@open-everywhere/provider-slack 0.7.0 → 0.8.1

package/agent/channels/slack-front.ts

@@ -39,6 +39,7 @@
 //      commands) still forwards exactly as before.
 //   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
 
+import { auditErrorDetail } from "@open-everywhere/core/agent/adapter-api.js";
 import { parseSlackUserDeactivation, routeSlackUserDeactivation, type SlackUserDeactivation } from "./slack-offboarding.js";
 import type { OffboardOutcome } from "@open-everywhere/core/agent/adapter-api.js";
 import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } from "eve/channels";
@@ -50,6 +51,7 @@ import {
   auditDmBotAuthorDrop,
   auditDmDriverAdmitted,
   dmDoorAdmitsDriver,
+  UNCHANGED_EDIT_DROP_REASON,
   parseMessageEvent,
   routeMessageEvent,
   liveDeps,
@@ -67,6 +69,7 @@ import {
   bindableFor,
   bindableForJoin,
   bindableForReaction,
+  bindableForSlackIds,
   slackSingleWindowMentionPolicy,
   slackDomainUsesUnifiedWindow,
   slackFrontTenantFenceDeclined,
@@ -84,6 +87,7 @@ import {
   touchDmSeat as liveTouchDmSeat,
   dmSeatThresholds,
   resolvePartition,
+  auditSurfaceModeFrom,
   domainKeyOf,
   isThreadEngaged,
   divertInboundToUnifiedWindow,
@@ -130,6 +134,9 @@ import {
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { botReplyCandidate, slackBotReplyFacts } from "./slack-bot-ask.js";
 import { sidePanelViewedRoom, slackDmSystemNote } from "./slack-side-panel.js";
+import { parseAgentSessionStopped, routeAgentSessionStop, setSlackSessionStatus, slackSessionTitle } from "./slack-agent-session.js";
+import { parseSlackFeedbackClick, routeSlackFeedbackClick, type ParsedSlackFeedbackClick } from "./slack-reply-feedback.js";
+import { followUpMessageEvent, followUpPressKey, markFollowUpPressed, parseSlackFollowUpClick, type ParsedSlackFollowUpClick } from "./slack-follow-ups.js";
 import {
   renderWakeMessage,
   slackChannelFactsFor,
@@ -141,7 +148,6 @@ import {
   stripUnfencedSlackAttachments,
   slackEnterpriseIdFromEnvelope,
   slackForm,
-  _resetAuthorMemberCache,
 } from "./slack-events.js";
 import { buildSlackAuth, withForwardedSlackEnvelope, type ForwardedSlackEnvelope } from "./slack-identity.js";
 import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
@@ -159,6 +165,7 @@ import {
   type ParsedHomeSubmission,
 } from "./slack-home.js";
 import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
+import { hasSlackVoiceClip, withSlackVoiceClips } from "./slack-voice-clips.js";
 import {
   parseSlackShortcutPayload,
   shortcutMessageEvent,
@@ -202,6 +209,12 @@ export type FrontDecision =
    *  OWNER of the ask answered it in their own DM. Core verifies the clicker IS that owner, then
    *  approves or declines. Never forwarded. */
   | { readonly kind: "grant-click"; readonly reason: string; readonly payload: unknown }
+  /** A click on Slack's native thumbs up / down under an agent answer (OPE-2520, slack-reply-blocks.ts)
+   *  — ours: record it as a `reply.feedback` row. Never forwarded, and it wakes nothing. */
+  | { readonly kind: "feedback-click"; readonly reason: string; readonly payload: unknown; readonly click: ParsedSlackFeedbackClick }
+  /** OPE-2516 — a press on a suggested follow-up under an answer in a 1:1 DM (`oe_followup:<n>`). The
+   *  handler wakes the DM seat with the button's text as the person's next message. */
+  | { readonly kind: "followup-click"; readonly reason: string; readonly payload: unknown; readonly click: ParsedSlackFollowUpClick }
   /** An `app_mention` — the native slackChannel path owns it UNLESS the handler's single-window
    *  policy says the unified window does (then the forward is suppressed and the mention's
    *  `message.channels` sibling carries it as an addressed wake). Carries `env` so the handler
@@ -231,7 +244,10 @@ export type FrontDecision =
   | { readonly kind: "home-submit"; readonly reason: string; readonly submission: ParsedHomeSubmission }
   /** An `app_context_changed` (OPE-2457) — ours, and nothing to do. The subscription exists only so
    *  Slack attaches the viewed room to each side-panel `message.im`; the change itself wakes nothing. */
-  | { readonly kind: "context-change"; readonly reason: string };
+  | { readonly kind: "context-change"; readonly reason: string }
+  /** An `agent_session_stopped` (OPE-2519) — ours: the person pressed Slack's native Stop on an agent
+   *  session. It takes the ✋ arm's cancel path (slack-agent-session.ts `routeAgentSessionStop`). */
+  | { readonly kind: "session-stop"; readonly reason: string; readonly env: SlackEventEnvelope };
 
