@open-everywhere/provider-slack 0.8.0 → 0.9.0

package/agent/app-manifest.ts

@@ -255,7 +255,9 @@ export function slackAppManifestTemplate(opts: SlackAppManifestOptions = {}): st
             "lists:read",
             "lists:write",
             // The side panel (OPE-2457): Slack requires it for `app_context_changed`, the event whose
-            // subscription makes Slack attach the viewed room to each side-panel `message.im`.
+            // subscription makes Slack attach the viewed room to each side-panel `message.im`. It also
+            // covers `assistant.threads.setStatus`, the status line a turn shows while it works: the
+            // mention door's, and the DM seat's (OPE-2629, channels/slack-agent-session.ts).
             "assistant:write",
             // Slack requires this bot scope on an app whose people connect to Slack's MCP server
             // (OPE-2421). Declared only when the app declares "search Slack as you".

package/agent/channels/slack-agent-session.ts

@@ -21,6 +21,9 @@
 //     registers the Slack setter: it names the session from the delivery's auth attributes. The
 //     person's next message sets `processing`, then parks `active` unless it reports again that it
 //     waits on the person. A job's result wake names no session, so its turn sets no state.
+//   • THE WORKING SIGNS (OPE-2629, OPE-2632). The same setter, and the stepper, show the mention door's
+//     signs on a DM-door turn — a 1:1 DM or a group DM: 👀, the status line with its step labels, and
+//     at the end no sign, or 🛑 when the turn failed for good. See "the working signs" below.
 //   • A FORWARDED JOB's WAIT (OPE-2536). A job the DM seat forwards to the work session can end waiting
 //     on the person: it asked a question in the room (`ask_room`), or it needs their own sign-in. The
 //     work session has no `update_status`, so the host sets the session `suspended` at the job's
@@ -38,14 +41,20 @@
 import {
   cancelAnchoredTurn,
   resolvePartition,
+  swallowRoomOp,
   turnAnchorKey,
   turnChannelKey,
   type AttachSessionForCancel,
   type CancelResult,
   type SurfaceSessionPinner,
   type SurfaceSessionSetter,
+  type SurfaceSessionStatus,
+  type SurfaceSessionStepper,
+  type SurfaceTurnEnd,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { bindableForSlackIds, slackForm, type SlackEventEnvelope } from "./slack-events.js";
+import { type StepAction } from "./slack-step-label.js";
+import { setSlackStatusReaction, setSlackThreadStatus, SLACK_WORKING_STATUS, slackStepStatus, type SlackSignRequest } from "./slack-working-signs.js";
 
 /** Slack's event for a press of the session's Stop button. */
 export const AGENT_SESSION_STOPPED_EVENT = "agent_session_stopped";
@@ -159,13 +168,130 @@ export const slackSurfaceSessionPin: SurfaceSessionPinner = (attributes) => {
   };
 };
 
