@opengeni/api-router 2.1.0-canary.0 → 2.3.2-canary.0

package/src/integrations/slack-interactions.ts

@@ -9,7 +9,9 @@ import {
   evaluateSlackTaskPolicy,
   resolveWorkspaceSlackOrchestrationNoticeSettings,
   resolveWorkspaceSlackReactionSummonSettings,
+  SlackChannelRouteListResponse,
   SlackReactionChannelListResponse,
+  UpdateSlackChannelRoutesRequest,
   SlackUserLinkAccessMutationRequest,
   SlackUserLinkAccessRequest,
   type AccessGrant,
@@ -61,7 +63,15 @@ import {
   getSlackInteractionById,
   getSlackInteractionByConnectionRoute,
   probeSlackActionHandleTenancy,
+  openSlackRoutePrompt,
+  getSlackRoutePromptByOption,
+  settleSlackRoutePrompt,
+  answerSlackRoutePrompt,
+  type SlackRoutableWorkspace,
   getSlackChannelRoute,
+  listSlackChannelRoutes,
+  upsertSlackChannelRoute,
+  deleteSlackChannelRoute,
   getSlackUserDmRoute,
   listNamedSubjectSlackRoutableWorkspaces,
   getActiveSlackTaskPolicy,
@@ -69,11 +79,14 @@ import {
   getSessionEventByClientEventId,
   getWorkspace,
   getWorkspaceGrant,
+  namedSubjectPersonalWorkspaceId,
   resolveSlackTargetAuthority,
   listSlackInteractionProgressDeliveryEvidence,
   listSessionEventPage,
   listSessionHumanInputRequests,
   listPendingSlackUserLinkAccessRequests,
+  listSlackInstallationBindings,
+  slackUserLinkAccessRequestTeam,
   rekeySlackInteractionRoute,
   reopenSlackInteractionDelivery,
   reserveSlackInteractionActionHandles,
@@ -401,6 +414,46 @@ export function slackReactionInboxEntry(
   };
 }
 
+/**
+ * Prove a Slack link token may name this workspace.
+ *
+ * Before routing, a token could only ever name the installation's own
+ * workspace, and both intent routes asserted exactly that. A routed
+ * conversation asks for access to the workspace the work would actually land
+ * in, which is a different one, so the assertion becomes: the installation
+ * binding resolves for the token's team, it is the same connection the token
+ * was minted against, and the named workspace belongs to that installation's
+ * organization.
+ *
+ * That is the same fence the route tables carry. It does not widen access by
+ * itself: this only decides which workspace an access REQUEST may be raised
+ * for, and the request still goes through the ordinary approval path.
+ */
+async function resolveSlackLinkTargetInstallation(
+  deps: ApiRouteDeps,
+  link: { slackTeamId: string; connectionId: string },
+  workspaceId: string,
+): Promise<{
+  accountId: string;
+  connectionId: string;
+  workspaceName: string;
+  /** Where the identity link lives, which is not the routed workspace. */
+  identityHome: { accountId: string; workspaceId: string };
+} | null> {
+  const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
+  if (!route || route.connectionId !== link.connectionId || route.accountId.length === 0) {
+    return null;
+  }
+  const workspace = await getWorkspace(deps.db, workspaceId);
+  if (!workspace || workspace.accountId !== route.accountId) return null;
+  return {
+    accountId: route.accountId,
+    connectionId: route.connectionId,
+    workspaceName: workspace.name,
+    identityHome: { accountId: route.accountId, workspaceId: route.workspaceId },
+  };
+}
+
 export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/integrations/slack/events", async (c) => {
     const signed = await readSignedSlackRequest(c, deps);
@@ -563,22 +616,13 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
     if (!link || link.workspaceId !== workspaceId) {
       throw freshSlackLinkRequired();
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (
-      !route ||
-      route.workspaceId !== workspaceId ||
-      route.connectionId !== link.connectionId ||
-      route.accountId.length === 0
-    ) {
-      throw freshSlackLinkRequired();
-    }
-    const workspace = await getWorkspace(deps.db, workspaceId);
-    if (!workspace || workspace.accountId !== route.accountId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw freshSlackLinkRequired();
     }
     try {
       const prepared = await prepareSlackUserLinkAccessRequest(deps.db, {
-        accountId: route.accountId,
+        accountId: installation.accountId,
         workspaceId,
         tokenDigest: createHash("sha256").update(payload.linkToken).digest("hex"),
         connectionId: link.connectionId,
@@ -592,12 +636,13 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         workspaceId,
         requestId: prepared.id,
         subjectId: context.subjectId,
+        identityHome: installation.identityHome,
       });
       if (!completed) throw freshSlackLinkRequired();
       return c.json(
         SlackUserLinkAccessRequest.parse({
           ...completed,
-          workspaceDisplayName: workspace.name,
+          workspaceDisplayName: installation.workspaceName,
         }),
         201,
       );
@@ -705,14 +750,33 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
       const payload = ApproveSlackUserLinkAccessRequest.parse(await c.req.json());
+      // The identity link belongs to the installation, which for a routed
+      // request is a different workspace from the one being granted. The
+      // request row names its Slack team, so the binding resolves from it.
