@open-everywhere/provider-slack 0.8.1 → 0.9.0

package/agent/channels/slack-agent-session.ts

@@ -21,8 +21,9 @@
 //     registers the Slack setter: it names the session from the delivery's auth attributes. The
 //     person's next message sets `processing`, then parks `active` unless it reports again that it
 //     waits on the person. A job's result wake names no session, so its turn sets no state.
-//   • THE WORKING SIGNS (OPE-2629). The same setter shows the 👀 and the status line on the session's
-//     root while a turn works, and clears both at the park. See `setSlackDmWorkingSigns`.
+//   • THE WORKING SIGNS (OPE-2629, OPE-2632). The same setter, and the stepper, show the mention door's
+//     signs on a DM-door turn — a 1:1 DM or a group DM: 👀, the status line with its step labels, and
+//     at the end no sign, or 🛑 when the turn failed for good. See "the working signs" below.
 //   • A FORWARDED JOB's WAIT (OPE-2536). A job the DM seat forwards to the work session can end waiting
 //     on the person: it asked a question in the room (`ask_room`), or it needs their own sign-in. The
 //     work session has no `update_status`, so the host sets the session `suspended` at the job's
@@ -40,7 +41,6 @@
 import {
   cancelAnchoredTurn,
   resolvePartition,
-  STATUS_REACTION,
   swallowRoomOp,
   turnAnchorKey,
   turnChannelKey,
@@ -48,8 +48,13 @@ import {
   type CancelResult,
   type SurfaceSessionPinner,
   type SurfaceSessionSetter,
+  type SurfaceSessionStatus,
+  type SurfaceSessionStepper,
+  type SurfaceTurnEnd,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { bindableForSlackIds, slackForm, type SlackEventEnvelope } from "./slack-events.js";
+import { type StepAction } from "./slack-step-label.js";
+import { setSlackStatusReaction, setSlackThreadStatus, SLACK_WORKING_STATUS, slackStepStatus, type SlackSignRequest } from "./slack-working-signs.js";
 
 /** Slack's event for a press of the session's Stop button. */
 export const AGENT_SESSION_STOPPED_EVENT = "agent_session_stopped";
@@ -63,13 +68,6 @@ export type SlackSessionStatus = "processing" | "active" | "suspended";
 /** The auth attribute the DM door stamps with the session's thread root (slack-front.ts `scheduleDmWake`). */
 const AGENT_SESSION_TS_ATTRIBUTE = "agent_session_ts";
 
-/**
- * The mark a PINNED bag carries (OPE-2629). A forwarded job's settlement sets the session's state from
- * its pin, not from a turn, so the setter must not touch the turn's working signs for it: a turn of the
- * same session can be running at that moment, and its 👀 must stay until its own park.
- */
-const SESSION_PIN_ATTRIBUTE = "oe_session_pin";
-
 /** The form-call seam: `slackForm` in production, a recorder in the tests. */
 export type SlackFormCall = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
 
@@ -166,32 +164,34 @@ export const slackSurfaceSessionPin: SurfaceSessionPinner = (attributes) => {
   if (!session) return undefined;
   return {
     id: `${session.channelId}:${session.threadTs}`,
-    attributes: { channel_id: session.channelId, channel_type: "im", [AGENT_SESSION_TS_ATTRIBUTE]: session.threadTs, [SESSION_PIN_ATTRIBUTE]: "1" },
+    attributes: { channel_id: session.channelId, channel_type: "im", [AGENT_SESSION_TS_ATTRIBUTE]: session.threadTs },
   };
 };
 