-/** The Slack setter core's turn-anchor hook calls (registered in register.ts). */
+// --- the working signs ------------------------------------------------------------------------------
+//
+// 🔴 THE DM DOOR's WORKING SIGNS (OPE-2629, OPE-2632). A 1:1 DM and a group DM run on the `unified`
+// channel, so none of the Slack channel's own handlers reach them: `onInbound` (the 👀), the
+// `turn.started` and `actions.requested` renderers (the status line and its step labels) and the
+// `session.failed` arm (the 🛑) serve only eve's native mention door. Core's turn-anchor hook calls
+// the setter below at a DM turn's start (`processing`), at its park (`active` or `suspended`) and at
+// `session.failed` (the park's state with `{ failed: true }`), and the stepper at each step. The signs
+// ride those calls, through the SAME functions the mention door calls (slack-working-signs.ts):
+//   • the status reaction on the message the DM door stamped (`working_signs_ts`: the message itself
+//     when top-level, its thread root for a threaded reply): 👀 at the start, none at the park, 🛑
+//     when the turn failed for good;
+//   • the status line on that root: `Working...` at the start, each step's code-owned label (or a
+//     status verb) at each step, and cleared at every end. The flat DM reply does not clear it.
+// Only a delivery the DM door stamped shows a sign: a person's 1:1 or group-DM message, and a follow-up
+// press inside a thread (on its thread root). A channel turn carries no stamp (the mention door draws
+// its own), and neither does a shortcut or a top-level press (a minted ts names no message) or a
+// forwarded job's PIN (its settlement must not clear a running turn's 👀).
+
+/** The status line a DM turn shows at its start — the mention door's own words (slack-working-signs.ts). */
+export const SLACK_DM_WORKING_STATUS = SLACK_WORKING_STATUS;
+
+/** The auth attribute the DM door stamps with the message the signs ride (slack-front.ts `scheduleDmWake`). */
+const WORKING_SIGNS_TS_ATTRIBUTE = "working_signs_ts";
+
+/**
+ * What an operator does when one sign call fails with a setup error (`SIGN_SETUP_ERRORS`). The sign
+ * needs a scope or the agent view, and both come from the app manifest, so the fix is the manifest
+ * paste. Logged once per method and error, so a workspace without the feature does not log it on
+ * every turn.
+ */
+const SIGN_SETUP_FIX: Readonly<Record<string, string>> = {
+  "reactions.add": "the 👀 and the 🛑 need the reactions:write bot scope",
+  "reactions.remove": "the 👀 and the 🛑 need the reactions:write bot scope",
+  "assistant.threads.setStatus": "the DM status line needs the assistant:write bot scope and the agent view (features.agent_view)",
+};
+/** Slack's answers that mean the app lacks a scope or a feature: a setup gap, not a passing fault. */
+const SIGN_SETUP_ERRORS = new Set(["missing_scope", "feature_disabled", "not_allowed_token_type", "not_allowed", "access_denied"]);
+/** Slack's answers that say the sign is already in the state asked for. */
+const SIGN_NO_OP_ERRORS = new Set(["already_reacted", "no_reaction"]);
+const warnedSignErrors = new Set<string>();
+
+/** The DM door's sign seam over a form call. Never throws; a failure is logged once per method and error, with the setup fix. */
+function formSignRequest(form: SlackFormCall): SlackSignRequest {
+  return async (method, params) => {
+    let error: string;
+    try {
+      const res = await form(method, new URLSearchParams({ ...params }).toString());
+      if (res?.ok === true) return;
+      error = String(res?.error ?? "no answer");
+    } catch (err) {
+      error = String(err);
+    }
+    if (SIGN_NO_OP_ERRORS.has(error)) return;
+    const key = `${method}:${error}`;
+    if (warnedSignErrors.has(key)) return;
+    warnedSignErrors.add(key);
+    const fix = SIGN_SETUP_ERRORS.has(error)
+      ? `${SIGN_SETUP_FIX[method] ?? "this sign needs a manifest scope"}. Fix: paste the app manifest again (App Manifest → Save Changes) and reinstall if Slack asks`
+      : "the sign is best-effort and the turn goes on";
+    console.warn(`[open-everywhere:slack-session] ${method} failed (${error}) — ${fix}. Logged once per process.`);
+  };
+}
+
+/** Test-only: forget which sign failures were already logged. */
+export function _resetSignWarningsForTest(): void {
+  warnedSignErrors.clear();
+}
+
+/** The message a DM-door delivery's signs ride, or undefined when the door stamped none. Pure. */
+export function slackWorkingSignsOf(attributes: Readonly<Record<string, unknown>>): { readonly channelId: string; readonly threadTs: string; readonly teamId?: string } | undefined {
+  if (attributes.channel_type !== "im" && attributes.channel_type !== "mpim") return undefined;
+  const channelId = attributes.channel_id;
+  const stamped = attributes[WORKING_SIGNS_TS_ATTRIBUTE];
+  if (typeof channelId !== "string" || channelId.length === 0 || typeof stamped !== "string" || stamped.length === 0) return undefined;
+  return { channelId, threadTs: stamped, ...(typeof attributes.team_id === "string" ? { teamId: attributes.team_id } : {}) };
+}
+
+/**
+ * Set the DM turn's signs for one state: 👀 and `Working...` at `processing`; at a settle, no
+ * reaction (or 🛑 when the turn failed) and a cleared status line. The two calls run in parallel,
+ * because the turn waits on this setter. A swallowed room op (the egress spoof) sends neither.
+ */
+async function setSlackDmWorkingSigns(root: { readonly channelId: string; readonly threadTs: string }, status: SurfaceSessionStatus, end: SurfaceTurnEnd | undefined, request: SlackSignRequest): Promise<void> {
+  const working = status === "processing";
+  if (swallowRoomOp(`a slack DM working sign (${working ? "start" : end?.failed === true ? "failed" : "end"})`)) return;
+  await Promise.all([
+    setSlackStatusReaction(request, { channel: root.channelId, timestamp: root.threadTs }, working ? "working" : end?.failed === true ? "blocked" : "none"),
+    setSlackThreadStatus(request, root, working ? SLACK_WORKING_STATUS : ""),
+  ]);
+}
+
+/**
+ * The Slack setter core's turn-anchor hook calls (registered in register.ts). It sets the agent
+ * session's state for a 1:1 DM, and the working signs for every DM-door delivery. It answers the id
+ * of the conversation it named: the agent session, else the message the signs ride.
+ */
 export function slackSurfaceSessionSetter(form: SlackFormCall = slackForm): SurfaceSessionSetter {
-  return async (attributes, status) => {
+  const request = formSignRequest(form);
+  return async (attributes, status, end) => {
     const session = slackAgentSessionOf(attributes);
-    if (!session) return undefined;
-    await setSlackSessionStatus({ ...session, status }, form);
-    return `${session.channelId}:${session.threadTs}`;
+    const signs = slackWorkingSignsOf(attributes);
+    const named = session ?? signs;
+    if (!named) return undefined;
+    await Promise.all([
+      ...(session ? [setSlackSessionStatus({ ...session, status }, form)] : []),
+      ...(signs ? [setSlackDmWorkingSigns(signs, status, end, request)] : []),
+    ]);
+    return `${named.channelId}:${named.threadTs}`;
+  };
+}
+
+/**
+ * The Slack stepper (OPE-2632): each step of a DM-door turn shows its code-owned label on the status
+ * line, or a status verb — the mention door's own `actions.requested` text (slack-working-signs.ts
+ * `slackStepStatus`). A delivery with no sign stamp shows nothing here.
+ */
+export function slackSurfaceSessionStepper(form: SlackFormCall = slackForm): SurfaceSessionStepper {
+  const request = formSignRequest(form);
+  return async (attributes, actions) => {
+    const signs = slackWorkingSignsOf(attributes);
+    if (!signs) return;
+    if (swallowRoomOp("a slack DM step label")) return;
+    await setSlackThreadStatus(request, signs, slackStepStatus(actions as readonly StepAction[], { channelId: signs.channelId, teamId: signs.teamId ?? null }));
   };
 }
 

