@open-everywhere/provider-slack 0.8.1 → 0.9.0

package/agent/channels/slack.ts

@@ -10,11 +10,11 @@
 // (the defaults derive a thinner, workspace-scoped auth). The typing indicator shows
 // a code-owned STEP LABEL while a tool runs ("Searching Notion…", OPE-2449, see
 // slack-step-label.ts), and otherwise a random status VERB ("Tinkering…"),
-// configurable per org/domain — see statusVerb() below.
+// configurable per org/domain — see slackStatusVerb() in slack-working-signs.ts.
 //
 // Credentials: supplied to eve (OPE-2231), as a VERIFIER and a token FUNCTION rather than two
-// strings — agent/setup/eve-credentials.ts. Both resolve env-first and then this deployment's
-// encrypted credential store, which is where a `/setup` run puts them. They used to be omitted, which
+// strings — agent/setup/eve-credentials.ts. Both resolve the operator secret first (OPE-2650: the db
+// store, then its env var on-ramp), then the value a `/setup` run stored. They used to be omitted, which
 // left eve reading `process.env` on a path OE no longer does. Capturing channel_type/is_private is a RAW-fact job; the
 // security-critical interpretation (fail-closed to private) lives in the binding.
 
@@ -43,7 +43,6 @@ import {
   getOperationalStore,
   postOnce,
   outboundKey,
-  statusVerbsFor,
   getConfig,
   finalMessageActionForTurn,
   NO_REPLY_SENTINEL_REASON,
@@ -76,7 +75,6 @@ import {
   introMessage,
   instructionBullet,
   ONBOARDED_MARKER,
-  STATUS_REACTION,
   renderPinned,
   isPinnedStatusMessage,
   classifyWakeMapping,
@@ -89,7 +87,6 @@ import {
   type BindableContext,
   type ReactionState,
   dmTrustTtlMs,
-  swallowRoomOp,
   domainRoster,
   domainKeyOf,
   resolveWakeTrust,
@@ -105,7 +102,8 @@ import { admitSlackInputResponse } from "./slack-input-response.js";
 import { taskCardConfidentiality } from "./slack-task-card.js";
 import { turnEffectsFor, botDisplayName, slackForm, isSupervisorReplyTurn, deliverSupervisorReply, dmWakeThreadOverride, replyThreadTsForState, slackAuthorIsMember, slackWakeAuthorFacts, type SlackMemberProbe, type SupervisorReplyTarget } from "./slack-events.js";
 import { markdownToSlackMrkdwn } from "./slack-mrkdwn.js";
-import { stepStatusFor, type StepAction } from "./slack-step-label.js";
+import { type StepAction } from "./slack-step-label.js";
+import { setSlackStatusReaction, setSlackThreadStatus, SLACK_WORKING_STATUS, slackStatusVerb, slackStepStatus, type SlackSignRequest } from "./slack-working-signs.js";
 import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 // WARM_SILENT_LIMIT (the warm-thread shed threshold) now lives in channels/engagement.ts so
@@ -122,13 +120,8 @@ import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 // "working" from the inbound handlers we already own — so the HITL approval UI
 // (input.requested), reply rendering (message.completed), and typing all stay intact.
 
-// --- status verbs (the fun bit) ----------------------------------------------
-// "Tinkering…" / "Untangling…" instead of a flat "Thinking…"/"Working…" — a random
-// pick per status update from the channel's effective vocabulary (framework defaults
-// ← org ← role ← domain, extend-or-replace; memory/domain.ts statusVerbsFor — a
-// domain's ROLE preset contributes its themed verbs as its own rung). Orgs add house
-// verbs, a team adds its in-jokes. Cosmetic only, so ANY failure falls back to a
-// plain verb — the status line must never take a turn down.
+// --- status verbs: slack-working-signs.ts `slackStatusVerb` (OPE-2632 moved them there, so both doors
+// draw one vocabulary). ---------------------------------------------------------
 /** The team a channel belongs to per THIS deploy's domain config (`slack/<team>/<channel>` entries),
  *  or undefined when the channel is unmapped. Fail-soft: config errors read as "unknown", never
  *  throw into the inbound path. Used only as the last leg of onInbound's teamId heal. */
@@ -150,29 +143,15 @@ function teamIdFromDomainConfig(channelId: string | undefined): string | undefin
   return undefined;
 }
 