 // --- the working signs ------------------------------------------------------------------------------
 //
-// 🔴 THE DM SEAT'S 👀 AND STATUS LINE LIVE HERE (OPE-2629). A 1:1 DM runs on the `unified` channel, so
-// none of the Slack channel's own handlers reach it: `onInbound` (the 👀) and the `turn.started`
-// renderer (the status line) serve only eve's native mention door. Before this, a person who DMed
-// the app saw neither during the turn. Core's turn-anchor hook calls this setter at every DM turn's
-// start (`processing`) and park (`active` or `suspended`), so the signs ride the same two calls:
-//   • 👀 on the session's thread root — the message itself when it is top-level, the same root the
-//     mention door's 👀 uses for a threaded one. Added at `processing`, removed at the park.
-//   • Slack's assistant status (`assistant.threads.setStatus`) on that root: `Working...` at
-//     `processing`, cleared at the park. The flat DM reply does not clear it, so the park must.
-// A forwarded job's settlement (OPE-2536) also calls this setter, from the job's PIN. A turn of the
-// same session can run at that moment, so a pinned bag (`SESSION_PIN_ATTRIBUTE`) moves the session
-// state only and leaves the signs to the turn's own park.
-// A turn that fails for good emits `session.failed` and never parks, so its signs stay: the 👀 until
-// the session's next turn parks, and the status line until Slack expires it.
+// 🔴 THE DM DOOR's WORKING SIGNS (OPE-2629, OPE-2632). A 1:1 DM and a group DM run on the `unified`
+// channel, so none of the Slack channel's own handlers reach them: `onInbound` (the 👀), the
+// `turn.started` and `actions.requested` renderers (the status line and its step labels) and the
+// `session.failed` arm (the 🛑) serve only eve's native mention door. Core's turn-anchor hook calls
+// the setter below at a DM turn's start (`processing`), at its park (`active` or `suspended`) and at
+// `session.failed` (the park's state with `{ failed: true }`), and the stepper at each step. The signs
+// ride those calls, through the SAME functions the mention door calls (slack-working-signs.ts):
+//   • the status reaction on the message the DM door stamped (`working_signs_ts`: the message itself
+//     when top-level, its thread root for a threaded reply): 👀 at the start, none at the park, 🛑
+//     when the turn failed for good;
+//   • the status line on that root: `Working...` at the start, each step's code-owned label (or a
+//     status verb) at each step, and cleared at every end. The flat DM reply does not clear it.
+// Only a delivery the DM door stamped shows a sign: a person's 1:1 or group-DM message, and a follow-up
+// press inside a thread (on its thread root). A channel turn carries no stamp (the mention door draws
+// its own), and neither does a shortcut or a top-level press (a minted ts names no message) or a
+// forwarded job's PIN (its settlement must not clear a running turn's 👀).
 
-/** The status line a DM turn shows while it works — the same words the mention door's `turn.started` shows. */
-export const SLACK_DM_WORKING_STATUS = "Working...";
+/** The status line a DM turn shows at its start — the mention door's own words (slack-working-signs.ts). */
+export const SLACK_DM_WORKING_STATUS = SLACK_WORKING_STATUS;
 
-/** The 👀 the bot sets while it works (core status/status.ts `STATUS_REACTION.working`). */
-const WORKING_REACTION = STATUS_REACTION.working;
+/** The auth attribute the DM door stamps with the message the signs ride (slack-front.ts `scheduleDmWake`). */
+const WORKING_SIGNS_TS_ATTRIBUTE = "working_signs_ts";
 
 /**
  * What an operator does when one sign call fails with a setup error (`SIGN_SETUP_ERRORS`). The sign
@@ -200,8 +200,8 @@ const WORKING_REACTION = STATUS_REACTION.working;
  * every turn.
  */
 const SIGN_SETUP_FIX: Readonly<Record<string, string>> = {
-  "reactions.add": "the 👀 needs the reactions:write bot scope",
-  "reactions.remove": "the 👀 needs the reactions:write bot scope",
+  "reactions.add": "the 👀 and the 🛑 need the reactions:write bot scope",
+  "reactions.remove": "the 👀 and the 🛑 need the reactions:write bot scope",
   "assistant.threads.setStatus": "the DM status line needs the assistant:write bot scope and the agent view (features.agent_view)",
 };
 /** Slack's answers that mean the app lacks a scope or a feature: a setup gap, not a passing fault. */
@@ -210,24 +210,26 @@ const SIGN_SETUP_ERRORS = new Set(["missing_scope", "feature_disabled", "not_all
 const SIGN_NO_OP_ERRORS = new Set(["already_reacted", "no_reaction"]);
 const warnedSignErrors = new Set<string>();
 