+      const requestId = c.req.param("requestId");
+      const requestTeam = await slackUserLinkAccessRequestTeam(deps.db, {
+        workspaceId,
+        requestId,
+      });
+      const installation = requestTeam
+        ? await resolveSlackInstallationRoute(deps.db, requestTeam.slackTeamId)
+        : null;
       try {
         const request = await approveSlackUserLinkAccessRequest(deps.db, {
           workspaceId,
-          requestId: c.req.param("requestId"),
+          requestId,
           actorSubjectId: grant.subjectId,
           expectedVersion: payload.expectedVersion,
           idempotencyKey: payload.idempotencyKey,
           permissions: payload.permissions,
+          ...(installation
+            ? {
+                identityHome: {
+                  accountId: installation.accountId,
+                  workspaceId: installation.workspaceId,
+                },
+              }
+            : {}),
           ...(payload.role !== undefined ? { role: payload.role } : {}),
         });
         const workspace = await getWorkspace(deps.db, workspaceId);
@@ -771,8 +835,8 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         message: "invalid or expired Slack identity link",
       });
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (!route || route.workspaceId !== workspaceId || route.connectionId !== link.connectionId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw new HTTPException(404, {
         message: "Slack installation not found",
       });
@@ -793,6 +857,7 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
         workspaceId,
         requestId: prepared.id,
         subjectId: grant.subjectId,
+        identityHome: installation.identityHome,
       });
       if (completed?.status !== "completed") throw freshSlackLinkRequired();
       const saved = await getSlackBotUserLink(
@@ -826,6 +891,135 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
     },
   );
 
+  app.get("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    // Same gate as the reaction-channel allowlist beside it. The response names
+    // workspaces across the organization, including ones the reader may hold no
+    // grant in, so it is not an ordinary connections read.
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const connectionId = boundedString(c.req.query("connectionId"), 64);
+    if (!connectionId) throw new HTTPException(400, { message: "connectionId is required" });
+    const routes = await listSlackChannelRoutes(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      { connectionId },
+    );
+    // Names are resolved once per distinct target rather than per route.
+    const names = new Map<string, string | null>();
+    for (const route of routes) {
+      if (names.has(route.targetWorkspaceId)) continue;
+      names.set(
+        route.targetWorkspaceId,
+        (await getWorkspace(deps.db, route.targetWorkspaceId))?.name ?? null,
+      );
+    }
+    return c.json(
+      SlackChannelRouteListResponse.parse({
+        routingEnabled: deps.settings.slackWorkspaceRoutingEnabled,
+        routes: routes.map((route) => ({
+          slackChannelId: route.slackChannelId,
+          targetWorkspaceId: route.targetWorkspaceId,
+          targetWorkspaceName: names.get(route.targetWorkspaceId) ?? null,
+          source: route.source,
+          updatedAt: route.updatedAt.toISOString(),
+        })),
+      }),
+    );
+  });
+
+  app.put("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    // Same gate as the reaction-channel allowlist this sits beside: pointing a
+    // channel somewhere is an installation-administration act.
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const payload = UpdateSlackChannelRoutesRequest.parse(await c.req.json());
+    const home = { accountId: grant.accountId, workspaceId };
+    const installation = await listSlackInstallationBindings(deps.db, home);
+    const binding = installation.find(
+      (candidate) => candidate.connectionId === payload.connectionId,
+    );
+    // The connection must be this workspace's own installation, and the route
+    // rows carry its team id, so a missing binding is a refusal rather than a
+    // row written with an empty team the column's own bound would reject.
+    if (!binding) {
+      throw new HTTPException(404, { message: "Slack installation not found" });
+    }
+    // Authorize EVERY target before writing anything. Applying routes one at a
+    // time means a refusal partway through would otherwise leave some channels
+    // moved and the rest not, behind an error that says the save failed.
+    //
+    // An admin may only point a channel at a workspace they could start work in
+    // themselves, and only inside this organization. The table's own CHECK
+    // enforces the second half; this refuses before writing rather than
+    // surfacing a constraint error.
+    // A channel may never be pointed at a personal workspace. The routing
+    // resolver already refuses to treat one as a candidate in a channel, and
+    // this is the same rule at the write boundary, where a durable route would
+    // otherwise smuggle it back in: every message in that channel would land
+    // somewhere nobody else in the channel can see.
+    //
+    // Only the caller's OWN personal workspace has to be excluded, and that is
+    // the whole rule rather than a partial one, because no other person's can
+    // reach this loop. `resolveSlackTargetAuthority` admits exactly two shapes:
+    // a `workspace_memberships` row this subject holds, or this subject's own
+    // personal-workspace pointer. There is no account-admin union, so an
+    // administrator does not thereby reach anyone else's personal workspace.
