@open-everywhere/provider-slack 0.7.0 → 0.8.1

package/agent/channels/slack-events.ts

@@ -23,6 +23,7 @@ import { slackBotToken } from "../setup/credentials.js";
 import { RateLimitExhaustedError } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   resolvePartition,
+  auditSurfaceModeFrom,
   cancelAnchoredTurn,
   turnAnchorKey,
   STOP_HAND_SLACK_NAME,
@@ -102,6 +103,7 @@ import {
   type EngagementRow,
   type ChannelSessionRow,
   type RoomRoster,
+  type RoomShape,
   type ContextLine,
   type WakeAttachment,
   type WakeMessageInput,
@@ -113,12 +115,15 @@ import {
   dmTrustTtlMs,
   engagedFollowUpContract,
   dispatchNativeWakeWithRetry,
+  coverForWake,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   slackMode,
   buildSlackAuth,
   channelFactsFromInfo,
+  imRosterFactsFromInfo,
   partnerFactsFromInfo,
+  slackUserGuestFlagged,
   appCanReadConversation,
   type ChannelFacts,
   type OpenEverywhereSlackAuth,
@@ -129,9 +134,8 @@ import { holdRouteWork } from "./slack-route-hold.js";
 import { fetchWakeBackscrollLines, fetchWakeEnvelopeBackscroll, RAW_FETCH_REACHBACK_HOURS, WAKE_BACKSCROLL_MAX, type WakeBackscrollLines } from "./slack-wake-backscroll.js";
 // The silence vocabulary (NO_REPLY_SENTINEL / PREFER_NO_REPLY_TOOL) MOVED to normalized-wake.ts —
 // the shared wake renderer that emits it — so no per-surface dialect can drift its own copy.
-// PREFER_NO_REPLY_TOOL is re-exported here for existing importers; provider-neutral callers reach
-// NO_REPLY_SENTINEL through turn-delivery.ts (OPE-114 Stage 0), never through this provider file.
-export { PREFER_NO_REPLY_TOOL };
+// Provider-neutral callers reach NO_REPLY_SENTINEL through turn-delivery.ts (OPE-114 Stage 0), never
+// through this provider file.
 import { registerSlackAttachment } from "./slack-attachments.js";
 // Provider-neutral turn/delivery helpers lifted to turn-delivery.ts (OPE-114 Stage 0). The
 // Slack code below still consumes these three (turnEffectsFor builds on FinalMessageAction,
@@ -165,6 +169,7 @@ import {
   type ReactionIngestOutcome,
   type ReactionVerb,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 /**
  * Minimal Slack `event_callback` envelope shape (the subset the parser reads). Mirrors
@@ -260,6 +265,12 @@ export interface ParsedMessageEvent {
    * wake envelope's `<previous-body>` (wake-envelope.ts) so a judged turn can diff old↔new.
    */
   readonly previousText?: string;
+  /**
+   * TRUE ⇒ a `message_changed` edit whose words and files are exactly the pre-edit ones
+   * ({@link isUnchangedSlackEdit}). Absent on every other event, and on an edit that carries no
+   * `previous_message` to compare against, so an unknown edit reads as a real one.
+   */
+  readonly unchangedEdit?: true;
   /** True when the text @mentions the bot — those go through the normal mention path. */
   readonly isAppMention: boolean;
   /** Image/file attachment REFERENCES parsed off Slack's `files[]` (docs Part B) — surfaced in
@@ -724,6 +735,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   for (const a of attachments) {
     if (a.kind === "image" && a.id && a.url) registerSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, teamId });
   }
+  const unchangedEdit = previousMessage !== undefined && isUnchangedSlackEdit(inner, previousMessage);
   return {
     channelId,
     ts,
@@ -737,6 +749,7 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
     text,
     authoredText,
     previousText: typeof previousMessage?.text === "string" ? previousMessage.text : undefined,
+    ...(unchangedEdit ? { unchangedEdit: true as const } : {}),
     // `app_mention` arrives as its own event type; a `message` whose text contains the bot
     // ref is also a mention. We don't know our own bot id here, so the event-type check is
     // the reliable signal; the route also filters app_mention so the mention path owns it.
@@ -749,6 +762,49 @@ export function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEv
   };
 }
 
+/**
+ * Does a `message_changed` edit leave the message's WORDS and FILES as they were? Pure.