package/agent/channels/slack-events.ts

@@ -103,6 +103,7 @@ import {
   type EngagementRow,
   type ChannelSessionRow,
   type RoomRoster,
+  type RoomShape,
   type ContextLine,
   type WakeAttachment,
   type WakeMessageInput,
@@ -120,7 +121,9 @@ import {
   slackMode,
   buildSlackAuth,
   channelFactsFromInfo,
+  imRosterFactsFromInfo,
   partnerFactsFromInfo,
+  slackUserGuestFlagged,
   appCanReadConversation,
   type ChannelFacts,
   type OpenEverywhereSlackAuth,
@@ -3530,7 +3533,7 @@ const TRANSCRIPT_TOTAL_CHARS = 4000; // whole-block cap — the wake prompt stay
 // instead of a hunt through every caller.
 //
 // 🔴 THE DEFAULT IS RESOLVED, NOT AN ENV READ (OPE-2231). It used to default to
-// `process.env.SLACK_BOT_TOKEN` in the parameter list, which a default cannot be any more: the token
+// the SLACK_BOT_TOKEN env var in the parameter list, which a default cannot be any more: the token
 // may live in the credential store, so resolving it is async. The resolution therefore moved into the
 // body. An explicitly-passed token (the multi-bot seam) still wins untouched; no caller in the tree
 // passes one today, which is why this is a default-shape change and not a behaviour change for any
@@ -3785,13 +3788,16 @@ function slackRosterFailureState(res: Record<string, unknown> | undefined): "uno
 /**
  * Live Slack roster for a governance channel's floor tripwire (OPE-110, access/audience-floor.ts).
  * Up to three Slack reads: conversations.info (is_private + externally-shared bit),
- * conversations.members (member ids) and auth.test (the bot's own user id). The roster excludes the
+ * conversations.members (member ids) and auth.test (the bot's own user id). A 1:1 DM adds a fourth,
+ * users.info on the partner, and reads neither `is_org_shared` nor `is_shared` (OPE-2630, {@link slackImRoster}). The roster excludes the
  * bot's own user id, so the agent doesn't count as a non-admin member. A failed conversations.info
  * or conversations.members read, a members list of a NON-SHARED channel longer than one page, or a
  * thrown error returns `resolved: false`, with an `unresolvedState` (OPE-2306). A transient failure
  * is `failed`: a non-ok answer outside SLACK_ROSTER_UNOBSERVABLE_ERRORS, no answer, a thrown error, a
  * conversations.info answer with no channel object. A steady state is `unobservable`: a code in that
- * set, or a non-shared members list longer than one page. A failed auth.test does not unresolve the roster: the roster stays resolved and counts the bot as a
+ * set, or a non-shared members list longer than one page. For a 1:1 DM, a failed partner users.info
+ * read also returns `resolved: false`, with the same split ({@link slackImRoster}): so a short users.info
+ * outage makes the connector-disclosure floor refuse in every 1:1 DM for up to 30 s. A failed auth.test does not unresolve the roster: the roster stays resolved and counts the bot as a
  * non-admin member, so the governance channel does not arm. `resolved: false` is closed for the
  * governance tripwire: the floor computes to `guest`, so the channel can never arm. It is
  * also closed for the clicker floor's beneficiary leg, which refuses on it (`unattested-room`). It
@@ -3803,7 +3809,8 @@ function slackRosterFailureState(res: Record<string, unknown> | undefined): "uno
  * answer for UNRESOLVED_ROSTER_TTL_MS (30 s) only, not for the full memo TTL (OPE-2150), so one
  * failed read disarms the inert legs, and refuses the connector-disclosure floor, for at most that
  * short window.
- * `hasGuest` uses the channel's externally-shared bit as the available external signal;
+ * `hasGuest` uses the channel's externally-shared bit as the available external signal (a 1:1 DM
+ * reads the Slack Connect bits and the partner's guest flags instead, {@link slackImRoster});
  * per-member guest classification rides the guest-detection work (design §2/§10 fragile-point #1) and
  * is a future tightening, not a loosening (an internal-only private channel already needs every
  * member on the roster to arm). Governance channels are small by config lint, so a single members
@@ -3834,7 +3841,7 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
       // with `hasGuest: true` and an EMPTY member list, never a partial one. The floor is `guest` for every consumer, and
       // the observed-guest legs refuse. The share bit is a steady state, so the full memo TTL is fine.
       if (facts.trustChecked === true && facts.isExternal === true) {
-        return { humanMemberIds: [], resolved: true, isPrivate: facts.isPrivate === true, hasGuest: true };
+        return { humanMemberIds: [], resolved: true, isPrivate: facts.isPrivate === true, hasGuest: true, ...slackRoomShape(facts) };
       }
       // An ok conversations.info with no channel object is an odd answer, not a steady state: it is
       // `failed`, as on the one-page path below.
@@ -3853,6 +3860,8 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
     const humanMemberIds = (members.members as unknown[])
       .filter((m): m is string => typeof m === "string")
       .filter((m) => m !== botId);
+    const im = imRosterFactsFromInfo(info);
+    if (im) return await slackImRoster(im, humanMemberIds, facts.isPrivate === true);
     return {
       humanMemberIds,
       resolved: facts.trustChecked === true, // conversations.info authoritative
@@ -3860,12 +3869,57 @@ export async function slackGovernanceRoster(channelId: string): Promise<RoomRost
       ...(facts.trustChecked === true ? {} : { unresolvedState: "failed" as const }),
       isPrivate: facts.isPrivate === true,
       hasGuest: facts.isExternal === true,
+      ...slackRoomShape(facts),
     };
   } catch {
     return { humanMemberIds: [], resolved: false, unresolvedState: "failed", isPrivate: false, hasGuest: false };
   }
 }
 