 /**
  * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
@@ -405,6 +421,19 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     if (grantClick !== undefined) {
       return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
     }
+    // OPE-2520 — the native thumbs under an answer. Its action id is exactly `oe_feedback`, which no
+    // prefix above matches, so the order among these branches does not matter.
+    const feedbackPayload = decodeInteractivityPayload(rawBody);
+    const feedbackClick = parseSlackFeedbackClick(feedbackPayload);
+    if (feedbackClick !== undefined) {
+      return { kind: "feedback-click", reason: `block_actions oe_feedback ${feedbackClick.rating} — ours, never forwarded`, payload: feedbackPayload, click: feedbackClick };
+    }
+    // OPE-2516 — a suggested follow-up under an answer. Its action ids start `oe_followup:`, which no
+    // branch above matches.
+    const followUpClick = parseSlackFollowUpClick(feedbackPayload);
+    if (followUpClick !== undefined) {
+      return { kind: "followup-click", reason: "block_actions oe_followup: press in a DM — ours, never forwarded", payload: feedbackPayload, click: followUpClick };
+    }
     // THE HOME TAB (OPE-2451). Its clicks carry an `oe_home:` action id and its one modal a callback
     // id of its own, so neither can be mistaken for another door's payload, nor for eve's.
     const homePayload = decodeInteractivityPayload(rawBody);
@@ -465,6 +494,10 @@ export function classifyEnvelope(rawBody: string, contentType: string): FrontDec
     // forward costs eve a parse and a re-verify for every click the person makes in Slack.
     return { kind: "context-change", reason: "app_context_changed — the room rides the next side-panel message; nothing to wake" };
   }
+  if (eventType === "agent_session_stopped") {
+    // SLACK'S NATIVE STOP (OPE-2519). The subscription is what makes Slack show the button at all.
+    return { kind: "session-stop", reason: "agent_session_stopped — stop the session's running turn", env };
+  }
   if (eventType === "user_change") {
     // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
     return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
@@ -578,16 +611,14 @@ export function resolveBotIdentity(): Promise<{ readonly userId?: string; readon
   return botIdentityPromise;
 }
 
-/** Reset the cached identity (tests only). */
-export function _resetBotIdentity(): void {
-  botIdentityPromise = undefined;
-}
-
 // --- the composed channel ---------------------------------------------------
 
 /** Injectable seams so the wake path is testable without live crypto / Slack. */
 export interface FrontOptions {
   readonly signingSecret?: string;
+  /** Hear the voice clips on a message an addressed road already decided to wake (OPE-2524). Defaults to
+   *  slack-voice-clips.ts `withSlackVoiceClips`; a test injects a stub so no audio is fetched. */
+  readonly hearVoiceClips?: (ev: ParsedMessageEvent) => Promise<ParsedMessageEvent>;
   readonly dedupe?: EventDedupe;
   readonly fifo?: ThreadFifo;
   readonly getBotIdentity?: () => Promise<{ readonly userId?: string; readonly botId?: string }>;
@@ -850,7 +881,7 @@ const logOutcome =
  * ({@link markUndeliveredAfterHeal}) before it rethrows, so {@link recordWakeFailure} can give the
  * row its own reason.
  */
-export async function deliverWithStrandRetry<T>(deliver: () => Promise<T>): Promise<T> {
+async function deliverWithStrandRetry<T>(deliver: () => Promise<T>): Promise<T> {
   try {
     return await deliver();
   } catch (err) {
@@ -878,10 +909,11 @@ export function recordWakeFailure(key: string, err: unknown): void {
   void holdRouteWork(
     (async () => {
       try {
-        const p = resolvePartition({
+        const bindable = {
           channel: { kind: "slack" },
           session: { auth: { current: { attributes: { team_id: "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
-        } as Parameters<typeof resolvePartition>[0]);
+        } as Parameters<typeof resolvePartition>[0];
+        const p = resolvePartition(bindable);
         // OPE-970: a retry that ALSO failed after the pruned-deployment heal gets its own reason —
         // otherwise it is indistinguishable from any other send failure, and the only way to tell
         // "the seat is fine now but this message was lost" from "a transient blip" was to read the
@@ -893,10 +925,11 @@ export function recordWakeFailure(key: string, err: unknown): void {
           platform: p.platform,
           workspace: p.workspace,
           surface: p.surface,
+          ...auditSurfaceModeFrom(bindable),
           action: "surface.wake_failed",
           detail: {
             fifoKey: key,
-            message: String(err instanceof Error ? err.message : err).slice(0, 500),
+            message: auditErrorDetail(err).error,
             ...(undeliveredAfterHeal
               ? { reason: "pruned-deployment-heal-retry-failed", remedy: "seat healed for its next wake; this message got no answer" }
               : {}),
@@ -998,11 +1031,6 @@ async function liveDmPartnerTrust(userId: string, teamId: string | undefined): P
   return member === undefined ? undefined : member ? "internal" : "external";
 }
 