+    //
+    // Deliberately NOT justified by "the schema forbids a membership row on a
+    // personal workspace". It does not. Migration 0219's `42501` is a
+    // precondition inside the provisioning function, checked at provisioning
+    // time only, and `personal_workspace_has_no_membership_row` is recorded as
+    // `basis: "runtime"` - the parity report's own term for a property nothing
+    // in the schema prevents. It holds because every membership writer either
+    // requires `members:manage` on the target (which a personal-workspace grant
+    // deliberately omits) or excludes personal workspaces outright.
+    const callerPersonalWorkspaceId = await namedSubjectPersonalWorkspaceId(deps.db, {
+      accountId: grant.accountId,
+      subjectId: grant.subjectId,
+    });
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) continue;
+      const authorized = await resolveSlackTargetAuthority(deps.db, {
+        subjectId: grant.subjectId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId,
+      });
+      if (!authorized || !hasPermission(authorized.permissions, "sessions:create")) {
+        throw new HTTPException(403, {
+          message: `you cannot start work in the workspace chosen for ${route.slackChannelId}`,
+        });
+      }
+      if (
+        callerPersonalWorkspaceId !== null &&
+        route.targetWorkspaceId === callerPersonalWorkspaceId
+      ) {
+        throw new HTTPException(422, {
+          message: `a channel cannot be routed to a personal workspace: work started in ${route.slackChannelId} would be invisible to everyone else in it`,
+        });
+      }
+    }
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) {
+        await deleteSlackChannelRoute(deps.db, home, {
+          connectionId: payload.connectionId,
+          slackChannelId: route.slackChannelId,
+        });
+        continue;
+      }
+      await upsertSlackChannelRoute(deps.db, home, {
+        connectionId: payload.connectionId,
+        slackTeamId: binding.slackTeamId,
+        slackChannelId: route.slackChannelId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId,
+        decidedBySubjectId: grant.subjectId,
+        decidedBySlackUserId: "admin",
+        source: "admin",
+      });
+    }
+    return c.json({ ok: true });
+  });
+
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
@@ -1339,11 +1533,12 @@ async function resolveSlackRouteForEntry(
  * Every branch ends with "No session was created." because the one thing a
  * refusal must never do is leave someone believing work is under way.
  *
- * No access-request link is minted here. The existing link flow signs a token
- * for the installation's own workspace, and offering one for a workspace it
- * cannot yet resolve would send people to a page that refuses them. Until that
- * flow accepts a routed workspace, the refusal names the workspace and points
- * at an administrator.
+ * Only `no_access_to_route` mints an access-request link, and it mints one for
+ * the workspace they actually need rather than the installation's. The other
+ * two branches deliberately do not: a prefix naming something they cannot
+ * reach, and an empty candidate list, both describe a workspace OpenGeni has
+ * not established it will confirm to this person, so they point at an
+ * administrator instead.
  */
 async function postSlackRouteRefusal(
   deps: ApiRouteDeps,
@@ -1354,14 +1549,30 @@ async function postSlackRouteRefusal(
   const available = refusal.candidates.map((candidate) => candidate.label);
   const text =
     refusal.reason === "no_access_to_named"
-      ? `OpenGeni does not see a workspace named ${JSON.stringify(refusal.requested ?? "")} that you can start work in.${
+      ? `OpenGeni does not see a workspace named ${JSON.stringify(refusal.requested ?? "")} that you can start work in from here.${
           available.length > 0 ? ` You can use: ${available.join(", ")}.` : ""
         } No session was created.`
       : refusal.reason === "no_access_to_route"
         ? `OpenGeni starts work from this conversation in ${
             refusal.requested ?? "another workspace"
-          }, and you do not have access to it. Ask an OpenGeni administrator for access to that workspace, or point this conversation somewhere else in OpenGeni under Capabilities, then Slack. No session was created.`
-        : "OpenGeni has no workspace it can start this task in for you. Ask an OpenGeni administrator to give you access to one. No session was created.";
+          }, and you do not have access to it. Request access: ${linkUrl(
+            deps,
+            {
+              // Minted for the workspace they actually need, not the
+              // installation's. The token only decides which workspace an
+              // access request may be raised for; approval is unchanged.
+              workspaceId: refusal.workspaceId ?? entry.workspaceId,
+              connectionId: entry.connectionId,
+              slackTeamId: entry.slackTeamId,
+              slackUserId: entry.slackUserId,
+            },
+            entry.createdAt.getTime(),
+          )}. No session was created.`
+        : // Deliberately "from this conversation" rather than "for you": in a
+          // channel this also fires for someone whose only workspace is their
+          // own personal one, and telling that person they have no workspace
+          // at all would be false. Their bot DM still works.
+          "OpenGeni has no workspace it can start this task in from this conversation. Ask an OpenGeni administrator to give you access to one, or message OpenGeni directly to work in your own workspace. No session was created.";
   await client.postMessage({
     operationId: deterministicUuid(`slack-route-denied:${entry.id}:${refusal.reason}`),
     userId: entry.slackUserId,
@@ -1369,6 +1580,330 @@ async function postSlackRouteRefusal(
   });
 }
 
+/**
+ * A workspace name as a Slack button label.
