the budget scope `domainNameForScope` picks is unchanged. The rung reaches
- *  `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), where the mapper leaves trust
- *  undefined and the vouch is what answers. Spread conditionally, like every other door: a
- *  single-workspace install stamps nothing. */
-export function bindableForSlashCommand(params: URLSearchParams): BindableContext {
+ *  🔴 STATE ITS REACH EXACTLY. For a CHANNEL command the rung does NOT change `binding.trust`: the
+ *  room's own verdict answers there (see below), and `bindFrom` takes that raw verdict ahead of any
+ *  vouch. The rung reaches `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), and only
+ *  when the invoker probe gave no verdict: the mapper then leaves trust undefined and the vouch
+ *  answers (see below). Spread conditionally, like every other door: a single-workspace install
+ *  stamps nothing.
+ *
+ *  🔴 A CHANNEL COMMAND CARRIES THE ROOM'S OWN VERDICT (OPE-2579). Slack's slash payload carries no
+ *  sharing bit, so before this every channel `/oe` bound `slackTrust(undefined, undefined,
+ *  "channel")`, which fails closed to `external`. A member in an internal channel was then refused
+ *  `/oe suggest on` as an outsider. The route now passes {@link slashRoomVerdict}'s answer as
+ *  `is_ext_shared` + `trust_checked`, the two attributes a channel message stamps from the same
+ *  TTL-cached `conversations.info`. So a channel command reads the room's `internal` or `external` as a
+ *  message in that room does. On the `person` leg (the default) the verdict is stamped only for an
+ *  invoker `users.info` confirms a member. On the `room` leg it is stamped for anybody, because that
+ *  leg answers the room's budget, not a member gate (OPE-2588, {@link bindSlashCommand}). No verdict
+ *  stamps nothing, and the command stays fail-closed `external`.
+ *
+ *  🔴 A DM COMMAND CARRIES THE INVOKER'S OWN VERDICT (OPE-2579). In a 1:1 DM the invoker IS the
+ *  partner, and the route passes {@link slashInvokerDmTrust}'s answer as `dm_partner_trust`, the
+ *  attribute the chat DM leg stamps from the same `users.info` probe. Before this, a workspace vouch
+ *  alone answered a DM command, so a guest or a Connect stranger in their DM with the app read
+ *  `internal` here while the same person read `external` in a DM turn. A verdict outranks the vouch
+ *  in both directions, exactly as in a DM turn: a guest reads `external` under a workspace vouch, and
+ *  a confirmed member reads `internal` with no declaration at all. No verdict leaves the attribute
+ *  unset and the binding resolves as before. This reaches every `/oe` command typed in a DM, not
+ *  only `watch`. */
+export function bindableForSlashCommand(params: URLSearchParams, invoker?: SlashTrustFacts, leg: SlashTrustLeg = "person"): BindableContext {
   const enterpriseId = formField(params, "enterprise_id");
+  const room = invoker?.room && (leg === "room" || invoker.invokerMember === true) ? invoker.room : undefined;
   return {
     channel: { kind: "slack" },
     session: {
@@ -95,6 +134,8 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
             team_id: formField(params, "team_id") ?? "",
             channel_id: formField(params, "channel_id") ?? "",
             ...(enterpriseId ? { enterprise_id: enterpriseId } : {}),
+            ...(invoker?.dmPartnerTrust ? { dm_partner_trust: invoker.dmPartnerTrust } : {}),
+            ...(room ? { is_ext_shared: String(room.extShared), trust_checked: "true" } : {}),
           },
           principalId: formField(params, "user_id") ?? "",
           principalType: "slack-user",
@@ -104,6 +145,120 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
   };
 }
 
