@stratusagent/channel-slack 0.11.3 → 0.11.5

package/dist/index.js

@@ -2,8 +2,14 @@ import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { filePathsOf, latestTurnReply, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, } from '@stratusagent/core';
+import { filePathsOf, latestTurnReply, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, } from '@stratusagent/core';
 import { channelSessionKey, } from '@stratusagent/channels';
+import { toSlackMrkdwn } from "./mrkdwn.js";
+/**
+ * The longest display name the model is shown. Slack caps profile names
+ * well under this; the bound is for a profile that is not a name.
+ */
+const MAX_DISPLAY_NAME_LENGTH = 80;
 const SLACK_MAX_MESSAGE_CHARS = 4000;
 const DEFAULT_EDIT_INTERVAL_MS = 1000;
 const DEDUPE_CAPACITY = 2000;
@@ -46,6 +52,15 @@ const THREAD_HANDOVER_DEPTH = 32;
  */
 const MAX_UNRENDERED_FILES = 20;
 const PLACEHOLDER_TEXT = '…';
+/** What the loading status says while a turn works, and while it runs a tool. */
+const THINKING_STATUS = 'is thinking…';
+const toolStatus = (toolName) => `is running ${toolName}…`;
+/**
+ * How often a loading status is set again while its turn runs. Slack drops
+ * one after two minutes with no message, and a long turn — a tool, an
+ * approval wait — is exactly the one whose status must not vanish.
+ */
+const STATUS_REFRESH_MS = 60_000;
 /**
  * How long an agent that judges stays attentive after it last answered a
  * message that addressed it: this many messages, or this many minutes,
@@ -151,10 +166,13 @@ const uploadPlace = (result, channel) => {
     return undefined;
 };
 /**
- * Renders one turn's reply into Slack with the placeholder-then-edit
- * pattern: post `…` immediately, fold streaming deltas and tool status
- * lines into throttled edits, and finalize with the authoritative reply
- * (split across messages when it outgrows one).
+ * Renders one turn's reply into Slack, one of two ways. Streaming (the
+ * `stream` reply mode): post `…` immediately, fold streaming deltas and
+ * tool status lines into throttled edits, and finalize with the
+ * authoritative reply. Otherwise (`final`, the default): no placeholder —
+ * Slack's loading status says the agent is working, and the finished reply
+ * is posted once, so the notification carries the answer rather than a
+ * `…`. Either way a reply that outgrows one message is split.
  */
 class ReplyRenderer {
     /**
@@ -220,6 +238,47 @@ class ReplyRenderer {
      * had nothing to add is a message the decision cannot take back.
      */
     lazy;
+    /**
+     * Whether this turn streams into a placeholder. When it does not, there
+     * is never a placeholder: `finalize` finds none and posts the reply as
+     * messages of its own, and a handover has nothing to hand over and says
+     * so (`untaken`), so the recovery's reply is posted ahead of this one
+     * the ordinary way — both already the paths for a placeholder that
+     * could not be opened.
+     */
+    streaming;
+    /**
+     * The thread the loading status belongs to: the reply's thread, or the
+     * message itself in a DM, whose reply has no thread to key one on.
+     */
+    statusThread;
+    /** Shared by a connection's renderers, so a status Slack refuses is said once, not per message. */
+    statusWarned;
+    loading = false;
+    /**
+     * Status calls, in order, so the last one Slack applies is the last one
+     * sent — and so `finalize` can wait for them: a status that reached
+     * Slack after the reply would stand over a finished turn until Slack's
+     * own timeout, since the post that clears it came first.
+     */
+    statusChain = Promise.resolve();
+    /**
+     * The turn this one was queued behind has posted everything it will
+     * (see `posted`). A streaming turn holds its place with the placeholder
+     * it opened at intake; a `final` one has no placeholder, so it waits for
+     * this before putting text or files in the thread — or a quick answer
+     * would land above the slow one ahead of it.