+ *
+ * Slack renders a button label as plain text and the stored option snapshot caps
+ * it at 128 bytes, so bound it once at the boundary: the button, the row and
+ * every outcome card then agree. Counted in UTF-8 bytes, because that is what
+ * the CHECK counts.
+ */
+function boundedSlackRouteLabel(label: string): string {
+  const encoder = new TextEncoder();
+  if (encoder.encode(label).length <= 72) return label;
+  let bounded = label;
+  while (bounded.length > 0 && encoder.encode(`${bounded}...`).length > 72) {
+    bounded = bounded.slice(0, -1);
+  }
+  return `${bounded}...`;
+}
+
+/**
+ * Say where the work went, quietly.
+ *
+ * The line exists to stop work landing somewhere surprising, so it appears only
+ * when the routing decision was a genuine choice: a null label means routing is
+ * off, or the person had exactly one workspace anyway, and a constant footer on
+ * every message would be noise rather than information.
+ *
+ * The label is frozen on the interaction rather than looked up here, because a
+ * workspace rename between the original post and a reconciliation would make the
+ * post ledger's byte comparison raise.
+ */
+export function withWorkspaceLine(
+  label: string | null,
+  text: string,
+  blocks?: SlackMessageBlock[],
+): { text: string; blocks?: SlackMessageBlock[] } {
+  if (!label) return blocks ? { text, blocks } : { text };
+  const suffix = `\n-> ${label}`;
+  // Reserve the suffix rather than truncating after the fact, so the bounded
+  // body plus the line still fits.
+  const body = boundedOutput(text, MAX_SLACK_TEXT_CHARS - suffix.length);
+  const line: SlackMessageBlock = {
+    type: "context",
+    elements: [{ type: "mrkdwn", text: `-> ${label}` }],
+  };
+  return {
+    text: `${body}${suffix}`,
+    ...(blocks ? { blocks: [...blocks, line] } : {}),
+  };
+}
+
+/**
+ * The post-ledger seed for one interaction's messages.
+ *
+ * The ledger binds one operation id to a digest over the rendered bytes, so
+ * adding the workspace line under an unchanged id would wedge every interaction
+ * with a claimed-but-unposted row. But bumping the id for interactions whose
+ * bytes did NOT change is not free either: their ledger rows become unreachable,
+ * so a repair or a cross-deploy retry posts a duplicate instead of finding the
+ * completed original, and an action handle still points at the old operation.
+ *
+ * Only a labelled interaction renders different bytes, and the label is written
+ * once at insert and never updated, so it is a stable discriminator. Version the
+ * id on the label rather than on the release: a labelled interaction can only
+ * have been created by an image that already renders the line, and every
+ * pre-existing and unlabelled interaction keeps its exact ledger identity.
+ */
+export function slackPostSeed(
+  interaction: Pick<SlackInteraction, "routedWorkspaceLabel">,
+  seed: string,
+): string {
+  return interaction.routedWorkspaceLabel ? `${seed}:v2` : seed;
+}
+
+/** Sources that mean somebody, or something, actually chose this workspace. */
+const SLACK_ROUTE_SOURCES_WORTH_NAMING: ReadonlySet<string> = new Set([
+  // Not "thread": a mapped thread reuses the interaction that already exists,
+  // so it inherits the label frozen when that interaction was created and never
+  // reaches the writer below.
+  "prefix",
+  "channel",
+  "dm_route",
+  "dm_personal",
+]);
+
+/**
+ * The label to freeze on a new interaction, or null to say nothing.
+ *
+ * `installation` and `sole_candidate` both mean there was only ever one place
+ * this could go, so naming it on every message would be noise.
+ *
+ * Bounded with the picker's own button cap so the frozen label and the button
+ * that produced it agree; the column allows 128 bytes, which is headroom.
+ */
+async function routedWorkspaceLabelFor(
+  deps: ApiRouteDeps,
+  resolution: Extract<SlackRouteResolution, { kind: "resolved" }>,
+): Promise<string | null> {
+  if (!SLACK_ROUTE_SOURCES_WORTH_NAMING.has(resolution.source)) return null;
+  const label = resolution.label ?? (await getWorkspace(deps.db, resolution.workspaceId))?.name;
+  if (!label) return null;
+  const bounded = boundedSlackRouteLabel(label);
+  return bounded.length > 0 ? bounded : null;
+}
+
+/** How long a first-use picker stays answerable. */
+const SLACK_ROUTE_PROMPT_TTL_MS = 24 * 60 * 60 * 1000;
+
+/** Buttons a card can carry before it stops being readable. */
+const MAX_SLACK_ROUTE_PROMPT_BUTTONS = 5;
+
+/**
+ * Ask, once, where this conversation should work.
+ *
+ * The card is a bot DM rather than an ephemeral message: `chat.postEphemeral`
+ * returns no durable `(channel, ts)` and no `client_msg_id` echo, and the whole
+ * post ledger and its reconciliation are built on both.
+ *
+ * Nothing is created in any workspace here. The request is parked on the prompt
+ * row and re-queued only once the person answers, so a picker that is never
+ * answered leaves no session, no interaction and no half-started work.