-/** One sign call. Never throws; a failure is logged once per method and error, with the setup fix. */
-async function sendSign(form: SlackFormCall, method: string, body: URLSearchParams): Promise<void> {
-  let error: string;
-  try {
-    const res = await form(method, body.toString());
-    if (res?.ok === true) return;
-    error = String(res?.error ?? "no answer");
-  } catch (err) {
-    error = String(err);
-  }
-  if (SIGN_NO_OP_ERRORS.has(error)) return;
-  const key = `${method}:${error}`;
-  if (warnedSignErrors.has(key)) return;
-  warnedSignErrors.add(key);
-  const fix = SIGN_SETUP_ERRORS.has(error)
-    ? `${SIGN_SETUP_FIX[method] ?? "this sign needs a manifest scope"}. Fix: paste the app manifest again (App Manifest → Save Changes) and reinstall if Slack asks`
-    : "the sign is best-effort and the turn goes on";
-  console.warn(`[open-everywhere:slack-session] ${method} failed (${error}) — ${fix}. Logged once per process.`);
+/** The DM door's sign seam over a form call. Never throws; a failure is logged once per method and error, with the setup fix. */
+function formSignRequest(form: SlackFormCall): SlackSignRequest {
+  return async (method, params) => {
+    let error: string;
+    try {
+      const res = await form(method, new URLSearchParams({ ...params }).toString());
+      if (res?.ok === true) return;
+      error = String(res?.error ?? "no answer");
+    } catch (err) {
+      error = String(err);
+    }
+    if (SIGN_NO_OP_ERRORS.has(error)) return;
+    const key = `${method}:${error}`;
+    if (warnedSignErrors.has(key)) return;
+    warnedSignErrors.add(key);
+    const fix = SIGN_SETUP_ERRORS.has(error)
+      ? `${SIGN_SETUP_FIX[method] ?? "this sign needs a manifest scope"}. Fix: paste the app manifest again (App Manifest → Save Changes) and reinstall if Slack asks`
+      : "the sign is best-effort and the turn goes on";
+    console.warn(`[open-everywhere:slack-session] ${method} failed (${error}) — ${fix}. Logged once per process.`);
+  };
 }
 
 /** Test-only: forget which sign failures were already logged. */
@@ -235,26 +237,61 @@ export function _resetSignWarningsForTest(): void {
   warnedSignErrors.clear();
 }
 
+/** The message a DM-door delivery's signs ride, or undefined when the door stamped none. Pure. */
+export function slackWorkingSignsOf(attributes: Readonly<Record<string, unknown>>): { readonly channelId: string; readonly threadTs: string; readonly teamId?: string } | undefined {
+  if (attributes.channel_type !== "im" && attributes.channel_type !== "mpim") return undefined;
+  const channelId = attributes.channel_id;
+  const stamped = attributes[WORKING_SIGNS_TS_ATTRIBUTE];
+  if (typeof channelId !== "string" || channelId.length === 0 || typeof stamped !== "string" || stamped.length === 0) return undefined;
+  return { channelId, threadTs: stamped, ...(typeof attributes.team_id === "string" ? { teamId: attributes.team_id } : {}) };
+}
+
 /**
- * Show or clear the DM turn's working signs on the session's root: the 👀 and the status line. The
- * two calls run in parallel, because the turn waits on this setter. A swallowed room op (the egress
- * spoof) sends neither. Never throws.
+ * Set the DM turn's signs for one state: 👀 and `Working...` at `processing`; at a settle, no
+ * reaction (or 🛑 when the turn failed) and a cleared status line. The two calls run in parallel,
+ * because the turn waits on this setter. A swallowed room op (the egress spoof) sends neither.
  */
-async function setSlackDmWorkingSigns(session: { readonly channelId: string; readonly threadTs: string }, working: boolean, form: SlackFormCall = slackForm): Promise<void> {
-  if (swallowRoomOp(`a slack DM working sign ${working ? "add" : "remove"}`)) return;
-  const reaction = new URLSearchParams({ channel: session.channelId, name: WORKING_REACTION, timestamp: session.threadTs });
-  const status = new URLSearchParams({ channel_id: session.channelId, thread_ts: session.threadTs, status: working ? SLACK_DM_WORKING_STATUS : "" });
-  await Promise.all([sendSign(form, working ? "reactions.add" : "reactions.remove", reaction), sendSign(form, "assistant.threads.setStatus", status)]);
+async function setSlackDmWorkingSigns(root: { readonly channelId: string; readonly threadTs: string }, status: SurfaceSessionStatus, end: SurfaceTurnEnd | undefined, request: SlackSignRequest): Promise<void> {
+  const working = status === "processing";
+  if (swallowRoomOp(`a slack DM working sign (${working ? "start" : end?.failed === true ? "failed" : "end"})`)) return;
+  await Promise.all([
+    setSlackStatusReaction(request, { channel: root.channelId, timestamp: root.threadTs }, working ? "working" : end?.failed === true ? "blocked" : "none"),
+    setSlackThreadStatus(request, root, working ? SLACK_WORKING_STATUS : ""),
+  ]);
 }
 