+/**
+ * The roster of a 1:1 DM (OPE-2630). A DM has two parties, the app and one person, so its audience is
+ * that person. `hasGuest` is true when Slack OBSERVES an outside party: a Slack Connect DM
+ * (`is_ext_shared` / `is_pending_ext_shared`), or a partner whose `users.info` carries a guest flag
+ * (`slackUserGuestFlagged`). `is_org_shared` and `is_shared` do not count. `is_org_shared` marks a
+ * share across the Grid's own workspaces. `is_shared` marks any share, so a Connect DM sets it too, but
+ * a Connect DM also carries the Connect bits read here. Reading the two as a guest refused every
+ * approval card in a full member's own Grid DM (`imRosterFactsFromInfo` holds the reason).
+ *
+ * The workspace rung walk (`partnerFactsFromInfo`) is NOT read here. An undeclared Grid workspace is
+ * a guest by INFERENCE (OPE-1508), not by observation, and the observed-guest legs of the floor refuse
+ * only an observation (access/audience-floor.ts, the polarity rule). Reading the walk here would
+ * floor every DM of an undeclared Grid to `guest` again.
+ *
+ * A failed `users.info` read does not resolve the roster: `failed` on a transient error, and
+ * `unobservable` on a steady one (`missing_scope`), the same split as the room reads above.
+ */
+async function slackImRoster(
+  im: { readonly partnerId?: string; readonly connectShared: boolean },
+  humanMemberIds: readonly string[],
+  isPrivate: boolean,
+): Promise<RoomRoster> {
+  if (im.connectShared) return { humanMemberIds, resolved: true, isPrivate, hasGuest: true, room: "dm" };
+  const partnerId = im.partnerId ?? (humanMemberIds.length === 1 ? humanMemberIds[0] : undefined);
+  // A DM that names no partner gives no person to ask about. The roster then rests on the Connect
+  // bits alone (read above): resolved, with no outside party observed. Before OPE-2630 a DM like this
+  // with `is_org_shared` or `is_shared` set floored to `guest`; now it does not.
+  if (partnerId === undefined) return { humanMemberIds, resolved: true, isPrivate, hasGuest: false, room: "dm" };
+  const who = await slackForm("users.info", `user=${encodeURIComponent(partnerId)}`);
+  const user = who?.ok === true ? (who.user as Record<string, unknown> | undefined) : undefined;
+  if (!user || typeof user !== "object") {
+    return { humanMemberIds: [], resolved: false, unresolvedState: who?.ok === true ? "failed" : slackRosterFailureState(who), isPrivate: false, hasGuest: false };
+  }
+  return { humanMemberIds, resolved: true, isPrivate, hasGuest: slackUserGuestFlagged(user), room: "dm" };
+}
+
+/** The roster's `room` from a `conversations.info` channel type, or nothing when Slack did not say. */
+function slackRoomShape(facts: ChannelFacts): { readonly room?: RoomShape } {
+  if (facts.channelType === "im") return { room: "dm" };
+  if (facts.channelType === "mpim") return { room: "group-dm" };
+  if (facts.channelType === "channel" || facts.channelType === "group") return { room: "channel" };
+  return {};
+}
+
 /**
  * Register {@link slackGovernanceRoster} as the governance floor-tripwire member supplier (OPE-110).
  * Core owns the seam + the fail-closed default; this is the Slack arm, wired at boot from