+ *
+ * 🔴 WHY THIS EXISTS (OPE-2577). Slack raises `message_changed` for more than a person's edit. It
+ * raises one each time the message's METADATA changes: a link unfurl, and, in the person's DM with
+ * the app, each `agents.sessions.setStatus` call that OE itself makes on the session's root message
+ * (slack-agent-session.ts: the title at the door, `processing` at turn start, `active` or
+ * `suspended` at the park). The event is hidden: `conversations.history` never lists it, and its
+ * `ts` is a fresh notice stamp. Its inner message is the person's own message, with the person's
+ * own author. So before this predicate, the DM door woke the seat on every one of them, as a NEW
+ * inbound wake. Ship #252 measured it: one DM drew three more wakes within 15 seconds, the
+ * reply-freshness gate refused the answer to the person's real wake as `stale-conversation`, and the
+ * answer landed under a later edit wake. A voice clip was lost, because an edit is never heard again
+ * (slack-voice-clips.ts).
+ *
+ * An edit that changes no words and no files says nothing new, so no door wakes on it. A REAL edit
+ * still wakes: any difference in the typed text, in the quoted-message text Slack parks in
+ * `attachments[]` ({@link resolveSlackInboundText}), or in a file's id or its tombstone mark (a deleted file
+ * stays as `mode: "tombstone"`) makes this false.
+ */
+export function isUnchangedSlackEdit(inner: Record<string, unknown>, previous: Record<string, unknown>): boolean {
+  const textOf = (m: Record<string, unknown>): string => resolveSlackInboundText(typeof m.text === "string" ? m.text : "", m);
+  if (typeof previous.text !== "string") return false; // no pre-edit text to compare ⇒ treat it as a real edit
+  if (textOf(inner) !== textOf(previous)) return false;
+  // Each file's identity, plus a tombstone mark: Slack keeps a deleted file's `id` on the message and
+  // marks it `mode: "tombstone"`, so a removal changes the key even when the id set does not. Only that
+  // one mode counts, so a field that one copy carries and the other omits cannot turn a metadata-only
+  // edit into a real one.
+  const fileKeys = (m: Record<string, unknown>): string =>
+    (Array.isArray(m.files) ? m.files : [])
+      .map((f) => {
+        const o = typeof f === "object" && f !== null ? (f as Record<string, unknown>) : {};
+        const key = [o["id"], o["url_private"], o["name"]].find((v) => typeof v === "string") ?? "";
+        return `${String(key)}${o["mode"] === "tombstone" ? ":tombstone" : ""}`;
+      })
+      .sort()
+      .join("\n");
+  return fileKeys(inner) === fileKeys(previous);
+}
+
+/** The log reason both Slack wake doors give when they drop an {@link isUnchangedSlackEdit} edit. */
+export const UNCHANGED_EDIT_DROP_REASON = "an edit that changed no words and no files (a metadata-only message_changed) — not news";
+
 // --- judged replies: the wake instruction + the silence sentinel -------------
 //
 // An engaged thread forwards EVERY human reply to the session (that's what engagement
@@ -1236,7 +1292,7 @@ function seatWakeAddressing(opts: SlackWakeOpts): "direct-mention" | "name-drop"
  * surface", which an mpim is — inventing a fourth value for it would extrapolate a Tag-derived
  * vocabulary with no evidence behind the new entry.
  */
-export function slackDmWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake {
+function slackDmWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake {
   return slackJudgedWake(ev, "direct-mention", opts, "dm");
 }
 
@@ -1296,7 +1352,7 @@ export interface MessageRouteDeps {
    */
   readonly confirmInternal?: (channelId: string) => Promise<boolean>;
   /** Append a durable audit row. Optional; best-effort. */
-  readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+  readonly audit?: (action: string, detail: AuditDetail) => Promise<void>;
   /** Resolve the trigger author's display name for the envelope (fail-soft). Optional so
    *  existing test doubles keep compiling AND so a wake never depends on a name lookup — absent
    *  or throwing ⇒ the raw id renders. Live wiring points this at {@link fetchUserProfileNames}. */
@@ -1319,7 +1375,7 @@ export function bindableFor(ev: ParsedMessageEvent): BindableContext {
  *  them off — the interactivity CLICK routes (OPE-1680), which carry a signed payload rather than a
  *  message. ONE builder, so a row written from a click keys to the same partition a message from the
  *  same room would. */
-function bindableForSlackIds(ids: {
+export function bindableForSlackIds(ids: {
   readonly teamId?: string | undefined;
   readonly channelId: string;
   readonly channelType?: string | undefined;
@@ -1513,15 +1569,16 @@ function wakeState(ev: ParsedMessageEvent, threadTs: string, extra?: Record<stri
 
 /** Best-effort durable audit row from a route dep (`engagement.stop` / etc.). Resolves the
  *  partition from the surface key so the row is org/surface-scoped like every other audit. */
-async function appendRouteAudit(surfaceKey: string, action: string, detail: Record<string, unknown>): Promise<void> {
+async function appendRouteAudit(surfaceKey: string, action: string, detail: AuditDetail): Promise<void> {
   try {
     // surfaceKey is `platform/workspace/surface` — split to the partition fields the audit row needs.