-/** The Slack setter core's turn-anchor hook calls (registered in register.ts). */
+/**
+ * The Slack setter core's turn-anchor hook calls (registered in register.ts). It sets the agent
+ * session's state for a 1:1 DM, and the working signs for every DM-door delivery. It answers the id
+ * of the conversation it named: the agent session, else the message the signs ride.
+ */
 export function slackSurfaceSessionSetter(form: SlackFormCall = slackForm): SurfaceSessionSetter {
-  return async (attributes, status) => {
+  const request = formSignRequest(form);
+  return async (attributes, status, end) => {
     const session = slackAgentSessionOf(attributes);
-    if (!session) return undefined;
-    const fromTurn = attributes[SESSION_PIN_ATTRIBUTE] === undefined;
-    await Promise.all([setSlackSessionStatus({ ...session, status }, form), ...(fromTurn ? [setSlackDmWorkingSigns(session, status === "processing", form)] : [])]);
-    return `${session.channelId}:${session.threadTs}`;
+    const signs = slackWorkingSignsOf(attributes);
+    const named = session ?? signs;
+    if (!named) return undefined;
+    await Promise.all([
+      ...(session ? [setSlackSessionStatus({ ...session, status }, form)] : []),
+      ...(signs ? [setSlackDmWorkingSigns(signs, status, end, request)] : []),
+    ]);
+    return `${named.channelId}:${named.threadTs}`;
+  };
+}
+
+/**
+ * The Slack stepper (OPE-2632): each step of a DM-door turn shows its code-owned label on the status
+ * line, or a status verb — the mention door's own `actions.requested` text (slack-working-signs.ts
+ * `slackStepStatus`). A delivery with no sign stamp shows nothing here.
+ */
+export function slackSurfaceSessionStepper(form: SlackFormCall = slackForm): SurfaceSessionStepper {
+  const request = formSignRequest(form);
+  return async (attributes, actions) => {
+    const signs = slackWorkingSignsOf(attributes);
+    if (!signs) return;
+    if (swallowRoomOp("a slack DM step label")) return;
+    await setSlackThreadStatus(request, signs, slackStepStatus(actions as readonly StepAction[], { channelId: signs.channelId, teamId: signs.teamId ?? null }));
   };
 }
 

package/agent/channels/slack-events.ts

@@ -3533,7 +3533,7 @@ const TRANSCRIPT_TOTAL_CHARS = 4000; // whole-block cap — the wake prompt stay
 // instead of a hunt through every caller.
 //
 // 🔴 THE DEFAULT IS RESOLVED, NOT AN ENV READ (OPE-2231). It used to default to
-// `process.env.SLACK_BOT_TOKEN` in the parameter list, which a default cannot be any more: the token
+// the SLACK_BOT_TOKEN env var in the parameter list, which a default cannot be any more: the token
 // may live in the credential store, so resolving it is async. The resolution therefore moved into the
 // body. An explicitly-passed token (the multi-bot seam) still wins untouched; no caller in the tree
 // passes one today, which is why this is a default-shape change and not a behaviour change for any