-/** Reset the cached DM-partner trust (tests only). */
-export function _resetDmTrustCache(): void {
-  _resetAuthorMemberCache();
-}
-
 // `wrapDmSeatFrom` (OPE-90) is DELETED at OPE-351 stage 2. It existed to remap the address of eve's
 // NATIVE DM send onto a rotatable seat token — a bolt-on to a dispatch path a DM no longer takes. The
 // DM is now diverted onto the `unified` channel before the forward ever happens (`scheduleDmWake`
@@ -1058,9 +1086,27 @@ export function mentionSiblingSuppressed(input: {
   return input.authoredText.includes(`<@${input.botUserId}>`);
 }
 
+/**
+ * Would a TYPED message in this thread reach the agent (OPE-2524)? The thread roads hear a voice clip only then, so a clip
+ * is handled exactly as the same words typed. That is an engagement row that was not stood down: an invited thread, or a
+ * name-drop watcher thread (whose typed follow-ups `shouldDeliverReply` admits, and which wakes with `oeUninvited`). A
+ * STOOD-DOWN row is the one case `isThreadEngaged` admits and the road then drops (`shouldDeliverReply`'s `stopped`
+ * leg, `routeSupervisorEvent`'s stood-down silence), so a clip heard there would be downloaded and billed for nothing.
+ * Fail-closed: an unreadable row is not heard.
+ */
+async function threadHearsClips(p: { readonly org: string; readonly surfaceKey: string }, threadTs: string): Promise<boolean> {
+  try {
+    const row = await getOperationalStore().getEngagement(p.org, p.surfaceKey, threadTs);
+    return row !== null && row.stopped !== true;
+  } catch {
+    return false;
+  }
+}
+
 export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions = {}): RouteHandler {
   const dedupe = opts.dedupe ?? new EventDedupe();
   const fifo = opts.fifo ?? new ThreadFifo(recordWakeFailure);
+  const hearVoice = opts.hearVoiceClips ?? ((ev: ParsedMessageEvent) => withSlackVoiceClips(ev));
   const getBotIdentity = opts.getBotIdentity ?? resolveBotIdentity;
   const now = opts.now ?? (() => Date.now());
   // THE SIGNING SECRET RESOLVES PER REQUEST, AND IT IS ASYNC SINCE OPE-2231. It used to be a
@@ -1278,7 +1324,11 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     // `onWake` runs SYNCHRONOUSLY, once, immediately before a wake is scheduled — and never on the
     // addressed-drop path below. The shortcut route (OPE-1442) uses it to seed the attachment
     // registry only for a click that actually wakes something; every other caller omits it.
-    const scheduleUnownedWake = (ev: ParsedMessageEvent, label: string, directMention = false, onWake?: () => void, seatEngaged = false): void => {
+    // `hearsMentionClip` (OPE-2524) is an explicit opt-in, set by the diverted @mention road ONLY. `directMention` alone
+    // is not enough: a channel MESSAGE SHORTCUT is also an addressed wake, but the clip on its target message is someone
+    // ELSE's speech, which the shortcut fences as untrusted, and hearing it would put that person's words outside the
+    // fence at the presser's trust. A shortcut's clip is not heard.
+    const scheduleUnownedWake = (ev: ParsedMessageEvent, label: string, directMention = false, onWake?: () => void, seatEngaged = false, hearsMentionClip = false): void => {
       let ambient = false;
       let surfaceKey: string | undefined;
       try {
@@ -1327,15 +1377,31 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
         // on the hot path exactly like the token-based key did.
         const supKey = supervisorFifoKey(ev.channelId);
         args.waitUntil(
-          fifo.enqueue(supKey, () =>
-            deliverWithStrandRetry(() =>
+          fifo.enqueue(supKey, async () => {
+            // A voice clip is heard on an ADDRESSED seat wake only — a mention, or an engaged thread that was not stood
+            // down. An ambient wake on unaddressed talk never downloads a room's audio (OPE-2524, slack-voice-clips.ts).
+            // A bot author is dropped by the seat's own gate, so its clip is never paid for. The clip test comes first, so
+            // a message with no clip pays no extra store read. The thread leg also asks the room's fail-closed internal
+            // confirmation FIRST, the one `shouldSupervisorWake` drops on later: a thread in a room that became shared, or
+            // cannot be confirmed internal, wakes nothing, so its clip must not reach speech-to-text. (A mention already
+            // passed that confirmation in the single-window policy.)
+            const hears =
+              !ev.botId &&
+              hasSlackVoiceClip(ev) &&
+              ((directMention && hearsMentionClip) ||
+                (seatEngaged &&
+                  ev.threadTs !== undefined &&
+                  (await channelFactsFor(ev.channelId).then((f) => f.internal === true, () => false)) &&
+                  (await threadHearsClips(resolvePartition(bindableFor(ev)), ev.threadTs))));
+            const heard = hears ? await hearVoice(ev) : ev;
+            return deliverWithStrandRetry(() =>
               routeSupervisorEvent(
-                ev,
+                heard,
                 withSingleWindowDiversion(liveSupervisorDeps(send), args.to, surfaceKey!),
                 directMention ? { directMention: true } : undefined,
               ).then(logOutcome(`${label}-supervisor`, ev.channelId, ev.ts)),
-            ),
-          ),
+            );
+          }),
         );
         return;
       }
@@ -1428,7 +1494,15 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       /** The DM door admitted this bot author as the deployment's named e2e driver (OPE-1023).
        *  Defaults FALSE, so every existing call site is unchanged. */
       driverAdmitted = false,
+      /** Set only for a real `message.im` the person sent, which belongs to a Slack agent session
+       *  (OPE-2519): the words the person TYPED, before any voice clip was heard. A shortcut's minted
+       *  ts names no message, and a group DM has no agent session, so both leave it undefined and
+       *  leave the session untouched. The title reads only these words: a voice clip's transcript
+       *  rides `authoredText` behind a `[voice clip]` marker, and a clip OE could not hear adds a
+       *  host-written line, so neither is the person's typed text. */
+      agentSessionTypedText?: string,
     ): Promise<void> => {
+      const opensAgentSession = agentSessionTypedText !== undefined;
       // 🔴 THE TENANT FENCE, AND THIS IS ITS CHOKEPOINT FOR THE WHOLE DM FAMILY (OPE-1644). Before
       // this line `slack-front.ts` consulted the fence NOWHERE, while the mention door, the four
       // dispatching engagement routes, the channel-join door and the `/oe` slash door all did — so a
@@ -1583,6 +1657,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           channelType: dmKind,
           isPrivate: true,
           ...(partnerTrust ? { dmPartnerTrust: partnerTrust } : {}),
+          // OPE-2519: the 1:1 message's Slack agent session — its thread, or itself when top-level.
+          ...(opensAgentSession && !isGroup ? { agentSessionTs: ev.threadTs ?? ev.ts } : {}),
           // 🔴 THE GROUP DM CARRIES THE PLATFORM'S OWN SHARING VERDICT (OPE-1486), which is what a
           // channel wake has always stamped (`authForEvent`) and an mpim wake never did. `bindSlack`
           // reads the pair through `slackTrust`, so this is the binding's only route to the fact
@@ -1638,6 +1714,18 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
         ...(seat.freshGeneration && seat.tail.length > 0 ? { backscroll: seat.tail } : {}),
       });
 