     const [platform = "slack", workspace = "", surface = ""] = surfaceKey.split("/");
-    const org = resolvePartition({
+    const bindable = {
       channel: { kind: platform },
       session: { auth: { current: { attributes: { team_id: workspace, channel_id: surface }, principalId: "", principalType: "slack-user" } } },
-    } as Parameters<typeof resolvePartition>[0]).org;
-    await getOperationalStore().appendAudit({ ts: new Date().toISOString(), org, platform, workspace, surface, action, detail });
+    } as Parameters<typeof resolvePartition>[0];
+    const org = resolvePartition(bindable).org;
+    await getOperationalStore().appendAudit({ ts: new Date().toISOString(), org, platform, workspace, surface, ...auditSurfaceModeFrom(bindable), action, detail });
   } catch (err) {
     console.warn(`[open-everywhere:slack] route audit write failed: ${String(err)}`);
   }
@@ -1556,7 +1613,7 @@ async function appendRouteAudit(surfaceKey: string, action: string, detail: Reco
  * new thread still gets told why it's being ignored. Fail-open by contract — a dedupe-store
  * outage posts anyway.
  */
-export async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, threadRootTs: string): Promise<SpendGateDecision> {
+async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, threadRootTs: string): Promise<SpendGateDecision> {
   return slackSpendGate({
     bindable: bindableFor(ev),
     mode: slackMode(ev.channelType, ev.channelId),
@@ -1607,7 +1664,7 @@ export async function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, t
  * changes the decision. The route never WAITS on the audit sink — it holds the write open instead,
  * so the row lands after the 200 rather than racing the freeze that follows it.
  */
-function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, detail: Record<string, unknown> = {}): void {
+function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, detail: AuditDetail = {}): void {
   // HELD ON THE ROUTE, not fire-and-forget (OPE-1648). Every engagement route runs inside the front
   // route's `waitUntil`, but a `void`-ed write is OUTSIDE the promise that holds it — so the row
   // raced the freeze that follows the 200 exactly as the mention door's did.
@@ -1617,7 +1674,7 @@ function auditEngagementWakeDropped(ev: ParsedMessageEvent, reason: string, deta
 /** The awaitable half of {@link auditEngagementWakeDropped}. Never throws. The DM door hands the
  *  promise to `waitUntil` directly, because that route returns a 200 immediately and the serverless
  *  invocation can freeze before an unawaited write lands. */
-async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, detail: Record<string, unknown>): Promise<void> {
+async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, detail: AuditDetail): Promise<void> {
   await appendWakeRow(ev, "surface.wake_dropped", reason, detail);
 }
 
@@ -1625,7 +1682,7 @@ async function appendWakeDroppedRow(ev: ParsedMessageEvent, reason: string, deta
  *  DM door's admission row below. It resolves the event's own partition, so a row is always keyed to
  *  the surface it happened on, and it swallows every failure: an observability write must never
  *  block a route or change its decision. */
-async function appendWakeRow(ev: ParsedMessageEvent, action: string, reason: string, detail: Record<string, unknown>): Promise<void> {
+async function appendWakeRow(ev: ParsedMessageEvent, action: string, reason: string, detail: AuditDetail): Promise<void> {
   await appendWakeRowForIds({ teamId: ev.teamId, channelId: ev.channelId, channelType: ev.channelType, userId: ev.userId }, ev.ts, action, reason, detail);
 }
 
@@ -1637,16 +1694,18 @@ async function appendWakeRowForIds(
   ts: string | null,
   action: string,
   reason: string,
-  detail: Record<string, unknown>,
+  detail: AuditDetail,
 ): Promise<void> {
   try {
-    const p = resolvePartition(bindableForSlackIds(ids));
+    const bindable = bindableForSlackIds(ids);
+    const p = resolvePartition(bindable);
     await getOperationalStore().appendAudit({
       ts: new Date().toISOString(),
       org: p.org,
       platform: p.platform,
       workspace: p.workspace,
       surface: p.surface,
+      ...auditSurfaceModeFrom(bindable),
       action,
       detail: { reason, channel: ids.channelId, ts, ...detail },
     });
@@ -1955,6 +2014,9 @@ export async function auditDmDriverAdmitted(ev: ParsedMessageEvent, dmKind: "im"
     dmKind,
     botId: ev.botId ?? null,
     team: ev.teamId ?? null,
+    // The event's subtype, so a reader can tell a typed message from an edit or an upload without
+    // a second source (OPE-2577 had to infer it from the notice-shaped `ts`).