package/agent/channels/slack-front.ts

@@ -1114,9 +1114,9 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
   // instead, so the resolver may touch the vault. It is awaited ONCE at the top of
   // `handleFrontRequest` and the VALUE is used by both readers below (the inbound verify and the
   // native forward's re-sign) — one resolution per request, and the two can never disagree about
-  // which secret this request is being held to, which is what the re-sign depends on. A deployment
-  // with `SLACK_SIGNING_SECRET` set never reaches the store (the resolver is env-first), so this is
-  // the same property read it always was for every pre-OPE-2231 deployment.
+  // which secret this request is being held to, which is what the re-sign depends on. The
+  // `SLACK_SIGNING_SECRET` operator secret comes first (OPE-2650), and its store lookup is remembered
+  // for thirty seconds, so the steady state costs no store round trip per request.
   const resolveSigningSecret = async (): Promise<string | undefined> => opts.signingSecret ?? (await slackSigningSecret());
   const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
   const stampEventVerified = opts.stampEventVerified ?? (() => stampSurfaceEventVerified("slack"));
@@ -1229,7 +1229,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
      * the SAME seam (OPE-2231: `channels/slack.ts` hands `slackChannel` a `webhookVerifier` built on
      * `setup/credentials.ts`), so there is no path on which the two can disagree about which secret
      * this request is held to. Before that wiring there WAS one — eve fell back to
-     * `process.env.SLACK_SIGNING_SECRET` while this route read the credential store — and a
+     * the SLACK_SIGNING_SECRET env var while this route read the credential store — and a
      * store-configured deployment 401'd in the inner handler after passing here.
      *
      * FAIL-SOFT TO TODAY'S BEHAVIOUR. If the body carried nothing to strip (the common path), or the
@@ -1501,6 +1501,10 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
        *  rides `authoredText` behind a `[voice clip]` marker, and a clip OE could not hear adds a
        *  host-written line, so neither is the person's typed text. */
       agentSessionTypedText?: string,
+      /** OPE-2632: the wake names a real message for the turn's working signs to ride: a `message.im`,
+       *  a `message.mpim`, a group-DM mention, or a follow-up press inside a thread (its thread root).
+       *  A shortcut and a top-level press leave it false: a minted ts names no message. */
+      showsWorkingSigns = false,
     ): Promise<void> => {
       const opensAgentSession = agentSessionTypedText !== undefined;
       // 🔴 THE TENANT FENCE, AND THIS IS ITS CHOKEPOINT FOR THE WHOLE DM FAMILY (OPE-1644). Before
@@ -1659,6 +1663,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           ...(partnerTrust ? { dmPartnerTrust: partnerTrust } : {}),
           // OPE-2519: the 1:1 message's Slack agent session — its thread, or itself when top-level.
           ...(opensAgentSession && !isGroup ? { agentSessionTs: ev.threadTs ?? ev.ts } : {}),
+          // OPE-2632: the message the turn's 👀, status line and 🛑 ride — the same root, on a 1:1 and a group DM.
+          ...(showsWorkingSigns && (ev.threadTs ?? ev.ts) ? { workingSignsTs: ev.threadTs ?? ev.ts } : {}),
           // 🔴 THE GROUP DM CARRIES THE PLATFORM'S OWN SHARING VERDICT (OPE-1486), which is what a
           // channel wake has always stamped (`authForEvent`) and an mpim wake never did. `bindSlack`
           // reads the pair through `slackTrust`, so this is the binding's only route to the fact
@@ -1980,7 +1986,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
           // A voice clip is heard ONCE, before the retry wrapper, so a strand retry never pays for a second
           // transcription (OPE-2524, slack-voice-clips.ts). A DM is always addressed, so its clips are always heard.
           const heard = await hearVoice(dev);
-          await deliverWithStrandRetry(() => scheduleDmWake(heard, decision.dmKind, driverAdmitted, decision.dmKind === "im" ? dev.authoredText : undefined));
+          await deliverWithStrandRetry(() => scheduleDmWake(heard, decision.dmKind, driverAdmitted, decision.dmKind === "im" ? dev.authoredText : undefined, true));
           console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: woke — diverted to the DM window seat`);
         }),
       );
@@ -2195,7 +2201,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
             fifo.enqueue(dmFifoKey(mev.channelId), async () => {
               // A bot's group-DM mention is not heard: `scheduleDmWake` drops a bot author after this step.
               const heard = mev.botId ? mev : await hearVoice(mev);
-              await deliverWithStrandRetry(() => scheduleDmWake({ ...heard, channelType: "mpim" }, "mpim"));
+              await deliverWithStrandRetry(() => scheduleDmWake({ ...heard, channelType: "mpim" }, "mpim", false, undefined, true));
             }),
           );
           return OK();
@@ -2384,7 +2390,8 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       // The rewrite removes the buttons and shows what the person sent. The wake takes the SAME road a
       // typed DM takes, so the seat, the trust probe, the external-participant policy and the spend
       // gate all decide it. The agent session is touched only when the answer sits in a thread: a
-      // top-level answer has no session thread for a minted ts to name.
+      // top-level answer has no session thread for a minted ts to name. The working signs (OPE-2632)
+      // follow the same rule: a threaded press shows them on its thread root, a real message.
       args.waitUntil(
         markFollowUpPressed(click)
           .then((rewritten) => {
@@ -2394,7 +2401,7 @@ export function buildFrontHandler(innerHandler: RouteHandler, opts: FrontOptions
       );
       args.waitUntil(
         fifo.enqueue(dmFifoKey(click.channelId), async () => {
-          await deliverWithStrandRetry(() => scheduleDmWake(sev, "im", false, click.threadTs === undefined ? undefined : click.text));
+          await deliverWithStrandRetry(() => scheduleDmWake(sev, "im", false, click.threadTs === undefined ? undefined : click.text, click.threadTs !== undefined));
           console.log(`[open-everywhere:slack-front] follow-up press in ${click.channelId}: woke the DM window`);
         }),
       );