+      // THE SESSION TITLE (OPE-2519). A top-level 1:1 message opens a new conversation in the Messages
+      // tab or the side panel, and Slack keys its agent session by that message. Create the session with
+      // a title from the person's own words BEFORE the wake: the turn's `processing` call would
+      // otherwise create it untitled first, and Slack applies a title only on creation. That same rule
+      // keeps a title the person typed over ours. A group DM, a shortcut and a thread reply open no new
+      // session. The title reads the TYPED text alone, before any voice clip was heard: `text` also
+      // carries the lines of a forwarded or quoted message, which are another conversation's words.
+      if (opensAgentSession && !isGroup && !ev.threadTs && ev.ts) {
+        const title = slackSessionTitle(agentSessionTypedText);
+        if (title) await setSlackSessionStatus({ channelId: ev.channelId, threadTs: ev.ts, status: "active", title });
+      }
+
       // 🔴 NO `replyAnchorTs` ON A TOP-LEVEL DM — the reply stays FLAT in the conversation. The
       // CHANNEL divert DOES set one (slack-events.ts), because threading an answer under its trigger
       // keeps a busy shared channel tidy; the slack post arm reads `threadTs ?? replyAnchorTs`
@@ -1781,6 +1869,16 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // between here and it. The parse above has already seeded the in-memory attachment LRU, which
       // is the one cost no placement in this branch avoids.
       if (slackFrontTenantFenceDeclined(dev, `dm-${decision.dmKind}`, "front-dm-branch")) return fencedAck(OK());
+      // 🔴 AN EDIT THAT CHANGED NOTHING IS NOT A WAKE (OPE-2577). OE's own agent-session status calls
+      // edit the person's root message, and each edit reaches this door as a `message_changed` with
+      // the person as author. Woken, each one was a new inbound wake that made the answer to the
+      // person's real message stale. See {@link isUnchangedSlackEdit}. Above the driver carve-out, so
+      // the driver's DM and a person's DM take the same drop. A log line only, no audit row: three of
+      // these follow every DM turn, the same reasoning that keeps our own reply echo out of the trail.
+      if (dev.unchangedEdit) {
+        console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: no wake — ${UNCHANGED_EDIT_DROP_REASON}`);
+        return OK();
+      }
       // A bot-authored DM is never a wake — a no-op 200. NOT a forward: forwarding a bot_message
       // would hand eve's native door a turn the DM window is meant to own.
       //
@@ -1879,7 +1977,10 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // enqueues on the SAME key, so a group DM's two legs can never run concurrently on one seat.
       args.waitUntil(
         fifo.enqueue(dmFifoKey(dev.channelId), async () => {
-          await deliverWithStrandRetry(() => scheduleDmWake(dev, decision.dmKind, driverAdmitted));
+          // A voice clip is heard ONCE, before the retry wrapper, so a strand retry never pays for a second
+          // transcription (OPE-2524, slack-voice-clips.ts). A DM is always addressed, so its clips are always heard.
+          const heard = await hearVoice(dev);
+          await deliverWithStrandRetry(() => scheduleDmWake(heard, decision.dmKind, driverAdmitted, decision.dmKind === "im" ? dev.authoredText : undefined));
           console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: woke — diverted to the DM window seat`);
         }),
       );
@@ -2053,7 +2154,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
         // directMention path (slack-events.ts routeSupervisorEvent) and re-checks its own
         // fail-closed internal confirmation — the SAME process-local TTL-cached conversations.info
         // the policy just populated, so the two reads on this one webhook are cache-coherent.
-        scheduleUnownedWake(mev, "single-window-mention", true);
+        scheduleUnownedWake(mev, "single-window-mention", true, undefined, false, true);
         return OK();
       }
       // 🔴 THE GROUP-DM MENTION LEG (OPE-351 stage 4). An @mention is how a human addresses the bot in
@@ -2092,7 +2193,9 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           // which is what makes `bindSlack` bind mode `mpim` on this leg exactly as on the other.
           args.waitUntil(
             fifo.enqueue(dmFifoKey(mev.channelId), async () => {
-              await deliverWithStrandRetry(() => scheduleDmWake({ ...mev, channelType: "mpim" }, "mpim"));
+              // A bot's group-DM mention is not heard: `scheduleDmWake` drops a bot author after this step.
+              const heard = mev.botId ? mev : await hearVoice(mev);
+              await deliverWithStrandRetry(() => scheduleDmWake({ ...heard, channelType: "mpim" }, "mpim"));
             }),
           );
           return OK();
@@ -2248,6 +2351,56 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return new Response(null, { status: 200 });
     }
 