+ */
+async function askSlackRouteChoice(
+  deps: ApiRouteDeps,
+  client: OpenGeniSlackBotClient,
+  home: SlackRouteTenancy,
+  entry: SlackInteractionInboxEntry,
+  candidates: readonly SlackRoutableWorkspace[],
+): Promise<void> {
+  const offered = candidates.slice(0, MAX_SLACK_ROUTE_PROMPT_BUTTONS);
+  // Slack renders a button label as plain text and the stored snapshot caps it
+  // at 128 bytes, so bound it once here: the button, the stored row and every
+  // outcome card then agree, and the full name still shows in OpenGeni.
+  const bounded = offered.map((candidate) => ({
+    ...candidate,
+    label: boundedSlackRouteLabel(candidate.label),
+  }));
+  const opened = await openSlackRoutePrompt(deps.db, home, {
+    connectionId: entry.connectionId,
+    inboxId: entry.id,
+    slackTeamId: entry.slackTeamId,
+    slackUserId: entry.slackUserId,
+    slackChannelId: entry.slackChannelId,
+    slackMessageTs: entry.slackMessageTs,
+    providerEventId: entry.providerEventId,
+    triggerKind: entry.triggerKind,
+    requestText: entry.text,
+    hasFiles: entry.hasFiles,
+    slackThreadTs: entry.slackThreadTs,
+    messageOperationId: deterministicUuid(`slack-route-prompt:${entry.id}`),
+    expiresAt: new Date(Date.now() + SLACK_ROUTE_PROMPT_TTL_MS),
+    candidates: bounded,
+  });
+  if (!opened) return;
+  // The prompt commits before the card is posted, so a transient Slack failure
+  // would otherwise leave a pending row with no card in front of anybody and
+  // silently deaden the conversation. Post unconditionally instead: the
+  // operation id is persisted on the prompt and the card is rendered from the
+  // prompt's own stored options, so a replay reproduces identical bytes and the
+  // post ledger returns the completed original rather than posting twice.
+  const where = opened.prompt.slackChannelId.startsWith("D")
+    ? "your messages with OpenGeni"
+    : `<#${opened.prompt.slackChannelId}>`;
+  const blocks: SlackMessageBlock[] = [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `OpenGeni can start this task in more than one workspace. Pick where ${where} should work. This choice is remembered.`,
+      },
+    },
+    {
+      type: "actions",
+      block_id: "opengeni-route-choice",
+      elements: [
+        ...opened.prompt.options.map((option) => ({
+          type: "button" as const,
+          action_id: "opengeni.route.select",
+          value: option.id,
+          text: { type: "plain_text" as const, text: option.candidateLabel },
+        })),
+        {
+          type: "button" as const,
+          action_id: "opengeni.route.cancel",
+          value: opened.prompt.options[0]?.id ?? opened.prompt.id,
+          text: { type: "plain_text" as const, text: "Not now" },
+        },
+      ],
+    },
+  ];
+  // Deliberately unconditional rather than derived from the live candidate
+  // count: a replay must render identical bytes, and membership can change
+  // between attempts.
+  const url = slackWorkspaceUrl(deps, home.workspaceId);
+  blocks.push({
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: url
+        ? `You can change this later in <${url}|OpenGeni>, under Capabilities, then Slack.`
+        : "You can change this later in OpenGeni, under Capabilities, then Slack.",
+    },
+  });
+  await client.postMessage({
+    operationId: opened.prompt.messageOperationId,
+    userId: opened.prompt.slackUserId,
+    text: boundedOutput(
+      `OpenGeni can start this task in more than one workspace. Pick where ${where} should work.`,
+    ),
+    blocks,
+  });
+}
+
+/**
+ * Process one click on a picker.
+ *
+ * The stored option row is a prompt-time snapshot and is NEVER authority: the
+ * chosen workspace is re-authorized live, because access can have been revoked
+ * between the question and the answer.
+ */
+async function handleSlackRouteChoice(
+  deps: ApiRouteDeps,
+  home: SlackRouteTenancy,
+  entry: SlackInteractionInboxEntry,
+  actionId: string,
+  optionId: string,
+): Promise<void> {
+  if (!deps.settings.slackWorkspaceRoutingEnabled) {
+    // A card can outlive the flag being turned back off. Honouring the click
+    // would write a route row and start work through a path the operator has
+    // disabled.
+    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
+  }
+  const found = await getSlackRoutePromptByOption(deps.db, home, optionId);
+  if (!found) throw new SlackInteractionPermanentError("slack_route_prompt_invalid");
+  const { prompt, chosen } = found;
+  // The same authorization pinning ordinary action handles use: a different
+  // Slack human clicking someone else's card is ignored, not obeyed.
+  if (prompt.slackUserId !== entry.slackUserId) {
+    throw new SlackInteractionPermanentError("slack_route_prompt_user_mismatch");
+  }
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    ...home,
+    connectionId: entry.connectionId,
+    subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID,
+  });
+  // The post ledger binds one operation id to a digest over the text, so the
+  // outcome has to be part of the seed. A second click on a settled card
+  // renders different bytes than the first, and reusing one id would wedge the
+  // ledger rather than saying so.