+    subtype: ev.subtype ?? null,
   });
 }
 
@@ -2043,10 +2105,6 @@ function authForEvent(ev: ParsedMessageEvent, facts?: ChannelFacts): OpenEverywh
   });
 }
 
-// Keep mode resolution referenced (the wake scopes to a channel, never mpim/dm here) so a
-// future spike that needs it doesn't re-derive — and to assert the import stays live.
-export const _engagementWakeMode = (ev: ParsedMessageEvent) => slackMode(ev.channelType, ev.channelId);
-
 // --- name-drop wake: judged replies to unmentioned TOP-LEVEL messages ---------
 //
 // Claude Tag's documented behaviour ("a top-level message without a mention may still
@@ -2154,7 +2212,7 @@ export function shouldNameDropWake(input: NameDropInput): ReplyDecision {
  * disqualifiers would go stale the first time somebody adds one to the policy above, and the arm
  * would then reach a message the policy had just started dropping.
  */
-export function nameDropAbstained(input: NameDropInput): boolean {
+function nameDropAbstained(input: NameDropInput): boolean {
   if (input.textMatchesName) return false;
   return shouldNameDropWake({ ...input, textMatchesName: true }).deliver;
 }
@@ -2717,11 +2775,6 @@ export function botDisplayName(): Promise<string | undefined> {
   return botDisplayNamePromise;
 }
 
-/** Reset the cached display name (tests only). */
-export function _resetBotDisplayName(): void {
-  botDisplayNamePromise = undefined;
-}
-
 // Positively confirm a channel is internal via conversations.info, TTL-cached (channels
 // change shared-ness rarely; the API is rate-limited). Any failure → { internal: false }
 // (fail-closed). The SAME response also carries the channel's descriptive metadata
@@ -3234,7 +3287,7 @@ function externalPolicyDropReason(verdict: SlackExternalVerdict): string {
  * On `withhold` it costs one TTL-cached `users.info` per DISTINCT hydrated author, resolved in
  * parallel, and the render budget caps the hydration at ten lines.
  */
-export async function withholdNameDropContext(
+async function withholdNameDropContext(
   nw: NormalizedWake,
   policy: ExternalPolicy,
   teamId: string | undefined,
@@ -3735,13 +3788,16 @@ function slackRosterFailureState(res: Record<string, unknown> | undefined): "uno
 /**
  * Live Slack roster for a governance channel's floor tripwire (OPE-110, access/audience-floor.ts).
  * Up to three Slack reads: conversations.info (is_private + externally-shared bit),
- * conversations.members (member ids) and auth.test (the bot's own user id). The roster excludes the
+ * conversations.members (member ids) and auth.test (the bot's own user id). A 1:1 DM adds a fourth,
+ * users.info on the partner, and reads neither `is_org_shared` nor `is_shared` (OPE-2630, {@link slackImRoster}). The roster excludes the
  * bot's own user id, so the agent doesn't count as a non-admin member. A failed conversations.info
  * or conversations.members read, a members list of a NON-SHARED channel longer than one page, or a
  * thrown error returns `resolved: false`, with an `unresolvedState` (OPE-2306). A transient failure
  * is `failed`: a non-ok answer outside SLACK_ROSTER_UNOBSERVABLE_ERRORS, no answer, a thrown error, a
  * conversations.info answer with no channel object. A steady state is `unobservable`: a code in that
- * set, or a non-shared members list longer than one page. A failed auth.test does not unresolve the roster: the roster stays resolved and counts the bot as a
+ * set, or a non-shared members list longer than one page. For a 1:1 DM, a failed partner users.info
+ * read also returns `resolved: false`, with the same split ({@link slackImRoster}): so a short users.info
+ * outage makes the connector-disclosure floor refuse in every 1:1 DM for up to 30 s. A failed auth.test does not unresolve the roster: the roster stays resolved and counts the bot as a
  * non-admin member, so the governance channel does not arm. `resolved: false` is closed for the
  * governance tripwire: the floor computes to `guest`, so the channel can never arm. It is
  * also closed for the clicker floor's beneficiary leg, which refuses on it (`unattested-room`). It
@@ -3753,7 +3809,8 @@ function slackRosterFailureState(res: Record<string, unknown> | undefined): "uno
  * answer for UNRESOLVED_ROSTER_TTL_MS (30 s) only, not for the full memo TTL (OPE-2150), so one
  * failed read disarms the inert legs, and refuses the connector-disclosure floor, for at most that
  * short window.