+    if (decision.kind === "feedback-click") {
+      // THE TENANT FENCE FIRST (OPE-1680), as every click branch: a foreign workspace writes no row.
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "feedback-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // OPE-2520 — a rating, recorded after the acknowledgement. Slack draws the pressed state itself,
+      // so the empty 200 is the whole answer, and the row write never holds the click up.
+      const click = decision.click;
+      args.waitUntil(
+        routeSlackFeedbackClick(click)
+          .then((recorded) => {
+            if (!recorded) console.warn("[open-everywhere:slack-front] a thumbs click was not recorded");
+          })
+          .catch(() => undefined),
+      );
+      return new Response(null, { status: 200 });
+    }
+
+    if (decision.kind === "followup-click") {
+      // OPE-2516 — the person pressed a suggested follow-up under an answer in their DM.
+      // THE TENANT FENCE FIRST (OPE-1680), as every click branch. `scheduleDmWake` refuses the same
+      // workspace on its own; this spares an unadmitted one the rewrite and the dedupe write.
+      const click = decision.click;
+      const sev = followUpMessageEvent(click, now());
+      if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "followup-click", "front-interactivity-branch")) {
+        return fencedAck(new Response(null, { status: 200 }));
+      }
+      // One answer takes one press: a double press, or Slack's redelivery of one, wakes the seat once.
+      if (!(await notYetSeenKey(followUpPressKey(click), sev))) return new Response(null, { status: 200 });
+      // ACK FIRST, WORK AFTER, as the shortcut branch: the rewrite and the wake both ride `waitUntil`.
+      // The rewrite removes the buttons and shows what the person sent. The wake takes the SAME road a
+      // typed DM takes, so the seat, the trust probe, the external-participant policy and the spend
+      // gate all decide it. The agent session is touched only when the answer sits in a thread: a
+      // top-level answer has no session thread for a minted ts to name.
+      args.waitUntil(
+        markFollowUpPressed(click)
+          .then((rewritten) => {
+            if (!rewritten) console.log(`[open-everywhere:slack-front] follow-up press in ${click.channelId}: the answer was not rewritten`);
+          })
+          .catch(() => undefined),
+      );
+      args.waitUntil(
+        fifo.enqueue(dmFifoKey(click.channelId), async () => {
+          await deliverWithStrandRetry(() => scheduleDmWake(sev, "im", false, click.threadTs === undefined ? undefined : click.text));
+          console.log(`[open-everywhere:slack-front] follow-up press in ${click.channelId}: woke the DM window`);
+        }),
+      );
+      return new Response(null, { status: 200 });
+    }
+
     if (decision.kind === "home-open" || decision.kind === "home-click" || decision.kind === "home-submit") {
       // THE HOME TAB (OPE-2451). THE TENANT FENCE FIRST (OPE-1680), for the reason the approval branch
       // states: the page reads and changes a person's memory, keyed to a bare per-workspace member id,
@@ -2433,6 +2586,49 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       return OK();
     }
 