-function statusVerb(state: { channelId?: string | null; teamId?: string | null }): string {
-  try {
-    const p = resolvePartition({
-      channel: { kind: "slack" },
-      session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
-    });
-    const cfg = getConfig();
-    const verbs = statusVerbsFor(p.surfaceKey, cfg.loadDomains(), cfg.loadRoles?.() ?? []);
-    return `${verbs[Math.floor(Math.random() * verbs.length)]}…`;
-  } catch {
-    return "Working…";
-  }
-}
-
 // Shared by `reasoning.appended` and `actions.requested`: the clean status verb, or a CODE-owned
 // step label (OPE-2449, `slack-step-label.ts`), and NEVER the model's own in-progress text. We used to show the model's pre-tool-call
 // preamble here (Tag-style, written for humans) — dropped 2026-07 (Tommy, live): that
 // text streams in mid-sentence, so it could flash a truncated fragment ("I'll go away and
 // look to setu…") for a moment before reverting to a verb, which read as broken. One
 // helper, one behaviour, so neither call site can drift back to surfacing partial text.
-async function refreshTypingStatus(channel: SlackEventContext, stepLabel?: string): Promise<void> {
+async function refreshTypingStatus(channel: SlackEventContext, actions?: readonly StepAction[]): Promise<void> {
   try {
-    await setWakeTyping(channel, stepLabel ?? statusVerb(channel.state));
+    await setWakeTyping(channel, slackStepStatus(actions, channel.state));
   } catch {
     /* typing indicator is best-effort */
   }
@@ -190,12 +169,7 @@ async function setWakeTyping(channel: SlackEventContext, status?: string): Promi
   const override = dmWakeThreadOverride(channel.state);
   const channelId = channel.state.channelId ?? undefined;
   if (override && channelId) {
-    try {
-      const body = new URLSearchParams({ channel_id: channelId, thread_ts: override, status: status ?? "" });
-      await slackForm("assistant.threads.setStatus", body.toString());
-    } catch {
-      /* thinking-status is best-effort */
-    }
+    await setSlackThreadStatus(formSign, { channelId, threadTs: override }, status ?? "");
     return;
   }
   await channel.thread.startTyping(status);
@@ -284,19 +258,31 @@ async function setStatusReaction(slack: SlackHandle, state: ReactionState | "non
   const timestamp = threadTsOverride ?? slack.threadTs;
   if (!channel || !timestamp) return;
   // The shared egress exit (core's channels/egress-spoof.ts, OPE-1132). This glyph is a room post,
-  // and it is the ONE Slack write in this bundle that does not travel through core's Slack bridge —
-  // `slack.request` is eve's own channel handle, so the bridge's gate never sees it. Gated here for
-  // that reason alone; every other Slack write this deployment makes is already covered upstream.
-  if (swallowRoomOp("a slack status reaction")) return;
-  for (const [s, name] of Object.entries(STATUS_REACTION)) {
-    try {
-      await slack.request(s === state ? "reactions.add" : "reactions.remove", { channel, name, timestamp });
-    } catch {
-      /* already-reacted / no-reaction / missing-scope are all non-fatal */
-    }
-  }
+  // and `slack.request` is eve's own channel handle, so core's Slack bridge gate never sees it.
+  // `setSlackStatusReaction` asks `swallowRoomOp` for that reason.
+  // OPE-2632: the shared implementation (slack-working-signs.ts), which the DM door's signs call too.
+  await setSlackStatusReaction(
+    async (method, params) => {
+      try {
+        await slack.request(method, { ...params });
+      } catch {
+        /* already-reacted / no-reaction / missing-scope are all non-fatal */
+      }
+    },
+    { channel, timestamp },
+    state,
+  );
 }
 