+  const replaceCard = async (outcome: string, text: string) => {
+    await client.updateMessage({
+      operationId: deterministicUuid(
+        `slack-route-answered:${prompt.id}:${actionId}:${chosen.id}:${outcome}`,
+      ),
+      channelId: entry.slackChannelId,
+      timestamp: entry.slackMessageTs,
+      text,
+      // Every button goes with the card, so a sibling option cannot be pressed
+      // after the question is settled.
+      blocks: [{ type: "section", text: { type: "mrkdwn", text } }],
+    });
+  };
+
+  if (actionId === "opengeni.route.cancel") {
+    const cancelled = await settleSlackRoutePrompt(deps.db, home, {
+      promptId: prompt.id,
+      status: "cancelled",
+    });
+    await replaceCard(
+      cancelled ? "cancelled" : "already_settled",
+      cancelled
+        ? "OpenGeni did not start this task. No session was created."
+        : "OpenGeni already settled this choice.",
+    );
+    return;
+  }
+
+  const link = await getSlackBotUserLink(
+    deps.db,
+    home.workspaceId,
+    entry.connectionId,
+    entry.slackUserId,
+  );
+  const grant = link
+    ? await resolveSlackTargetAuthority(deps.db, {
+        subjectId: link.subjectId,
+        targetAccountId: chosen.candidateAccountId,
+        targetWorkspaceId: chosen.candidateWorkspaceId,
+      })
+    : null;
+  if (!grant || !hasPermission(grant.permissions, "sessions:create")) {
+    // Fail closed WITHOUT touching the card: the person may still have another
+    // workspace on it that they can use, and replacing the card would take the
+    // remaining buttons away and leave a pending prompt nobody can answer.
+    await client.postMessage({
+      operationId: deterministicUuid(`slack-route-denied:${prompt.id}:${chosen.id}`),
+      userId: entry.slackUserId,
+      text: boundedOutput(
+        `OpenGeni cannot start work in ${chosen.candidateLabel}: you do not have access to it. No session was created. Pick another workspace on the card, or ask an OpenGeni administrator for access.`,
+      ),
+    });
+    return;
+  }
+
+  const answered = await answerSlackRoutePrompt(deps.db, home, {
+    promptId: prompt.id,
+    targetAccountId: chosen.candidateAccountId,
+    targetWorkspaceId: chosen.candidateWorkspaceId,
+    answeredBySubjectId: grant.subjectId,
+    decidedBySlackUserId: entry.slackUserId,
+  });
+  if (!answered.answered) {
+    await replaceCard(
+      "settled",
+      "OpenGeni already settled this choice. No new session was created.",
+    );
+    return;
+  }
+  await replaceCard(
+    "answered",
+    `OpenGeni will use *${chosen.candidateLabel}* here. You can change this in OpenGeni under Capabilities, then Slack.`,
+  );
+}
+
 async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractionInboxEntry) {
   if (entry.triggerKind === "block_action") {
     await processSlackBlockAction(deps, entry);
@@ -1442,7 +1977,7 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     await client.postMessage({
       operationId: deterministicUuid(`slack-link:${entry.id}`),
       userId: entry.slackUserId,
-      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry)}. No session was created.`,
+      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry, entry.createdAt.getTime())}. No session was created.`,
     });
     return;
   }
@@ -1451,14 +1986,11 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
     threadTenancy: existing
       ? { accountId: existing.accountId, workspaceId: existing.workspaceId }
       : null,
-    // The first-use picker does not exist yet, so genuine ambiguity keeps the
-    // installation's workspace rather than inventing an answer.
-    askEnabled: false,
+    askEnabled: true,
   });
   if (resolution.kind === "ask") {
-    // Unreachable: `askEnabled` is false above because the first-use picker
-    // lands in a later change. Fail loudly rather than guessing a workspace.
-    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
+    await askSlackRouteChoice(deps, client, home, entry, resolution.candidates);
+    return;
   }
   if (resolution.kind === "denied") {
     await postSlackRouteRefusal(deps, client, entry, resolution);
@@ -1579,6 +2111,11 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
     ...target,
+    // Frozen here, after authorization, so a workspace name is never shown to
+    // someone who could not reach it. Null when the routing decision was not a
+    // genuine choice, which is what keeps the line off every message in an
+    // install that only ever had one workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, resolution),
     connectionId: entry.connectionId,
     slackTeamId: entry.slackTeamId,
     slackChannelId: entry.slackChannelId,
@@ -1894,7 +2431,7 @@ async function acknowledgeSlackSession(
   const privateHandoff =
     !directMessageShortcut && interaction.visibility === "private" && entry.triggerKind !== "dm";
   const privateBotDm = directMessageShortcut || privateHandoff;
-  const operationId = deterministicUuid(`slack-ack:${interaction.id}`);
+  const operationId = deterministicUuid(slackPostSeed(interaction, `slack-ack:${interaction.id}`));
   // The acknowledgement carries exactly one session link plus the Status/Stop
   // buttons. The how-to prose it used to repeat forever now rides along once,
   // on this Slack identity's first accepted task in this installation.