+    if (decision.kind === "session-stop") {
+      // SLACK'S NATIVE STOP (OPE-2519) — the same cancel door as the ✋ arm below, with the same fence
+      // in front of it: an unadmitted workspace's press must never reach `args.attachSession`.
+      const stop = parseAgentSessionStopped(decision.env);
+      if (!stop) return OK();
+      const stopEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+      if (
+        slackInteractivityTenantFenceDeclined(
+          {
+            ...(stop.teamId === undefined ? {} : { teamId: stop.teamId }),
+            ...(stopEnterpriseId === undefined ? {} : { enterpriseId: stopEnterpriseId }),
+            channelId: stop.channelId,
+            userId: stop.userId,
+          },
+          "session-stop",
+          "front-session-stop-branch",
+        )
+      ) {
+        return fencedAck(OK());
+      }
+      // A Slack RETRY of the same press must not send a second cancel: in-memory first, then durable.
+      const skey = wakeKey(decision.env, stop.channelId, stop.eventTs ?? stop.threadTs);
+      if (dedupe.seen(skey, now())) return OK();
+      dedupe.mark(skey, now());
+      try {
+        const org = resolvePartition(bindableForSlackIds({ teamId: stop.teamId, channelId: stop.channelId, userId: stop.userId })).org;
+        if (!(await markEventSeen(org, skey, new Date(now()).toISOString()))) return OK();
+      } catch {
+        /* unresolvable partition → in-memory dedupe only (fail-open, as for a reaction) */
+      }
+      if (!args.attachSession) {
+        console.warn(`[open-everywhere:slack-front] session stop ${stop.channelId}/${stop.threadTs}: no cancel door on this route — nothing stopped`);
+        return OK();
+      }
+      const attachSession = args.attachSession;
+      args.waitUntil(
+        routeAgentSessionStop(stop, { attachSession }).then((r) =>
+          console.log(`[open-everywhere:slack-front] session stop ${stop.channelId}/${stop.threadTs}: ${r.outcome}`),
+        ),
+      );
+      return OK();
+    }
+
     if (decision.kind === "reaction") {
       // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
       const rev = parseSlackReactionEvent(decision.env);
@@ -2496,6 +2692,10 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     // Wake path. Parse the message; a non-message or id-less envelope is a no-op 200.
     const ev = parseMessageEvent(decision.env);
     if (!ev) return OK();
+    // An edit that changed no words and no files (a link unfurl, for example) is not news here either:
+    // the engagement and supervisor gates keep `message_changed` so a person's REAL edit wakes, and
+    // this keeps a metadata-only one out (OPE-2577, {@link isUnchangedSlackEdit}).
+    if (ev.unchangedEdit) return OK();
     persistAttachments(ev); // durable upload registry (task #107) — so a delegated worker can read this message's files
 