+/** The host-side sign seam for {@link setWakeTyping}'s per-wake override: `slackForm`, never throwing. */
+const formSign: SlackSignRequest = async (method, params) => {
+  try {
+    await slackForm(method, new URLSearchParams({ ...params }).toString());
+  } catch {
+    /* thinking-status is best-effort */
+  }
+};
+
 // Mirror surface-tier STATUS.md to a single pinned Slack message (find it via a
 // stable header marker so we don't persist a message ts across sessions).
 async function syncPinnedStatus(channel: SlackEventContext): Promise<void> {
@@ -712,7 +698,7 @@ async function onInbound(
   }
 
   try {
-    await ctx.thread.startTyping(statusVerb({ channelId: message.channelId, teamId: message.teamId }));
+    await ctx.thread.startTyping(slackStatusVerb({ channelId: message.channelId, teamId: message.teamId }));
   } catch {
     /* typing indicator is best-effort */
   }
@@ -934,7 +920,7 @@ const slackMentionChannel = slackChannel({
           channel.state.pendingTaskResults = null;
           channel.state.pendingToolCallMessage = null;
           (channel.state as unknown as Record<string, unknown>).oeReasoningTypingAtMs = null;
-          await setWakeTyping(channel, "Working...");
+          await setWakeTyping(channel, SLACK_WORKING_STATUS);
         },
         // Keep the model's REASONING out of the channel. GLM-5.2 runs with reasoning:"medium",
         // and Eve's default `reasoning.appended` handler pipes the chain-of-thought straight into
@@ -978,7 +964,7 @@ const slackMentionChannel = slackChannel({
         // so the indicator flashed a truncated fragment ("I'll go away and look to setu…"). That
         // stays dropped: no model text reaches the status line.
         "actions.requested": async (data, channel) => {
-          await refreshTypingStatus(channel, stepStatusFor(data.actions as readonly StepAction[] | undefined));
+          await refreshTypingStatus(channel, data.actions as readonly StepAction[] | undefined);
         },
         // 🔴 THE OUTPUT FENCE (OPE-2449). eve's defaults for these two events show
         // `presentation[callId].label`, which a tool's `label.complete`/`label.delta` builds from its