+/** How long each trust read (the invoker probe, the room read) may take before the route answers without
+ *  it. Slack wants its ack inside three seconds, and `slackForm`'s 429 backoff can wait longer than that. */
+const INVOKER_PROBE_MS = 1_500;
+
+/**
+ * The invoker's own membership verdict for a 1:1 DM command, in `dm_partner_trust`'s vocabulary, or
+ * `{}` when there is none to give (OPE-2579). It is the chat DM leg's reading of the same probe
+ * (slack-front.ts `liveDmPartnerTrust`): `slackAuthorIsMember` decides, so the two doors cannot
+ * drift on what a guest is. A channel or group DM asks nothing here: there the ROOM's verdict is the
+ * binding's trust, and {@link slashRoomVerdict} reads it.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. No user id, no bot token, a refused `users.info`, a transport
+ * failure or a probe slower than {@link INVOKER_PROBE_MS} all answer `{}`, which leaves the binding
+ * exactly as it resolved before this probe existed. An unanswered probe never invents a guest, and
+ * never invents a member.
+ */
+export async function slashInvokerDmTrust(
+  params: URLSearchParams,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<{ readonly dmPartnerTrust?: "internal" | "external" }> {
+  const userId = formField(params, "user_id");
+  if (!userId || slackMode(undefined, formField(params, "channel_id")) !== "dm") return {};
+  const member = await withinAckBudget(probe(userId, formField(params, "team_id")));
+  return member === undefined ? {} : { dmPartnerTrust: member ? "internal" : "external" };
+}
+
+/** The room facts {@link slashRoomVerdict} reads: `slackChannelFactsFor`'s shape, which every channel wake reads. */
+export type SlashRoomFacts = (channelId: string) => Promise<{ readonly channelType?: string; readonly extShared?: boolean; readonly trustChecked?: boolean }>;
+
+/**
+ * A CHANNEL command's room verdict and invoker check, or `{}` when there is no room verdict to give
+ * (OPE-2579). The room read is `slackChannelFactsFor`, the TTL-cached `conversations.info` every
+ * channel wake reads, so the command door and the message door cannot disagree about one room.
+ *
+ * 🔴 THE INVOKER LEG, AND IT FAILS CLOSED. A channel message keeps the room's verdict on the auth and marks
+ * a guest author on the side (slack-events.ts `slackWakeAuthorFacts`), because one guest's message must not
+ * demote the channel's memory for everybody. A command has no session to protect: its binding exists for
+ * one answer, and `/oe suggest on` and `/oe watch more|less` read `binding.trust` as "is this person a
+ * member". So the route folds the author leg into the binding's `trust`, the composition Discord and
+ * Teams make: `invokerMember` is set only when `users.info` CONFIRMS the invoker a member, and the
+ * person's binding stamps the room's verdict only beside it. A guest, a Slack Connect stranger, and a
+ * person the probe could not check (no `users:read`, a refusal, a timeout) all leave `trust` fail-closed
+ * `external`. The message door fails OPEN on an unanswered probe because it marks a turn. Here `trust`
+ * IS the member gate, and a channel has no declaration to fall back to the way a DM command does.
+ *
+ * 🔴 THE ROOM'S VERDICT IS RETURNED FOR EVERY INVOKER (OPE-2588). `/oe budget` names the room's budget,
+ * and a channel's turns are charged under the room's domain, whoever typed them. So {@link bindSlashCommand}
+ * binds the room's verdict alone into `roomTrust`, and the budget reads that. A guest's `trust` is
+ * unchanged, and `/oe budget` reads both to refuse a guest in an internal channel (commands/core.ts
+ * `budgetWithheldFrom`). `/oe cover on` refuses outside a DM before it reads trust.
+ *
+ * 🔴 ONLY A ROOM IN THE CHANNEL MODE IS STAMPED. A 1:1 DM has its own leg ({@link slashInvokerDmTrust}).
+ * A group DM, or a room whose type Slack did not report, stamps nothing, so its binding is unchanged.
+ * Stamping a sharing verdict on a group DM the binding still calls a channel would mix two modes' rules.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. A failed or refused `conversations.info`, a response without the check,
+ * or a read slower than {@link INVOKER_PROBE_MS} answers `{}`. The command then binds `external`, as
+ * before this read existed. The room read and the invoker probe run in parallel inside one ack budget.
+ */
+export async function slashRoomVerdict(
+  params: URLSearchParams,
+  roomFacts: SlashRoomFacts = slackChannelFactsFor,
+  probe: (userId: string, teamId: string | undefined) => Promise<boolean | undefined> = slackAuthorIsMember,
+): Promise<SlashTrustFacts> {
+  const channelId = formField(params, "channel_id");
+  if (!channelId || slackMode(undefined, channelId) === "dm") return {};
+  const userId = formField(params, "user_id");
+  const [facts, member] = await Promise.all([
+    withinAckBudget(roomFacts(channelId)),
+    userId ? withinAckBudget(probe(userId, formField(params, "team_id"))) : Promise.resolve(undefined),
+  ]);
+  if (!facts || facts.trustChecked !== true || typeof facts.extShared !== "boolean") return {};
+  if (facts.channelType !== "channel" && facts.channelType !== "group") return {};
+  return { room: { extShared: facts.extShared }, ...(member === true ? { invokerMember: true as const } : {}) };
+}
+
+/** Both legs, for whichever kind of room the command came from. Never throws. */
+export async function slashTrustFacts(params: URLSearchParams): Promise<SlashTrustFacts> {
+  return slackMode(undefined, formField(params, "channel_id")) === "dm" ? slashInvokerDmTrust(params) : slashRoomVerdict(params);
+}
+
+/**
+ * The slash command's binding, with the room's trust and the person's trust kept apart (OPE-2588).
+ *
+ * `trust` is the PERSON leg: the member gate `/oe suggest on`, `/oe watch more|less` and `/oe cover on`
+ * read. `roomTrust` is the ROOM leg: the same `bindFrom` walk over the room's verdict alone, so the
+ * declarations and the fail-closed default apply to it unchanged. `/oe budget` and the caps behind
+ * `raise` and `clear` read it through `roomTrustOf`. Before this the binding carried one value, so a
+ * guest in an internal channel read the external domain's budget while that channel's turns were
+ * charged under the internal domain. Now `/oe budget` refuses that guest, because a guest must not read
+ * an internal room's caps and spend (Tommy's ruling on #1431).
+ *
+ * In a DM both legs bind the same context, so the two values are equal. Every other field comes from
+ * the person's binding. The two bindings differ only in the two trust attributes, which move no key.
+ */
+export function bindSlashCommand(params: URLSearchParams, facts: SlashTrustFacts): SurfaceBinding {
+  const person = bindFrom(bindableForSlashCommand(params, facts, "person"));
+  const room = bindFrom(bindableForSlashCommand(params, facts, "room"));
+  return { ...person, roomTrust: room.trust };
+}
+
+/** `p`'s answer, or `undefined` when it throws or takes longer than {@link INVOKER_PROBE_MS}. */
+async function withinAckBudget<T>(p: Promise<T>): Promise<T | undefined> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<undefined>((resolve) => {
+    timer = setTimeout(() => resolve(undefined), INVOKER_PROBE_MS);
+  });
+  try {
+    return await Promise.race([p.catch(() => undefined), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * Make a refused slash command OBSERVABLE, the same way `slack.ts`'s `auditWakeDropped` makes a
  * refused wake observable: the webhook function's console output never reaches `vercel logs`, so
@@ -123,16 +278,18 @@ export function bindableForSlashCommand(params: URLSearchParams): BindableContex
  */
 async function auditCommandDropped(teamId: string | undefined, channelId: string | undefined, reason: string, enterpriseId?: string): Promise<void> {
   try {
-    const p = resolvePartition({
+    const bindable = {
       channel: { kind: "slack" },
       session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-    } as BindableContext);
+    } as BindableContext;
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action: "surface.wake_dropped",
       detail: { reason, door: "slash-command", channel: channelId ?? null, team: teamId ?? null, enterprise: enterpriseId ?? null },
     });
@@ -142,6 +299,9 @@ async function auditCommandDropped(teamId: string | undefined, channelId: string
 }
 