- * `hasGuest` uses the channel's externally-shared bit as the available external signal;
+ * `hasGuest` uses the channel's externally-shared bit as the available external signal (a 1:1 DM
+ * reads the Slack Connect bits and the partner's guest flags instead, {@link slackImRoster});
  * per-member guest classification rides the guest-detection work (design §2/§10 fragile-point #1) and
  * is a future tightening, not a loosening (an internal-only private channel already needs every
  * member on the roster to arm). Governance channels are small by config lint, so a single members
@@ -3784,7 +3841,7 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
       // with `hasGuest: true` and an EMPTY member list, never a partial one. The floor is `guest` for every consumer, and
       // the observed-guest legs refuse. The share bit is a steady state, so the full memo TTL is fine.
       if (facts.trustChecked === true && facts.isExternal === true) {
-        return { humanMemberIds: [], resolved: true, isPrivate: facts.isPrivate === true, hasGuest: true };
+        return { humanMemberIds: [], resolved: true, isPrivate: facts.isPrivate === true, hasGuest: true, ...slackRoomShape(facts) };
       }
       // An ok conversations.info with no channel object is an odd answer, not a steady state: it is
       // `failed`, as on the one-page path below.
@@ -3803,6 +3860,8 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
     const humanMemberIds = (members.members as unknown[])
       .filter((m): m is string => typeof m === "string")
       .filter((m) => m !== botId);
+    const im = imRosterFactsFromInfo(info);
+    if (im) return await slackImRoster(im, humanMemberIds, facts.isPrivate === true);
     return {
       humanMemberIds,
       resolved: facts.trustChecked === true, // conversations.info authoritative
@@ -3810,12 +3869,57 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
       ...(facts.trustChecked === true ? {} : { unresolvedState: "failed" as const }),
       isPrivate: facts.isPrivate === true,
       hasGuest: facts.isExternal === true,
+      ...slackRoomShape(facts),
     };
   } catch {
     return { humanMemberIds: [], resolved: false, unresolvedState: "failed", isPrivate: false, hasGuest: false };
   }
 }
 
+/**
+ * The roster of a 1:1 DM (OPE-2630). A DM has two parties, the app and one person, so its audience is
+ * that person. `hasGuest` is true when Slack OBSERVES an outside party: a Slack Connect DM
+ * (`is_ext_shared` / `is_pending_ext_shared`), or a partner whose `users.info` carries a guest flag
+ * (`slackUserGuestFlagged`). `is_org_shared` and `is_shared` do not count. `is_org_shared` marks a
+ * share across the Grid's own workspaces. `is_shared` marks any share, so a Connect DM sets it too, but
+ * a Connect DM also carries the Connect bits read here. Reading the two as a guest refused every
+ * approval card in a full member's own Grid DM (`imRosterFactsFromInfo` holds the reason).
+ *
+ * The workspace rung walk (`partnerFactsFromInfo`) is NOT read here. An undeclared Grid workspace is
+ * a guest by INFERENCE (OPE-1508), not by observation, and the observed-guest legs of the floor refuse
+ * only an observation (access/audience-floor.ts, the polarity rule). Reading the walk here would
+ * floor every DM of an undeclared Grid to `guest` again.
+ *
+ * A failed `users.info` read does not resolve the roster: `failed` on a transient error, and
+ * `unobservable` on a steady one (`missing_scope`), the same split as the room reads above.
+ */
+async function slackImRoster(
+  im: { readonly partnerId?: string; readonly connectShared: boolean },
+  humanMemberIds: readonly string[],
+  isPrivate: boolean,
+): Promise<RoomRoster> {
+  if (im.connectShared) return { humanMemberIds, resolved: true, isPrivate, hasGuest: true, room: "dm" };
+  const partnerId = im.partnerId ?? (humanMemberIds.length === 1 ? humanMemberIds[0] : undefined);
+  // A DM that names no partner gives no person to ask about. The roster then rests on the Connect
+  // bits alone (read above): resolved, with no outside party observed. Before OPE-2630 a DM like this
+  // with `is_org_shared` or `is_shared` set floored to `guest`; now it does not.