package/agent/channels/slack-front.ts

@@ -1114,9 +1114,9 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   // instead, so the resolver may touch the vault. It is awaited ONCE at the top of
   // `handleFrontRequest` and the VALUE is used by both readers below (the inbound verify and the
   // native forward's re-sign) — one resolution per request, and the two can never disagree about
-  // which secret this request is being held to, which is what the re-sign depends on. A deployment
-  // with `SLACK_SIGNING_SECRET` set never reaches the store (the resolver is env-first), so this is
-  // the same property read it always was for every pre-OPE-2231 deployment.
+  // which secret this request is being held to, which is what the re-sign depends on. The
+  // `SLACK_SIGNING_SECRET` operator secret comes first (OPE-2650), and its store lookup is remembered
+  // for thirty seconds, so the steady state costs no store round trip per request.
   const resolveSigningSecret = async (): Promise<string | undefined> => opts.signingSecret ?? (await slackSigningSecret());
   const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
   const stampEventVerified = opts.stampEventVerified ?? (() => stampSurfaceEventVerified("slack"));
@@ -1229,7 +1229,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
      * the SAME seam (OPE-2231: `channels/slack.ts` hands `slackChannel` a `webhookVerifier` built on
      * `setup/credentials.ts`), so there is no path on which the two can disagree about which secret
      * this request is held to. Before that wiring there WAS one — eve fell back to
-     * `process.env.SLACK_SIGNING_SECRET` while this route read the credential store — and a
+     * the SLACK_SIGNING_SECRET env var while this route read the credential store — and a
      * store-configured deployment 401'd in the inner handler after passing here.
      *
      * FAIL-SOFT TO TODAY'S BEHAVIOUR. If the body carried nothing to strip (the common path), or the
@@ -1501,6 +1501,10 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
        *  rides `authoredText` behind a `[voice clip]` marker, and a clip OE could not hear adds a
        *  host-written line, so neither is the person's typed text. */
       agentSessionTypedText?: string,
+      /** OPE-2632: the wake names a real message for the turn's working signs to ride: a `message.im`,
+       *  a `message.mpim`, a group-DM mention, or a follow-up press inside a thread (its thread root).
+       *  A shortcut and a top-level press leave it false: a minted ts names no message. */
+      showsWorkingSigns = false,
     ): Promise<void> => {
       const opensAgentSession = agentSessionTypedText !== undefined;
       // 🔴 THE TENANT FENCE, AND THIS IS ITS CHOKEPOINT FOR THE WHOLE DM FAMILY (OPE-1644). Before
@@ -1659,6 +1663,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           ...(partnerTrust ? { dmPartnerTrust: partnerTrust } : {}),
           // OPE-2519: the 1:1 message's Slack agent session — its thread, or itself when top-level.
           ...(opensAgentSession && !isGroup ? { agentSessionTs: ev.threadTs ?? ev.ts } : {}),
+          // OPE-2632: the message the turn's 👀, status line and 🛑 ride — the same root, on a 1:1 and a group DM.
+          ...(showsWorkingSigns && (ev.threadTs ?? ev.ts) ? { workingSignsTs: ev.threadTs ?? ev.ts } : {}),
           // 🔴 THE GROUP DM CARRIES THE PLATFORM'S OWN SHARING VERDICT (OPE-1486), which is what a
           // channel wake has always stamped (`authForEvent`) and an mpim wake never did. `bindSlack`
           // reads the pair through `slackTrust`, so this is the binding's only route to the fact
@@ -1980,7 +1986,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           // A voice clip is heard ONCE, before the retry wrapper, so a strand retry never pays for a second
           // transcription (OPE-2524, slack-voice-clips.ts). A DM is always addressed, so its clips are always heard.
           const heard = await hearVoice(dev);
-          await deliverWithStrandRetry(() => scheduleDmWake(heard, decision.dmKind, driverAdmitted, decision.dmKind === "im" ? dev.authoredText : undefined));
+          await deliverWithStrandRetry(() => scheduleDmWake(heard, decision.dmKind, driverAdmitted, decision.dmKind === "im" ? dev.authoredText : undefined, true));
           console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: woke — diverted to the DM window seat`);
         }),
       );
@@ -2195,7 +2201,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
             fifo.enqueue(dmFifoKey(mev.channelId), async () => {
               // A bot's group-DM mention is not heard: `scheduleDmWake` drops a bot author after this step.
               const heard = mev.botId ? mev : await hearVoice(mev);
-              await deliverWithStrandRetry(() => scheduleDmWake({ ...heard, channelType: "mpim" }, "mpim"));
+              await deliverWithStrandRetry(() => scheduleDmWake({ ...heard, channelType: "mpim" }, "mpim", false, undefined, true));
             }),
           );
           return OK();
@@ -2384,7 +2390,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // The rewrite removes the buttons and shows what the person sent. The wake takes the SAME road a
       // typed DM takes, so the seat, the trust probe, the external-participant policy and the spend
       // gate all decide it. The agent session is touched only when the answer sits in a thread: a
-      // top-level answer has no session thread for a minted ts to name.
+      // top-level answer has no session thread for a minted ts to name. The working signs (OPE-2632)
+      // follow the same rule: a threaded press shows them on its thread root, a real message.
       args.waitUntil(
         markFollowUpPressed(click)
           .then((rewritten) => {
@@ -2394,7 +2401,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       );
       args.waitUntil(
         fifo.enqueue(dmFifoKey(click.channelId), async () => {
-          await deliverWithStrandRetry(() => scheduleDmWake(sev, "im", false, click.threadTs === undefined ? undefined : click.text));
+          await deliverWithStrandRetry(() => scheduleDmWake(sev, "im", false, click.threadTs === undefined ? undefined : click.text, click.threadTs !== undefined));
           console.log(`[open-everywhere:slack-front] follow-up press in ${click.channelId}: woke the DM window`);
         }),
       );