     // 🔴 THE ASKED-THREAD EXCEPTION (OPE-2426): the only road by which another bot's message WAKES the
@@ -2584,7 +2784,13 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
     // problem the durable dedupe above closes.)
     const threadKey = slackContinuationToken(ev.channelId, ev.threadTs);
     args.waitUntil(
-      fifo.enqueue(threadKey, () => routeMessageEvent(ev, liveDeps(send)).then(logOutcome("engaged-thread", ev.channelId, ev.threadTs!))),
+      // A human's voice clip is heard here unless the thread was stood down (OPE-2524): `shouldDeliverReply` drops a bot
+      // author and a stood-down thread, so their clips are never paid for. The clip test comes first, so a message with
+      // no clip pays no extra store read.
+      fifo.enqueue(threadKey, async () => {
+        const heard = !ev.botId && hasSlackVoiceClip(ev) && (await threadHearsClips(p, ev.threadTs!)) ? await hearVoice(ev) : ev;
+        return routeMessageEvent(heard, liveDeps(send)).then(logOutcome("engaged-thread", ev.channelId, ev.threadTs!));
+      }),
     );
     return OK();
   }

package/agent/channels/slack-home.ts

@@ -1,5 +1,5 @@
-// THE SLACK APP HOME TAB (OPE-2451) — the person's own page: what the agent remembers about them,
-// what their domains know, and their rules (OPE-2456). Core owns the page model
+// THE SLACK APP HOME TAB (OPE-2451) — the person's own page: what the agent does for them (OPE-2522),
+// what it remembers about them, what their domains know, and their rules (OPE-2456). Core owns the page model
 // (`home/home-view.ts`); this module is the Slack half: it parses the three Slack deliveries the
 // page needs, builds the VERIFIED viewer, renders Block Kit, and drives the dialogs.
 //
@@ -24,6 +24,7 @@
 // A guest, or a person whose only route into a domain is a Slack Connect channel, sees their own
 // memory and no domain's.
 
+import { auditErrorDetail } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   appendAudit,
   bindFrom,
@@ -214,6 +215,10 @@ function renderBlock(b: HomeBlock): SlackBlock[] {
           action_id: `${HOME_ACTION_PREFIX}item`,
           options: b.actions.map((a) => ({ text: plain(a.label), value: `${a.id}|${b.ref}` })),
         };
+      } else if (b.link && /^https:\/\//u.test(b.link) && b.link.length <= 3000) {
+        // A link button (OPE-2522). Slack still sends a click on it; `oe_home:link` names no registered action, so the
+        // front route claims it and runs nothing.
+        section.accessory = { type: "button", action_id: `${HOME_ACTION_PREFIX}link`, text: plain("Open"), url: b.link };
       }
       return [section];
     }
@@ -346,6 +351,7 @@ export async function buildSlackHomeViewer(ids: ParsedHomeInteraction, deps: Sla
     platform: partition.platform,
     workspace: partition.workspace,
     principalId: binding.principalId,
+    ...(ids.enterpriseId ? { enterprise: ids.enterpriseId } : {}),
     ...(dmId ? { personal: partition } : {}),
     trust,
     domains: homeDomainsFor(trust, memberships),
@@ -442,7 +448,7 @@ async function publishHome(userId: string, viewer: HomeViewer, deps: SlackHomeDe
       trust: viewer.trust,
       domains: viewer.domains.length,
       notice: notice !== undefined,
-      ...(ok ? {} : { error: typeof res?.error === "string" ? res.error : "no response" }),
+      ...(ok ? {} : { error: auditErrorDetail(typeof res?.error === "string" ? res.error : "no response").error }),
     },
   }).catch(() => undefined);
   return ok;

package/agent/channels/slack-identity.ts

@@ -55,6 +55,13 @@ export interface SlackIdentityInput {
    * fails closed (external), so a DM's shared read layer is `public`, never org/dm-shared.
    */
   readonly dmPartnerTrust?: "internal" | "external";
+  /**
+   * For a 1:1 DM only: the thread root of the Slack agent session the message belongs to (OPE-2519) —
+   * its `thread_ts`, or its own `ts` for a top-level message, which opens a session. It names the
+   * session whose state OE sets (channels/slack-agent-session.ts). It changes no reply target: the
+   * reply still reads `thread_ts`.
+   */
+  readonly agentSessionTs?: string;
 }
 