@@ -1922,6 +2459,15 @@ async function acknowledgeSlackSession(
     sessionEventSequence: 0,
     state: "active",
   });
+  // The approval and control cards let `text` and `blocks[0]` diverge, so the
+  // line is appended to each independently rather than assuming they match.
+  const acknowledgement = withWorkspaceLine(
+    interaction.routedWorkspaceLabel,
+    text,
+    controls.length > 0
+      ? ([{ type: "section", text: { type: "mrkdwn", text } }, ...controls] as SlackMessageBlock[])
+      : undefined,
+  );
   const ack = await client.postMessage({
     operationId,
     ...(privateBotDm
@@ -1932,15 +2478,8 @@ async function acknowledgeSlackSession(
             ? {}
             : { threadTimestamp: entry.slackThreadTs ?? entry.slackMessageTs }),
         }),
-    text,
-    ...(controls.length > 0
-      ? {
-          blocks: [
-            { type: "section", text: { type: "mrkdwn", text } },
-            ...controls,
-          ] as SlackMessageBlock[],
-        }
-      : {}),
+    text: acknowledgement.text,
+    ...(acknowledgement.blocks ? { blocks: acknowledgement.blocks } : {}),
   });
   if (entry.triggerKind === "slash_command" || privateBotDm) {
     const rekeyed = await rekeySlackInteractionRoute(deps.db, {
@@ -2155,6 +2694,10 @@ async function processSlackReactionInboxEntry(
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
     ...target,
+    // A reaction routes exactly like a mention, so it names its workspace the
+    // same way. Resolved after `authorizeTarget`, so a name never reaches
+    // somebody who could not reach the workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, routeResolution),
     connectionId: entry.connectionId,
     slackTeamId: entry.slackTeamId,
     slackChannelId: entry.slackChannelId,
@@ -2248,11 +2791,15 @@ async function acknowledgeSlackReactionSession(
   if (!interaction.sessionId) {
     throw new Error("Slack reaction acknowledgement requires a bound session");
   }
+  const started = `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`;
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, started);
   await client.postMessage({
-    operationId: deterministicUuid(`slack-reaction-ack:${interaction.id}`),
+    operationId: deterministicUuid(
+      slackPostSeed(interaction, `slack-reaction-ack:${interaction.id}`),
+    ),
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`,
+    text: rendered.text,
   });
 }
 
@@ -2715,6 +3262,13 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   ) {
     throw new SlackInteractionPermanentError("slack_action_installation_changed");
   }
+  // A route choice is not an action handle: the picker exists BEFORE any
+  // session, so there is no handle row to load and the ordinary path below
+  // would refuse it. Branch first.
+  if (actionId === "opengeni.route.select" || actionId === "opengeni.route.cancel") {
+    await handleSlackRouteChoice(deps, home, entry, actionId, handleId);
+    return;
+  }
   // A handle lives in the workspace that owns its session, which is not the
   // installation's workspace once routing is on. Learn that scope from the
   // content-free probe, then read the full handle under it: every authorization
@@ -2803,17 +3357,26 @@ async function processSlackBlockAction(deps: ApiRouteDeps, entry: SlackInteracti
   // ever shown. The handle's message operation identifies the acknowledgement
   // exactly, independent of route rekeying. Later control cards have their own
   // operation ids, so the hint still appears on exactly one message.
-  const acknowledgementOperationId = deterministicUuid(`slack-ack:${interaction.id}`);
+  const acknowledgementOperationId = deterministicUuid(
+    slackPostSeed(interaction, `slack-ack:${interaction.id}`),
+  );
   const updateText =
     interaction.firstTaskHint === true && handle.messageOperationId === acknowledgementOperationId
       ? `${outcome.text}${slackFirstTaskHintText(deps)}`
       : outcome.text;
+  // A control click replaces a message that already carried the line, so the
+  // replacement carries it too rather than quietly stripping it.
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, updateText, [
+    { type: "section", text: { type: "mrkdwn", text: updateText } },
+  ]);
   await client.updateMessage({
-    operationId: deterministicUuid(`slack-action-update:${handle.id}:${outcome.result}`),
+    operationId: deterministicUuid(
+      slackPostSeed(interaction, `slack-action-update:${handle.id}:${outcome.result}`),
+    ),
     channelId: entry.slackChannelId,
     timestamp: entry.slackMessageTs,
-    text: updateText,
-    blocks: [{ type: "section", text: { type: "mrkdwn", text: updateText } }],
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
   });
   await settleSlackInteractionActionHandles(deps.db, {
     ...target,
@@ -3261,7 +3824,7 @@ async function slackApprovalCard(
   requesterAuthorized: boolean,
 ): Promise<{ text: string; blocks?: SlackMessageBlock[]; operationId: string }> {
   const operationId = deterministicUuid(
-    `slack-delivery:${interaction.id}:${event.sequence}:approval`,
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:approval`),
   );
   const approvals = slackApprovalSummaries(event.payload);
   const fallback = approvals.length
@@ -3414,7 +3977,7 @@ async function slackHumanInputCard(
   );
   if (!request || request.status !== "pending") return null;
   const operationId = deterministicUuid(
-    `slack-delivery:${interaction.id}:${event.sequence}:human-input`,
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:human-input`),
   );
   const text = `${mention}OpenGeni needs your input:\n${formatQuestions(request.questions)}\nReply in this thread${request.allowSkip ? " or choose Skip" : ""}.`;
   if (!requesterAuthorized || !interaction.initiatingSlackUserId) return { text, operationId };
@@ -3890,32 +4453,38 @@ async function deliverSlackSessionEvents(
           // The result is the result. Continuation prose and the recurring
           // action live on the control/Status card and `<command> info`.