package/agent/docs-generated.ts

@@ -159,7 +159,13 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "Connect one included). A DM does not count these two bits as an outside audience. A DM refuses an",
       "approval card only on what Slack observes: the Slack Connect bits (`is_ext_shared`,",
       "`is_pending_ext_shared`), or a partner whose `users.info` carries a guest flag. A group DM and a",
-      "channel still count all four share bits. The",
+      "channel still count all four share bits. The MCP-server propose card passes the same floor (OPE-2640).",
+      "Before that card, `propose_mcp_server` refuses a DM whose partner verdict from `users.info` is",
+      "external. That verdict does not read the share bits, but it does read the line. Without the line, a",
+      "full member at home in another workspace of the Grid is refused. The integration test",
+      "`tests/integration/approvals/grid-dm-card.test.ts` forges the Grid DM, with a Slack Connect DM as the",
+      "refused control. The live leg `S-DM-MCP-PROPOSE` posts the card in the board's own DM, which is not on",
+      "a Grid. The",
       "**click** on that card is a member question, so it does read the line: a member-tier click from a",
       "person whose home workspace is not the click's workspace counts as a guest click without it.",
       "",
@@ -250,11 +256,13 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "[the control plane](../../security/control-plane.md)); a reopen keeps every stored credential, so the",
       "agent stays on Slack while you walk the page again.",
       "",
-      "🔴 **If `SLACK_BOT_TOKEN` or `SLACK_SIGNING_SECRET` is set in the environment, `/setup` answers 404.**",
-      "The resolver is env-first — deliberately, so that landing this page cannot change which Slack app a",
-      "working deployment speaks as — which means a run on such a deployment would store credentials nothing",
-      "would ever read. Rather than let you complete a run that changes nothing, the page refuses. To move an",
-      "existing deployment onto the credential store, unset both variables and redeploy; `/setup` then opens",
+      "🔴 **If `SLACK_BOT_TOKEN` or `SLACK_SIGNING_SECRET` is set — as an operator secret (`oe secret set`)",
+      "or as its env var on-ramp — `/setup` answers 404.** The resolver takes the operator secret first",
+      "(OPE-2650; before it, the env var) — deliberately, so that landing this page cannot change which Slack",
+      "app a working deployment speaks as — which means a run on such a deployment would store credentials",
+      "nothing would ever read. Rather than let you complete a run that changes nothing, the page refuses. To",
+      "move an existing deployment onto the `/setup` values, run `oe secret rm` for both names, unset both",
+      "variables and redeploy; `/setup` then opens",
       "and the deployment logs a setup code on that start.",
       "",
       "This is also why an existing deployment does **not** get an open setup page when it upgrades: it is",
@@ -284,7 +292,7 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "",
       "**2. The `/setup` window.** The page is open from the first start with a valid",
       "`OE_CREDENTIAL_ENCRYPTION_KEY` until the first Slack install, unless `SLACK_BOT_TOKEN` or",
-      "`SLACK_SIGNING_SECRET` is set in the environment. It answers 404 while the key is unset. In that",
+      "`SLACK_SIGNING_SECRET` is set (as an operator secret or its env var). It answers 404 while the key is unset. In that",
       "window, anyone who can read the deployment's logs can claim the page: every member of the Vercel",
       "team, and every reader of a log drain. The code is 128 bits, so a guess does not work. A claim lets",
       "the holder create a Slack app in their own workspace that points at this deployment, and lock",
@@ -675,20 +683,26 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "",
       "## Step 2 — Configure the environment",
       "",
-      "Set these on your instance:",
+      "Both Slack values are **operator secrets** (OPE-2650): store them in the deployment's encrypted",
+      "credential store, from your own terminal, with the same `DATABASE_URL` and",
+      "`OE_CREDENTIAL_ENCRYPTION_KEY` the deployment reads:",
       "",
       "```bash",
-      "SLACK_BOT_TOKEN=xoxb-…          # Bot User OAuth Token from Step 1.4",
-      "SLACK_SIGNING_SECRET=…          # Signing Secret from Step 1.5",
+      "npx oe secret set SLACK_BOT_TOKEN        # Bot User OAuth Token from Step 1.4 (value on stdin)",
+      "npx oe secret set SLACK_SIGNING_SECRET   # Signing Secret from Step 1.5 (value on stdin)",
       "```",
       "",
+      "A stored value takes effect within thirty seconds, with no redeploy. The env vars of the same names",
+      "still work as the on-ramp: the deployment reads one only when nothing is stored under its name.",
+      "",
       "Optional, but relevant to the silo model:",
       "",
       "```bash",