package/agent/channels/slack-identity.ts

@@ -62,6 +62,13 @@ export interface SlackIdentityInput {
    * reply still reads `thread_ts`.
    */
   readonly agentSessionTs?: string;
+  /**
+   * For a DM-family message (a 1:1 or a group DM) the person sent (OPE-2632): the message the turn's
+   * working signs ride — its `thread_ts`, or its own `ts` when top-level, the root the mention door's
+   * 👀 uses too. channels/slack-agent-session.ts reads it. A shortcut stamps none: its ts names no
+   * message. It changes no reply target.
+   */
+  readonly workingSignsTs?: string;
 }
 
 /** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
@@ -79,6 +86,7 @@ export function buildSlackAuth(input: SlackIdentityInput): OpenEverywhereSlackAu
   if (typeof input.trustChecked === "boolean") attributes.trust_checked = String(input.trustChecked);
   if (input.dmPartnerTrust) attributes.dm_partner_trust = input.dmPartnerTrust;
   if (input.agentSessionTs) attributes.agent_session_ts = input.agentSessionTs;
+  if (input.workingSignsTs) attributes.working_signs_ts = input.workingSignsTs;
   // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 DM OR an mpim (group
   // DM) is a STANDING seat ⇒ narrowed hands — both are closed multi-party conversations with no
   // channel identity. A DM is unambiguously channelType "im" (the DM path always sets it); the
@@ -265,7 +273,7 @@ function slackWorkspaceVouched(teamId: string | undefined, enterpriseId: string
 export function partnerFactsFromInfo(info: unknown, expectedTeamId?: string): { dmPartnerTrust: "internal" | "external" } {
   const u = (info as { user?: Record<string, unknown> } | null)?.user;
   if (!u || typeof u !== "object") return { dmPartnerTrust: "external" }; // lookup failed → fail closed
-  const guestOrStranger = Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+  const guestOrStranger = slackUserGuestFlagged(u);
   const deleted = Boolean(u["deleted"]);
   const homeTeamId = typeof u["team_id"] === "string" ? (u["team_id"] as string) : undefined;
   // 🔴 NO EXPECTED WORKSPACE IS NOT AN OWN-WORKSPACE ANSWER. This used to read the absence as
@@ -288,6 +296,39 @@ export function partnerFactsFromInfo(info: unknown, expectedTeamId?: string): {
   return { dmPartnerTrust: internal ? "internal" : "external" };
 }
 