+  if (partnerId === undefined) return { humanMemberIds, resolved: true, isPrivate, hasGuest: false, room: "dm" };
+  const who = await slackForm("users.info", `user=${encodeURIComponent(partnerId)}`);
+  const user = who?.ok === true ? (who.user as Record<string, unknown> | undefined) : undefined;
+  if (!user || typeof user !== "object") {
+    return { humanMemberIds: [], resolved: false, unresolvedState: who?.ok === true ? "failed" : slackRosterFailureState(who), isPrivate: false, hasGuest: false };
+  }
+  return { humanMemberIds, resolved: true, isPrivate, hasGuest: slackUserGuestFlagged(user), room: "dm" };
+}
+
+/** The roster's `room` from a `conversations.info` channel type, or nothing when Slack did not say. */
+function slackRoomShape(facts: ChannelFacts): { readonly room?: RoomShape } {
+  if (facts.channelType === "im") return { room: "dm" };
+  if (facts.channelType === "mpim") return { room: "group-dm" };
+  if (facts.channelType === "channel" || facts.channelType === "group") return { room: "channel" };
+  return {};
+}
+
 /**
  * Register {@link slackGovernanceRoster} as the governance floor-tripwire member supplier (OPE-110).
  * Core owns the seam + the fail-closed default; this is the Slack arm, wired at boot from
@@ -4053,7 +4157,7 @@ export interface SupervisorRouteDeps {
     window?: UnifiedWindowWake;
   }) => Promise<void>;
   /** Append a durable audit row (e.g. `engagement.stop`). Optional; best-effort. */
-  readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+  readonly audit?: (action: string, detail: AuditDetail) => Promise<void>;
   /**
    * ENGAGE the trigger's thread as a PARTICIPATING surface (task #100 — window-riding stop parity):
    * called ONLY on an ADDRESSED `directMention` so a mention diverted into the window enrolls its
@@ -4110,6 +4214,11 @@ export interface SupervisorRouteDeps {
  * route's own singleWindow + internal facts — a directMention flag on a non-single-window or
  * non-internal wake degrades safely to the plain channel-watch treatment. Unset ⇒ byte-identical.
  */
+/** The Slack user ids a message mentions (`<@U…>` or `<@U…|name>`), in the order it names them. Pure. */
+export function slackMentionedUserIds(text: string | undefined): string[] {
+  return [...(text ?? "").matchAll(/<@([UW][A-Z0-9]+)(?:\|[^>]*)?>/g)].map((m) => m[1]!);
+}
+
 export async function routeSupervisorEvent(
   ev: ParsedMessageEvent,
   deps: SupervisorRouteDeps,
@@ -4509,7 +4618,7 @@ export async function routeSupervisorEvent(
     // `priorContext` map above) and the hydrated lines are decided by one transform, and it returns
     // the wake BY REFERENCE on the `taint` opt-out grain, so nothing moves for a deployment that
     // opted out. Run only on the name-drop tier, which is the only tier that carries the slot.
-    const wake = slackChannelWatchWake(ev, {
+    const watchWake = slackChannelWatchWake(ev, {
       mode: "supervisor",
       trust: wakeTrust,
       engagementTier,
@@ -4546,6 +4655,25 @@ export async function routeSupervisorEvent(
         ? { contextLines: nameDropRendered, contextSource: nameDropContext?.source, readMoreHint: nameDropContext?.readMoreHint }
         : {}),
     });
+    // 🔴 OUT-OF-OFFICE COVER (OPE-2513). A message that mentions a person with live cover gets OE's cover note on
+    // THIS wake, and nothing else changes: the binding, the auth bag and the room's memory stay the room's, so the
+    // answer can use only what this room already knows. No window, no wake id, no cover (cover/wake.ts).