-      "OE_MEMORY_PROVIDER=git          # memory backend — git | sqlite",
       "OE_MEMORY_DIR=/abs/path/to/store",
       "```",
       "",
+      "The memory backend (`git` | `sqlite`) is the `memory.provider` setting in `agent/settings/settings.ts`, not an env var.",
+      "",
       "**Identity binds automatically.** You do **not** set workspace, surface, mode, or visibility by hand. The Slack channel reads `team_id`, `channel_id`, `channel_type`, and `is_private` straight off each inbound event into the session auth context, and `bindSlack` derives workspace = the Slack workspace, surface = the channel, plus mode and visibility. The `deploymentIdentity.workspace` / `.surface` declaration in `agent/identity/surfaces.ts` is only the `eve dev` (no-surface HTTP) gap-filler — once Slack is wired it is ignored.",
       "",
       "## Step 3 — Invoke it",
@@ -742,10 +756,12 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "     reaction via the `react` tool — a bare emoji ack (e.g. 👍) instead of a low-content reply in a",
       "     busy thread. It's a genuine alternative response, not a status indicator, and is audited like",
       "     any other tool call.",
-      "4. Test a DM: open a direct message with the bot and send a plain message (no `@mention` needed in a DM). The DM surface's memory is isolated and `private`. While the turn works, the bot shows the same two signs a mention gets:",
-      "   - **👀 on your message.** A message inside a DM thread gets it on the thread's first message, as in a channel. It goes away when the turn ends, unless the turn fails for good: then the 👀 stays until the next turn of that conversation ends. A DM reply stays flat, as described above.",
-      "   - **The status line** `Working...` under your message, removed when the turn ends. A turn that fails for good leaves it until Slack expires it. A DM turn shows no live step labels: those come from the Slack channel's own handlers, and a DM runs on the DM seat instead.",
-      "   - **If a sign is missing**, the app lacks a scope or the agent view. The 👀 needs `reactions:write`. The status line needs `assistant:write` and the agent view (`features.agent_view`). All three come from the manifest: paste it again (App Manifest → Save Changes) and reinstall if Slack asks. The deployment logs the refused call once per process, with this fix in the line: search the logs for `[open-everywhere:slack-session]`.",
+      "4. Test a DM: open a direct message with the bot and send a plain message (no `@mention` needed in a DM). The DM surface's memory is isolated and `private`. While the turn works, the bot shows the same signs a mention gets. A group DM with the bot shows them too.",
+      "   - **👀 on your message.** A message inside a DM thread gets it on the thread's first message, as in a channel. It goes away when the turn ends. A DM reply stays flat, as described above.",
+      "   - **The status line** under your message: `Working...` at the start, then a live step label while a tool runs (`Reading the thread…`), from the same code-owned table a mention uses. It goes away when the turn ends.",
+      "   - **🛑 when the turn fails for good.** The 👀 goes, 🛑 goes on your message, and the status line clears. In a 1:1 DM the agent session also leaves `processing`, so Slack takes its Stop button off the dead turn. The next turn on the same message takes the 🛑 off again.",
+      "   - **A group DM** has no agent session, so it has no Stop button and no session state. It shows every other sign.",
+      "   - **If a sign is missing**, the app lacks a scope or the agent view. The 👀 and the 🛑 need `reactions:write`. The status line needs `assistant:write` and the agent view (`features.agent_view`). All three come from the manifest: paste it again (App Manifest → Save Changes) and reinstall if Slack asks. The deployment logs the refused call once per process, with this fix in the line: search the logs for `[open-everywhere:slack-session]`.",
       "",
       "### What it can read on Slack",
       "",
@@ -1206,7 +1222,11 @@ export const PROVIDER_DOCS: readonly DocEntry[] = [
       "**What the tests prove.** The unit pack `test:slack-doc-write` (packages/core) pins the room fence, the",
       "cell encoding, the row match, the card text and the exact Slack calls an approval sends. The live e2e",
       "scenario `S-CANVAS-LIST` asks the agent for a canvas in a real channel, approves the card, and reads the",
-      "canvas back from Slack.",
+      "canvas back from Slack. The live e2e scenario `S-LIST-WRITE` asks the agent to add a row to a fixture",
+      "List in a real channel and then to change that row, approves each card, and reads the row back from",
+      "Slack. It needs a List titled \"OE e2e List fixture\", with a text column named \"Note\", shared in the e2e",
+      "channel, and a driver token with `lists:read`. The clean-up also needs `lists:write`: without it,",
+      "each run leaves its row in the List.",
       "",
       "## Slash commands: `/oe` (zero-inference control-plane)",
       "",