+/** Slack's own guest flags on a `users.info` user object: a multi-channel guest (`is_restricted`), a
+ *  single-channel guest (`is_ultra_restricted`) or a Slack Connect stranger (`is_stranger`). The ONE
+ *  reader of these three flags, so {@link partnerFactsFromInfo} and the 1:1 DM roster
+ *  ({@link imRosterFactsFromInfo}) cannot disagree on what Slack calls a guest. It reads no workspace
+ *  and no declaration: it is what Slack OBSERVED about the person, nothing inferred. */
+export function slackUserGuestFlagged(u: Record<string, unknown>): boolean {
+  return Boolean(u["is_restricted"] || u["is_ultra_restricted"] || u["is_stranger"]);
+}
+
+/**
+ * The room facts of a 1:1 DM (`is_im`) from a `conversations.info` response, or `undefined` for any
+ * other conversation (OPE-2630). The DM roster reads these instead of
+ * {@link ChannelFacts.isExternal}.
+ *
+ * 🔴 WHY A DM DOES NOT READ `isExternal`. `isExternal` is true on ANY of the four share bits.
+ * `is_org_shared` marks a share across the workspaces of ONE Enterprise Grid organisation. `is_shared`
+ * marks ANY share, a Slack Connect one included, so it alone does not tell a Grid share from a Connect
+ * one. A Connect DM also carries `is_ext_shared` (or `is_pending_ext_shared`), and this function reads
+ * those two bits. A 1:1 DM has exactly two parties, the app and one person, so `is_org_shared` or `is_shared` on it
+ * says nothing about an outside audience. Read as "external", they floored a full member's own DM to
+ * `guest`, and the card-disclosure floor refused every approval card there (OPE-2630, a Grid install).
+ * So a DM's audience is judged by the two facts that do name an outside party: the Slack Connect bits
+ * (`is_ext_shared`, `is_pending_ext_shared`) here, and the partner's own guest flags
+ * ({@link slackUserGuestFlagged}), which the roster reads with `users.info`.
+ */
+export function imRosterFactsFromInfo(info: unknown): { readonly partnerId?: string; readonly connectShared: boolean } | undefined {
+  const ch = (info as { channel?: Record<string, unknown> } | null)?.channel;
+  if (!ch || typeof ch !== "object" || ch["is_im"] !== true) return undefined;
+  const partnerId = typeof ch["user"] === "string" && ch["user"].length > 0 ? (ch["user"] as string) : undefined;
+  const connectShared = Boolean(ch["is_ext_shared"] || ch["is_pending_ext_shared"]);
+  return { ...(partnerId === undefined ? {} : { partnerId }), connectShared };
+}
+
 /** What an app_mention envelope tells us directly (often just channel_type). */
 export function channelFactsFromRaw(raw: Record<string, unknown>): ChannelFacts {
   const channelType = typeof raw["channel_type"] === "string" ? (raw["channel_type"] as string) : undefined;

package/agent/channels/slack-web-api.ts

@@ -24,7 +24,7 @@
 //     so form is the only safe default. A null or undefined value is dropped; a string, number or
 //     boolean is stringified; anything else is JSON-encoded.
 //   • Token resolution. An explicit token wins, otherwise the deployment's resolved bot token
-//     (`SLACK_BOT_TOKEN`, then the credential store — OPE-2231). Neither ⇒ throw
+//     (the `SLACK_BOT_TOKEN` operator secret, then the `/setup` value — OPE-2231, OPE-2650). Neither ⇒ throw
 //     `SLACK_BOT_TOKEN is required.` — the same message and the same fail-loud posture. ONE
 //     DELIBERATE NARROWING: eve's `SlackBotToken` also accepts a function (the secret-manager and
 //     rotation form). No caller in this repo passes one, so this seam takes a string. Widening it
@@ -137,8 +137,8 @@ const PROBE_CAP_MS = 2_000;
  *
  * 🔴 ASYNC SINCE OPE-2231, and the awaits are the whole change at the call site. The token used to be
  * a property read; it can now come from the encrypted vault, because `/setup` captures it there. The
- * resolver memoises a store hit per process, and a deployment with `SLACK_BOT_TOKEN` set never
- * reaches the store at all, so the hot path for every pre-OPE-2231 deployment is unchanged.
+ * resolver remembers each store lookup for thirty seconds (the `SLACK_BOT_TOKEN` operator secret and
+ * the `/setup` value alike, OPE-2650), so the steady state costs no store round trip per call.
  */
 async function resolveBotToken(botToken: string | undefined): Promise<string> {
   const token = botToken ?? (await slackBotToken());