package/agent/channels/slack-identity.ts

@@ -62,6 +62,13 @@ export interface SlackIdentityInput {
    * reply still reads `thread_ts`.
    */
   readonly agentSessionTs?: string;
+  /**
+   * For a DM-family message (a 1:1 or a group DM) the person sent (OPE-2632): the message the turn's
+   * working signs ride — its `thread_ts`, or its own `ts` when top-level, the root the mention door's
+   * 👀 uses too. channels/slack-agent-session.ts reads it. A shortcut stamps none: its ts names no
+   * message. It changes no reply target.
+   */
+  readonly workingSignsTs?: string;
 }
 
 /** Build the auth context OpenEverywhere dispatches with — raw facts as string attributes. */
@@ -79,6 +86,7 @@ export function buildSlackAuth(input: SlackIdentityInput): OpenEverywhereSlackAu
   if (typeof input.trustChecked === "boolean") attributes.trust_checked = String(input.trustChecked);
   if (input.dmPartnerTrust) attributes.dm_partner_trust = input.dmPartnerTrust;
   if (input.agentSessionTs) attributes.agent_session_ts = input.agentSessionTs;
+  if (input.workingSignsTs) attributes.working_signs_ts = input.workingSignsTs;
   // Root-DM grain stamp (window-tool-gating §D-DM, widened to group DMs): a 1:1 DM OR an mpim (group
   // DM) is a STANDING seat ⇒ narrowed hands — both are closed multi-party conversations with no
   // channel identity. A DM is unambiguously channelType "im" (the DM path always sets it); the

package/agent/channels/slack-web-api.ts

@@ -24,7 +24,7 @@
 //     so form is the only safe default. A null or undefined value is dropped; a string, number or
 //     boolean is stringified; anything else is JSON-encoded.
 //   • Token resolution. An explicit token wins, otherwise the deployment's resolved bot token
-//     (`SLACK_BOT_TOKEN`, then the credential store — OPE-2231). Neither ⇒ throw
+//     (the `SLACK_BOT_TOKEN` operator secret, then the `/setup` value — OPE-2231, OPE-2650). Neither ⇒ throw
 //     `SLACK_BOT_TOKEN is required.` — the same message and the same fail-loud posture. ONE
 //     DELIBERATE NARROWING: eve's `SlackBotToken` also accepts a function (the secret-manager and
 //     rotation form). No caller in this repo passes one, so this seam takes a string. Widening it
@@ -137,8 +137,8 @@ const PROBE_CAP_MS = 2_000;
  *
  * 🔴 ASYNC SINCE OPE-2231, and the awaits are the whole change at the call site. The token used to be
  * a property read; it can now come from the encrypted vault, because `/setup` captures it there. The
- * resolver memoises a store hit per process, and a deployment with `SLACK_BOT_TOKEN` set never
- * reaches the store at all, so the hot path for every pre-OPE-2231 deployment is unchanged.
+ * resolver remembers each store lookup for thirty seconds (the `SLACK_BOT_TOKEN` operator secret and
+ * the `/setup` value alike, OPE-2650), so the steady state costs no store round trip per call.
  */
 async function resolveBotToken(botToken: string | undefined): Promise<string> {
   const token = botToken ?? (await slackBotToken());