 function ephemeralResponse(text: string): Response {
+  // OPE-2490: an empty reply means the command's card posted in this channel and IS the answer. An
+  // empty 200 acknowledges the command, and Slack then shows nothing beside the card.
+  if (text.length === 0) return new Response(null, { status: 200 });
   return new Response(JSON.stringify({ response_type: "ephemeral", text }), {
     status: 200,
     headers: { "content-type": "application/json" },
@@ -219,7 +379,7 @@ export default defineChannel({
       }
 
       const cmd = parseSlackCommandText(formField(params, "text"));
-      const binding = bindFrom(bindableForSlashCommand(params));
+      const binding = bindSlashCommand(params, await slashTrustFacts(params));
       try {
         const reply = await runOeCommand(cmd, binding, { attachSession });
         return ephemeralResponse(reply);

package/agent/channels/slack-context.ts

@@ -38,11 +38,6 @@ import { loadThreadContextMessages } from "eve/channels/slack";
 import type { SlackMessage } from "eve/channels/slack";
 import { MAX_MESSAGES, renderContext, type ContextLine } from "@open-everywhere/core/agent/adapter-api.js";
 
-// Re-export the shared render + line shape so slack-wake-backscroll.ts (which imports them from
-// here) keeps compiling unchanged after the extraction, and any future Slack consumer has one
-// import site. The mapping (`linesFromMessages`) is defined below — it's Slack-message-shaped.
-export { renderContext, type ContextLine };
-
 // When the rendered slice fills MAX_MESSAGES exactly, there's very likely more history above
 // it (both fetchers below request MAX_MESSAGES-worth from Slack, so filling the cap usually
 // means older messages were left out) — tell the model this is a bounded slice, not the whole