+    const cover = await coverForWake({
+      org: p.org,
+      platform: "slack",
+      workspace: p.workspace,
+      surface: p.surface,
+      surfaceKey: p.surfaceKey,
+      channelId: ev.channelId,
+      roomPublic: ev.channelType === "channel",
+      wakeId: window?.wakeId,
+      mentionedIds: slackMentionedUserIds(ev.authoredText),
+      ...(ev.userId ? { askerId: ev.userId } : {}),
+      ...(trigger.authorName ? { askerName: trigger.authorName } : {}),
+      text: ev.authoredText,
+      now: new Date(atIso),
+    }).catch(() => ({ covered: [] }) as { systemNote?: string });
+    const wake = cover.systemNote ? { ...watchWake, systemNote: watchWake.systemNote ? `${watchWake.systemNote}\n${cover.systemNote}` : cover.systemNote } : watchWake;
     const rendered = renderWake(
       nameDropTier ? await withholdNameDropContext(wake, externalPolicy, ev.teamId, deps.authorIsMember) : wake,
       deps.now,

package/agent/channels/slack-follow-ups.ts

@@ -0,0 +1,148 @@
+// slack-follow-ups — a press on a suggested follow-up under an agent answer (OPE-2516).
+//
+// An answer in a 1:1 DM (the side panel included) can carry up to three follow-up buttons
+// (slack-reply-blocks.ts). Slack sends a press to the interactivity URL as a signed `block_actions`
+// payload whose action id starts `oe_followup:` and whose value is the button's text. The front route
+// classifies it (`slack-front.ts`, FrontDecision `followup-click`), runs the tenant fence, and then:
+//   1. marks the answer as answered: `chat.update` removes the button row and adds one line,
+//      "↳ You asked: <text>", so the conversation shows what the person sent and no second press
+//      can follow ({@link markFollowUpPressed});
+//   2. wakes the DM seat with the text as the person's next message ({@link followUpMessageEvent}),
+//      through the SAME `scheduleDmWake` road a typed DM takes — every gate on that road applies.
+//
+// 🔴 ONLY A 1:1 DM. A press counts only in a `D…` conversation, where the app and ONE person are the
+// only members, so the presser is the person the answer addressed. The choke point shows the buttons
+// nowhere else; this check is the backstop for a payload that names another conversation.
+//
+// 🔴 THE TEXT IS THE BUTTON'S OWN LABEL. Slack signs the payload and sends a `block_actions` only for
+// a block this app posted, so the value is the text this app wrote under the answer and the person
+// saw on the button. Core drops any follow-up too long to show whole, or holding a character that
+// draws nothing (`reply-follow-ups.ts`), and the parse below refuses both again.
+
+import type { ParsedMessageEvent } from "./slack-events.js";
+import { slackForm } from "./slack-events.js";
+import { SLACK_FOLLOW_UP_ACTION_PREFIX, SLACK_FOLLOW_UP_BLOCK_ID, SLACK_INVISIBLE_CHARACTER } from "./slack-reply-blocks.js";
+import { slackTsFromMs } from "./slack-shortcut.js";
+import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
+
+/** The longest value a press may carry: core's follow-up cap. A longer value is not one of ours. */
+const FOLLOW_UP_VALUE_MAX = 75;
+
+/** One parsed press on a follow-up button. IDS and the button's text only. */
+export interface ParsedSlackFollowUpClick {
+  readonly text: string;
+  readonly userId: string;
+  readonly channelId: string;
+  /** The answer the button sits under. */
+  readonly messageTs: string;
+  /** The answer's thread, when the answer sits in one (a side-panel or agent-session thread). */
+  readonly threadTs?: string;
+  readonly teamId?: string;
+  readonly enterpriseId?: string;
+  /** The answer's blocks as Slack sent them back, so the press can rewrite the message. */
+  readonly blocks?: readonly unknown[];
+  /** The answer's notification text, kept on the rewrite. */
+  readonly messageText?: string;
+}
+
+const obj = (v: unknown): Record<string, unknown> | undefined => (typeof v === "object" && v !== null ? (v as Record<string, unknown>) : undefined);
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.length > 0 ? v : undefined);
+
+/**
+ * Parse a decoded interactivity payload into a follow-up press, or `undefined` when it is not one: not
+ * a `block_actions`, no `oe_followup:` action, an empty or over-long value, a conversation that is not
+ * a 1:1 DM, or a missing user, channel or message. Pure and total: it never throws.
+ */
+export function parseSlackFollowUpClick(payload: unknown): ParsedSlackFollowUpClick | undefined {
+  const p = obj(payload);
+  if (p?.type !== "block_actions" || !Array.isArray(p.actions)) return undefined;
+  const action = (p.actions as unknown[]).map(obj).find((a) => typeof a?.action_id === "string" && a.action_id.startsWith(SLACK_FOLLOW_UP_ACTION_PREFIX));
+  if (action === undefined) return undefined;
+  const text = str(action.value)?.trim();
+  if (text === undefined || text.length === 0 || Array.from(text).length > FOLLOW_UP_VALUE_MAX) return undefined;
+  // A value with a control or format character holds words no button shows, so it is not one of ours.