package/agent/ops.ts

@@ -31,6 +31,7 @@ import {
   configuredAgentName,
   declaredMcpServers,
   getSettings,
+  registerOperatorSecretNames,
   registerSurfaceAppManifest,
 } from "@open-everywhere/core/agent/adapter-api-ops.js";
 import { SLACK_AS_YOU_NAME } from "./slack-as-you.js";
@@ -60,6 +61,9 @@ export function slackManifestOptionsFromSettings(opts: { readonly appName?: stri
 
 /** Register the slack ops-plane arm (the app manifest). */
 export function registerSlackOps(): void {
+  // The two Slack credentials are operator secrets (OPE-2650): `scaffold_env` marks them, so the setup
+  // flow names `secret_set` as the step that stores them.
+  registerOperatorSecretNames(["SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET"]);
   // THE PASTE-READY APP MANIFEST (OPE-1603). Minting the Slack app stays human, so the ops plane's
   // job is to hand the operator the exact document. The bundle owns the document (agent/
   // app-manifest.ts); core substitutes this deployment's host into it.

package/agent/register.ts

@@ -59,7 +59,7 @@ import {
   registerBotAskProbe,
   registerSurfaceSessionState,
 } from "@open-everywhere/core/agent/adapter-api.js";
-import { slackSurfaceSessionPin, slackSurfaceSessionSetter } from "./channels/slack-agent-session.js";
+import { slackSurfaceSessionPin, slackSurfaceSessionSetter, slackSurfaceSessionStepper } from "./channels/slack-agent-session.js";
 import { slackFriendlyNameResolver } from "./channels/slack-friendly-names.js";
 import { PROVIDER_DOCS } from "./docs-generated.js";
 import { slackSurfaceStatus } from "./status.js";
@@ -125,7 +125,9 @@ export function registerSlackProvider(): void {
   // SLACK'S AGENT SESSION STATE (OPE-2519): `processing` while a turn runs (Slack then shows its Stop
   // button), and `active` or `suspended` at the park. Core's turn-anchor hook drives it; the setter
   // names the person's DM session from the wake's auth (channels/slack-agent-session.ts).
-  registerSurfaceSessionState("slack", slackSurfaceSessionSetter(), slackSurfaceSessionPin);
+  // OPE-2632: the same setter and the stepper draw a DM-door turn's working signs (1:1 and group DM):
+  // 👀, the status line with its step labels, and 🛑 when the turn fails for good.
+  registerSurfaceSessionState("slack", slackSurfaceSessionSetter(), slackSurfaceSessionPin, slackSurfaceSessionStepper());
   // The bot's own Slack display name (OPE-587) — the arm the instruction assembler renders as a
   // HANDLE line on a Slack-pinned session ("your mention/handle here appears as X"), never as
   // identity since OPE-610 settled the naming model. `botDisplayName` memoises one auth.test +

package/agent/setup/claim.ts

@@ -63,7 +63,7 @@ import {
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { SLACK_COOKIE_KEY_REF, SLACK_SETUP_CODE_REF, readInstallRecord, type SlackInstallStateDeps } from "./install-state.js";
-import { slackSecretEnvPresent } from "./credentials.js";
+import { slackOperatorSecretPresent } from "./credentials.js";
 
 /** The cookie the page sets once the code matches. `__Host-` pins it to this exact host with no
  *  domain and a `/` path, which a subdomain cannot overwrite. */
@@ -192,13 +192,14 @@ export async function slackSetupOpen(deps: SlackClaimDeps = {}): Promise<boolean
   // stored credentials, lock the page behind themselves, and have `slackInstallFacts()` publish their
   // workspace as this deployment's install.
   //
-  // Closing on env presence costs nothing a real `/setup` operator wants: the resolver is env-first,
-  // so a deployment with either var set would IGNORE everything a run stored anyway — the page would
-  // have been a no-op with a credential write. An operator who wants to migrate onto the store unsets
-  // the vars and redeploys, which is what the runbook says and what makes the run meaningful.
-  // Screen 2's shadow notice still covers the case where one var is set after an install.
-  const env = slackSecretEnvPresent({ ...(deps.env ? { env: deps.env } : {}) });
-  if (env.botToken || env.signingSecret) return false;
+  // Closing on operator-secret presence costs nothing a real `/setup` operator wants: the resolver
+  // puts the operator secret first (OPE-2650 moved the two env vars there, with env as its on-ramp),
+  // so a deployment with either one set would IGNORE everything a run stored anyway — the page would
+  // have been a no-op with a credential write. An operator who wants to migrate onto the `/setup`
+  // values removes the operator secrets and the env vars, and redeploys. Screen 2's shadow notice
+  // still covers the case where one is set after an install.
+  const present = await slackOperatorSecretPresent({ ...(deps.env ? { env: deps.env } : {}) });
+  if (present.botToken || present.signingSecret) return false;
 
   // 🔴 ONLY AN ABSENT ROW OPENS THE PAGE, and the earlier draft got this backwards. It read through
   // `slackInstallState`, which collapses a store fault, a malformed row and an unknown record version