package/agent/channels/slack-working-signs.ts

@@ -0,0 +1,71 @@
+// THE WORKING SIGNS (OPE-2632) — the ONE implementation of what a person sees while the bot works.
+//
+// Two doors start a Slack turn, and before OPE-2632 each drew the signs its own way:
+//   • the MENTION DOOR (slack.ts): eve's Slack channel, for a mention in a channel or a thread;
+//   • the DM DOOR (slack-agent-session.ts): a 1:1 DM or a group DM, diverted to the DM seat on the
+//     `unified` channel, where the Slack channel's own handlers never run. Core's turn-anchor hook
+//     drives its signs through the Slack setter and stepper instead.
+// Both now call the functions in this file, so a person sees the same signs at either door:
+//   • ONE status reaction on the message: 👀 while the turn works, 🛑 when it fails, and none when it
+//     ends (absence is the done signal; ✅ stays reserved for people). See `setSlackStatusReaction`.
+//   • the LIVE STATUS LINE (`assistant.threads.setStatus`): `Working...` at the start, then each step's
+//     code-owned label ("Searching Notion…", slack-step-label.ts) or a status verb, and cleared at
+//     the end. See `slackStepStatus` and `setSlackThreadStatus`.
+// The transport differs (eve's `slack.request` and `startTyping` at the mention door, the host's
+// `slackForm` at the DM door), so each function takes a request seam that never throws.
+
+import { getConfig, resolvePartition, STATUS_REACTION, statusVerbsFor, swallowRoomOp, type ReactionState } from "@open-everywhere/core/agent/adapter-api.js";
+import { stepStatusFor, type StepAction } from "./slack-step-label.js";
+
+/** One Slack Web API call for a sign. It must never throw: a sign is best-effort and never fails a turn. */
+export type SlackSignRequest = (method: string, params: Readonly<Record<string, string>>) => Promise<void>;
+
+/** The status line at a turn's start, at both doors. */
+export const SLACK_WORKING_STATUS = "Working...";
+
+/**
+ * Set the ONE status reaction on a message: add `state`'s emoji and remove every other status emoji.
+ * `"none"` removes them all. The calls run in parallel, because a DM turn waits on this. A swallowed
+ * room op (the egress spoof, core channels/egress-spoof.ts) sends nothing.
+ */
+export async function setSlackStatusReaction(request: SlackSignRequest, target: { readonly channel: string; readonly timestamp: string }, state: ReactionState | "none"): Promise<void> {
+  if (swallowRoomOp("a slack status reaction")) return;
+  await Promise.all(
+    Object.entries(STATUS_REACTION).map(([s, name]) => request(s === state ? "reactions.add" : "reactions.remove", { channel: target.channel, name, timestamp: target.timestamp })),
+  );
+}
+
+/** Set the live status line on a thread. An empty `status` clears it. */
+export async function setSlackThreadStatus(request: SlackSignRequest, target: { readonly channelId: string; readonly threadTs: string }, status: string): Promise<void> {
+  await request("assistant.threads.setStatus", { channel_id: target.channelId, thread_ts: target.threadTs, status });
+}
+
+// --- status verbs (the fun bit) ----------------------------------------------
+// "Tinkering…" / "Untangling…" instead of a flat "Thinking…"/"Working…" — a random
+// pick per status update from the channel's effective vocabulary (framework defaults
+// ← org ← role ← domain, extend-or-replace; memory/domain.ts statusVerbsFor — a
+// domain's ROLE preset contributes its themed verbs as its own rung). Orgs add house
+// verbs, a team adds its in-jokes. Cosmetic only, so ANY failure falls back to a
+// plain verb — the status line must never take a turn down.
+export function slackStatusVerb(state: { channelId?: string | null; teamId?: string | null }): string {
+  try {
+    const p = resolvePartition({
+      channel: { kind: "slack" },
+      session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+    });
+    const cfg = getConfig();
+    const verbs = statusVerbsFor(p.surfaceKey, cfg.loadDomains(), cfg.loadRoles?.() ?? []);
+    return `${verbs[Math.floor(Math.random() * verbs.length)]}…`;
+  } catch {
+    return "Working…";
+  }
+}
+
+/**
+ * The status line for one step: the first labelled action's code-owned label (OPE-2449), else a
+ * status verb. Never the model's own text: slack-step-label.ts reads only the tool's name and, for a
+ * connector, the vendor through its own table. `actions` undefined (a reasoning refresh) shows a verb.
+ */
+export function slackStepStatus(actions: readonly StepAction[] | undefined, state: { channelId?: string | null; teamId?: string | null }): string {
+  return stepStatusFor(actions) ?? slackStatusVerb(state);
+}