+  if (SLACK_INVISIBLE_CHARACTER.test(text)) return undefined;
+  const userId = str(obj(p.user)?.id);
+  const channelId = str(obj(p.channel)?.id) ?? str(obj(p.container)?.channel_id);
+  const message = obj(p.message);
+  const messageTs = str(message?.ts) ?? str(obj(p.container)?.message_ts);
+  if (userId === undefined || channelId === undefined || messageTs === undefined) return undefined;
+  if (!channelId.startsWith("D")) return undefined;
+  const threadTs = str(message?.thread_ts) ?? str(obj(p.container)?.thread_ts);
+  const { teamId, enterpriseId } = slackInteractivityTenantIds(p);
+  const blocks = Array.isArray(message?.blocks) ? (message.blocks as unknown[]) : undefined;
+  const messageText = str(message?.text);
+  return {
+    text,
+    userId,
+    channelId,
+    messageTs,
+    // A top-level answer names itself as its own thread root on some payloads: that is no thread.
+    ...(threadTs !== undefined && threadTs !== messageTs ? { threadTs } : {}),
+    ...(teamId === undefined ? {} : { teamId }),
+    ...(enterpriseId === undefined ? {} : { enterpriseId }),
+    ...(blocks === undefined ? {} : { blocks }),
+    ...(messageText === undefined ? {} : { messageText }),
+  };
+}
+
+/**
+ * The press as the person's next DM message. The ts is minted from the clock, as a global shortcut's
+ * is, because no Slack message stands behind the press. The thread is the answer's thread, so the
+ * answer to the follow-up lands where the answer it follows sits.
+ */
+export function followUpMessageEvent(click: ParsedSlackFollowUpClick, nowMs: number = Date.now()): ParsedMessageEvent {
+  return {
+    channelId: click.channelId,
+    ts: slackTsFromMs(nowMs),
+    ...(click.threadTs === undefined ? {} : { threadTs: click.threadTs }),
+    ...(click.teamId === undefined ? {} : { teamId: click.teamId }),
+    ...(click.enterpriseId === undefined ? {} : { enterpriseId: click.enterpriseId }),
+    userId: click.userId,
+    channelType: "im",
+    text: click.text,
+    // The person chose these words by pressing them, so they are the person's own text.
+    authoredText: click.text,
+    isAppMention: false,
+  };
+}
+
+/** The dedupe key of one press: one answer takes one press, so a double press or a redelivery wakes once. */
+export function followUpPressKey(click: ParsedSlackFollowUpClick): string {
+  return `slack-followup:${click.channelId}:${click.messageTs}`;
+}
+
+/** The line that replaces the buttons once the person pressed one. Plain text: it draws no mention. */
+export function followUpPressedLine(text: string): string {
+  return `↳ You asked: ${text}`;
+}
+
+/**
+ * The answer's blocks after a press: the follow-up row removed, and one context line naming what the
+ * person sent. `undefined` when the blocks hold no follow-up row — then there is nothing to rewrite.
+ */
+export function blocksAfterFollowUp(blocks: readonly unknown[], text: string): unknown[] | undefined {
+  const kept = blocks.filter((b) => obj(b)?.block_id !== SLACK_FOLLOW_UP_BLOCK_ID);
+  if (kept.length === blocks.length) return undefined;
+  return [...kept, { type: "context", elements: [{ type: "plain_text", text: followUpPressedLine(text), emoji: true }] }];
+}
+
+/**
+ * Rewrite the answer after a press (see the header). Answers whether Slack took the rewrite. Never
+ * throws: a refused rewrite costs only the line, never the person's message, which wakes regardless.
+ */
+export async function markFollowUpPressed(
+  click: ParsedSlackFollowUpClick,
+  form: (method: string, body: string) => Promise<Record<string, unknown> | undefined> = slackForm,
+): Promise<boolean> {
+  try {
+    const blocks = click.blocks === undefined ? undefined : blocksAfterFollowUp(click.blocks, click.text);
+    if (blocks === undefined) return false;
+    const body = new URLSearchParams({ channel: click.channelId, ts: click.messageTs, blocks: JSON.stringify(blocks) });
+    if (click.messageText !== undefined) body.set("text", click.messageText);
+    const res = await form("chat.update", body.toString());
+    return res?.ok === true;
+  } catch {
+    return false;
+  }
+}