 /** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
@@ -71,6 +78,7 @@ export function buildSlackAuth(input: SlackIdentityInput): OpenEverywhereSlackAu
   if (typeof input.isExternal === "boolean") attributes.is_ext_shared = String(input.isExternal);
   if (typeof input.trustChecked === "boolean") attributes.trust_checked = String(input.trustChecked);
   if (input.dmPartnerTrust) attributes.dm_partner_trust = input.dmPartnerTrust;
+  if (input.agentSessionTs) attributes.agent_session_ts = input.agentSessionTs;
   // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 DM OR an mpim (group
   // DM) is a STANDING seat ⇒ narrowed hands — both are closed multi-party conversations with no
   // channel identity. A DM is unambiguously channelType "im" (the DM path always sets it); the
@@ -196,7 +204,7 @@ function enterpriseIdOfUser(u: Record<string, unknown>): string | undefined {
  * PURE and SYNCHRONOUS — the register read is (identity/trust.ts's own contract), so this adds no
  * I/O to a leg that already pays for one `users.info`.
  */
-export function slackWorkspaceVouched(teamId: string | undefined, enterpriseId: string | undefined): boolean {
+function slackWorkspaceVouched(teamId: string | undefined, enterpriseId: string | undefined): boolean {
   const team = surfaceKeySegment(teamId);
   if (team.length === 0) return false; // no workspace named ⇒ nothing to ask about ⇒ not vouched
   const enterprise = surfaceKeySegment(enterpriseId);
@@ -257,7 +265,7 @@ export function slackWorkspaceVouched(teamId: string | undefined, enterpriseId:
 export function partnerFactsFromInfo(info: unknown, expectedTeamId?: string): { dmPartnerTrust: "internal" | "external" } {
   const u = (info as { user?: Record<string, unknown> } | null)?.user;
   if (!u || typeof u !== "object") return { dmPartnerTrust: "external" }; // lookup failed → fail closed
-  const guestOrStranger = Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+  const guestOrStranger = slackUserGuestFlagged(u);
   const deleted = Boolean(u["deleted"]);
   const homeTeamId = typeof u["team_id"] === "string" ? (u["team_id"] as string) : undefined;
   // 🔴 NO EXPECTED WORKSPACE IS NOT AN OWN-WORKSPACE ANSWER. This used to read the absence as
@@ -280,6 +288,39 @@ export function partnerFactsFromInfo(info: unknown, expectedTeamId?: string): {
   return { dmPartnerTrust: internal ? "internal" : "external" };
 }
 
+/** Slack's own guest flags on a `users.info` user object: a multi-channel guest (`is_restricted`), a
+ *  single-channel guest (`is_ultra_restricted`) or a Slack Connect stranger (`is_stranger`). The ONE
+ *  reader of these three flags, so {@link partnerFactsFromInfo} and the 1:1 DM roster
+ *  ({@link imRosterFactsFromInfo}) cannot disagree on what Slack calls a guest. It reads no workspace
+ *  and no declaration: it is what Slack OBSERVED about the person, nothing inferred. */
+export function slackUserGuestFlagged(u: Record<string, unknown>): boolean {
+  return Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+}
+
+/**
+ * The room facts of a 1:1 DM (`is_im`) from a `conversations.info` response, or `undefined` for any
+ * other conversation (OPE-2630). The DM roster reads these instead of
+ * {@link ChannelFacts.isExternal}.
+ *
+ * 🔴 WHY A DM DOES NOT READ `isExternal`. `isExternal` is true on ANY of the four share bits.
+ * `is_org_shared` marks a share across the workspaces of ONE Enterprise Grid organisation. `is_shared`
+ * marks ANY share, a Slack Connect one included, so it alone does not tell a Grid share from a Connect
+ * one. A Connect DM also carries `is_ext_shared` (or `is_pending_ext_shared`), and this function reads
+ * those two bits. A 1:1 DM has exactly two parties, the app and one person, so `is_org_shared` or `is_shared` on it
+ * says nothing about an outside audience. Read as "external", they floored a full member's own DM to
+ * `guest`, and the card-disclosure floor refused every approval card there (OPE-2630, a Grid install).
+ * So a DM's audience is judged by the two facts that do name an outside party: the Slack Connect bits
+ * (`is_ext_shared`, `is_pending_ext_shared`) here, and the partner's own guest flags
+ * ({@link slackUserGuestFlagged}), which the roster reads with `users.info`.
+ */
+export function imRosterFactsFromInfo(info: unknown): { readonly partnerId?: string; readonly connectShared: boolean } | undefined {
+  const ch = (info as { channel?: Record<string, unknown> } | null)?.channel;
+  if (!ch || typeof ch !== "object" || ch["is_im"] !== true) return undefined;
+  const partnerId = typeof ch["user"] === "string" && ch["user"].length > 0 ? (ch["user"] as string) : undefined;
+  const connectShared = Boolean(ch["is_ext_shared"] || ch["is_pending_ext_shared"]);
+  return { ...(partnerId === undefined ? {} : { partnerId }), connectShared };
+}
+
 /** What an app_mention envelope tells us directly (often just channel_type). */
 export function channelFactsFromRaw(raw: Record<string, unknown>): ChannelFacts {
   const channelType = typeof raw["channel_type"] === "string" ? (raw["channel_type"] as string) : undefined;