           const text = boundedOutput(`${requester.mention}${existingProgress.text}`);
+          // This rewrites a message that already carried the line, so it has to
+          // carry it too, or the update would quietly strip it.
+          const rendered = withWorkspaceLine(
+            interaction.routedWorkspaceLabel,
+            text,
+            publicationBlocks.length > 0
+              ? ([
+                  { type: "section", text: { type: "mrkdwn", text } },
+                  ...publicationBlocks,
+                ] as SlackMessageBlock[])
+              : undefined,
+          );
           await client.updateMessage({
             operationId: deterministicUuid(
-              `slack-terminal-update:${interaction.id}:${event.sequence}`,
+              slackPostSeed(
+                interaction,
+                `slack-terminal-update:${interaction.id}:${event.sequence}`,
+              ),
             ),
             channelId: posted.slackChannelId,
             timestamp: posted.slackMessageTimestamp,
-            text,
-            ...(publicationBlocks.length > 0
+            text: rendered.text,
+            ...(rendered.blocks
               ? {
-                  blocks: [
-                    {
-                      type: "section",
-                      text: {
-                        type: "mrkdwn",
-                        text,
-                      },
-                    },
-                    ...publicationBlocks,
-                  ],
+                  blocks: rendered.blocks,
                 }
               : {}),
           });
         }
       } else {
         const operationId = deterministicUuid(
-          `slack-delivery:${interaction.id}:${event.sequence}:final`,
+          slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:final`),
         );
         const text = boundedOutput(
           `${requester.mention}${output || "OpenGeni finished this task."}`,
@@ -4016,15 +4585,18 @@ async function postDelivery(
   event: SessionEvent,
   text: string,
   kind: string,
-  operationId = deterministicUuid(`slack-delivery:${interaction.id}:${event.sequence}:${kind}`),
+  operationId = deterministicUuid(
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:${kind}`),
+  ),
   blocks?: SlackMessageBlock[],
 ) {
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, boundedOutput(text), blocks);
   await client.postMessage({
     operationId,
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: boundedOutput(text),
-    ...(blocks ? { blocks } : {}),
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
   });
 }
 
@@ -4104,6 +4676,8 @@ const SLACK_BLOCK_ACTION_IDS = new Set([
   "opengeni.session.pause",
   "opengeni.session.resume",
   "opengeni.shared_result.publish",
+  "opengeni.route.select",
+  "opengeni.route.cancel",
 ]);
 
 export function normalizedBlockActionInteraction(
@@ -4402,6 +4976,16 @@ function linkUrl(
     SlackInteractionInboxEntry,
     "workspaceId" | "connectionId" | "slackTeamId" | "slackUserId"
   >,
+  /**
+   * When this URL goes into a message posted under a deterministic operation
+   * id, the token has to be deterministic too. The post ledger binds that id to
+   * a digest over the text, so a retry that mints a fresh token renders
+   * different bytes and is refused as a conflicting request, permanently. Pass
+   * the originating inbox row's creation time: the token is then stable for that
+   * row and still expires fifteen minutes after the message could first have
+   * been read.
+   */
+  mintedAtMs?: number,
 ) {
   const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
   const signingSecret = deps.settings.slackSigningSecret;
@@ -4410,7 +4994,7 @@ function linkUrl(
   // Fragments stay out of HTTP request lines, reverse-proxy logs, Referer
   // headers, and managed-auth callback URLs. Query-form bearers are rejected.
   url.hash = new URLSearchParams({
-    slack_link: createSlackUserLinkToken(signingSecret, entry),
+    slack_link: createSlackUserLinkToken(signingSecret, entry, mintedAtMs),
   }).toString();
   return url.toString();
 }
@@ -4583,10 +5167,8 @@ function boundedSlackChildDetail(value: string) {
     : `${collapsed.slice(0, MAX_SLACK_CHILD_DETAIL_CHARS - 1)}…`;
 }
 
-function boundedOutput(value: string) {
-  return value.length <= MAX_SLACK_TEXT_CHARS
-    ? value
-    : `${value.slice(0, MAX_SLACK_TEXT_CHARS - 20)}\n… output truncated`;
+function boundedOutput(value: string, limit = MAX_SLACK_TEXT_CHARS) {
+  return value.length <= limit ? value : `${value.slice(0, limit - 20)}\n… output truncated`;
 }
 
 function safePayloadText(payload: unknown, field: string) {