package/agent/channels/slack-working-signs.ts

@@ -0,0 +1,71 @@
+// THE WORKING SIGNS (OPE-2632) — the ONE implementation of what a person sees while the bot works.
+//
+// Two doors start a Slack turn, and before OPE-2632 each drew the signs its own way:
+//   • the MENTION DOOR (slack.ts): eve's Slack channel, for a mention in a channel or a thread;
+//   • the DM DOOR (slack-agent-session.ts): a 1:1 DM or a group DM, diverted to the DM seat on the
+//     `unified` channel, where the Slack channel's own handlers never run. Core's turn-anchor hook
+//     drives its signs through the Slack setter and stepper instead.
+// Both now call the functions in this file, so a person sees the same signs at either door:
+//   • ONE status reaction on the message: 👀 while the turn works, 🛑 when it fails, and none when it
+//     ends (absence is the done signal; ✅ stays reserved for people). See `setSlackStatusReaction`.
+//   • the LIVE STATUS LINE (`assistant.threads.setStatus`): `Working...` at the start, then each step's
+//     code-owned label ("Searching Notion…", slack-step-label.ts) or a status verb, and cleared at
+//     the end. See `slackStepStatus` and `setSlackThreadStatus`.
+// The transport differs (eve's `slack.request` and `startTyping` at the mention door, the host's
+// `slackForm` at the DM door), so each function takes a request seam that never throws.
+
+import { getConfig, resolvePartition, STATUS_REACTION, statusVerbsFor, swallowRoomOp, type ReactionState } from "@open-everywhere/core/agent/adapter-api.js";
+import { stepStatusFor, type StepAction } from "./slack-step-label.js";
+
+/** One Slack Web API call for a sign. It must never throw: a sign is best-effort and never fails a turn. */
+export type SlackSignRequest = (method: string, params: Readonly<Record<string, string>>) => Promise<void>;
+
+/** The status line at a turn's start, at both doors. */
+export const SLACK_WORKING_STATUS = "Working...";
+
+/**
+ * Set the ONE status reaction on a message: add `state`'s emoji and remove every other status emoji.
+ * `"none"` removes them all. The calls run in parallel, because a DM turn waits on this. A swallowed
+ * room op (the egress spoof, core channels/egress-spoof.ts) sends nothing.
+ */
+export async function setSlackStatusReaction(request: SlackSignRequest, target: { readonly channel: string; readonly timestamp: string }, state: ReactionState | "none"): Promise<void> {
+  if (swallowRoomOp("a slack status reaction")) return;
+  await Promise.all(
+    Object.entries(STATUS_REACTION).map(([s, name]) => request(s === state ? "reactions.add" : "reactions.remove", { channel: target.channel, name, timestamp: target.timestamp })),
+  );
+}
+
+/** Set the live status line on a thread. An empty `status` clears it. */
+export async function setSlackThreadStatus(request: SlackSignRequest, target: { readonly channelId: string; readonly threadTs: string }, status: string): Promise<void> {
+  await request("assistant.threads.setStatus", { channel_id: target.channelId, thread_ts: target.threadTs, status });
+}
+
+// --- status verbs (the fun bit) ----------------------------------------------
+// "Tinkering…" / "Untangling…" instead of a flat "Thinking…"/"Working…" — a random
+// pick per status update from the channel's effective vocabulary (framework defaults
+// ← org ← role ← domain, extend-or-replace; memory/domain.ts statusVerbsFor — a
+// domain's ROLE preset contributes its themed verbs as its own rung). Orgs add house
+// verbs, a team adds its in-jokes. Cosmetic only, so ANY failure falls back to a
+// plain verb — the status line must never take a turn down.
+export function slackStatusVerb(state: { channelId?: string | null; teamId?: string | null }): string {
+  try {
+    const p = resolvePartition({
+      channel: { kind: "slack" },
+      session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+    });
+    const cfg = getConfig();
+    const verbs = statusVerbsFor(p.surfaceKey, cfg.loadDomains(), cfg.loadRoles?.() ?? []);
+    return `${verbs[Math.floor(Math.random() * verbs.length)]}…`;
+  } catch {
+    return "Working…";
+  }
+}
+
+/**
+ * The status line for one step: the first labelled action's code-owned label (OPE-2449), else a
+ * status verb. Never the model's own text: slack-step-label.ts reads only the tool's name and, for a
+ * connector, the vendor through its own table. `actions` undefined (a reasoning refresh) shows a verb.
+ */
+export function slackStepStatus(actions: readonly StepAction[] | undefined, state: { channelId?: string | null; teamId?: string | null }): string {
+  return stepStatusFor(actions) ?? slackStatusVerb(state);
+}