+     */
+    after;
+    settle;
+    /** Resolves once this turn has put in the thread everything it will. */
+    posted = new Promise((resolve) => {
+        this.settle = resolve;
+    });
+    statusText;
+    statusTimer;
+    /** The tool the turn is running, for the status line; the streamed `toolLine` is the other mode's. */
+    runningTool;
     web;
     channel;
     threadTs;
@@ -234,6 +293,83 @@ class ReplyRenderer {
         this.warn = warn;
         this.lazy = options.lazy ?? false;
         this.now = options.now ?? Date.now;
+        this.streaming = options.streaming ?? true;
+        this.statusThread = options.statusThread ?? threadTs;
+        this.statusWarned = options.statusWarned ?? { value: false };
+        this.after = options.after ?? Promise.resolve();
+    }
+    /**
+     * Show Slack's loading status for this turn, and keep it up until the
+     * turn is finalized. Not for a streaming turn, which has its placeholder,
+     * nor for one nobody asked for: "is thinking…" over a turn that may
+     * decide to say nothing is the interruption silence exists to avoid.
+     */
+    showLoading(head) {
+        if (this.streaming || this.lazy || this.loading || this.finalized) {
+            return;
+        }
+        this.loading = true;
+        // A thread has one status per app, so a turn queued behind another
+        // must not publish its own: it would overwrite what the running turn
+        // says it is doing. It publishes when it reaches the head (`beginTurn`,
+        // or `refreshLoading` once the turn ahead has posted).
+        if (head) {
+            this.publishLoading();
+        }
+    }
+    publishLoading() {
+        if (this.statusTimer || this.finalized) {
+            return;
+        }
+        this.setStatus(this.statusText ?? THINKING_STATUS);
+        this.statusTimer = setInterval(() => this.refreshLoading(), STATUS_REFRESH_MS);
+        this.statusTimer.unref?.();
+    }
+    /**
+     * Set the status again. Slack clears a thread's status whenever the app
+     * posts in it, so a reply or file from the turn ahead of this one — or
+     * this turn's own upload — takes it down while this turn is still
+     * working; the adapter calls this once that post has landed.
+     */
+    refreshLoading() {
+        if (!this.loading || this.finalized) {
+            return;
+        }
+        if (!this.statusTimer) {
+            // Queued until now: this is the renderer at the head at last.
+            this.publishLoading();
+            return;
+        }
+        this.setStatus(this.statusText ?? THINKING_STATUS);
+    }
+    stopLoading() {
+        if (this.statusTimer) {
+            clearInterval(this.statusTimer);
+            this.statusTimer = undefined;
+        }
+        this.loading = false;
+    }
+    setStatus(text) {
+        const setStatus = this.web.assistant?.threads.setStatus;
+        if (!setStatus || this.statusThread === undefined) {
+            return;
+        }
+        this.statusText = text;
+        const thread = this.statusThread;
+        // Not awaited by the caller: the turn never waits on a status. Only
+        // `finalize` does, for the ordering reason on `statusChain`. A refusal
+        // — a workspace or plan without it, a token Slack will not honour for
+        // it — is said once and then left alone; the reply still arrives,
+        // just without the status ahead of it.
+        this.statusChain = this.statusChain
+            .then(() => setStatus.call(this.web.assistant?.threads, { channel_id: this.channel, thread_ts: thread, status: text }))
+            .then(() => undefined, (error) => {
+            if (!this.statusWarned.value) {
+                this.statusWarned.value = true;
+                this.warn(`slack: could not show a loading status (${error instanceof Error ? error.message : String(error)}); `
+                    + 'replies still post when they are ready, without one');
+            }
+        });
     }
     /**
      * The gateway has begun this renderer's turn. Whatever was streamed here
@@ -250,8 +386,17 @@ class ReplyRenderer {
         }
         this.buffer = '';
         this.toolLine = undefined;
+        this.runningTool = undefined;
         this.turnBreakPending = false;
         this.generation += 1;
+        // Queued until now, this turn publishes its status as it starts; one
+        // already showing may be showing a tool the turn ahead of it ran.
+        if (this.loading && !this.statusTimer) {
+            this.publishLoading();
+        }
+        else if (this.loading && this.statusText !== THINKING_STATUS) {
+            this.setStatus(THINKING_STATUS);
+        }
     }
     async open() {
         const posted = await this.web.chat.postMessage({
@@ -300,6 +445,7 @@ class ReplyRenderer {
             // the text after it — without it they fuse in the live message.
             this.turnBreakPending = true;
             this.toolLine = `⚙ ${event.call.toolName}…`;
+            this.runningTool = event.call.toolName;
             this.scheduleEdit();
             return;
         }
@@ -309,12 +455,14 @@ class ReplyRenderer {
             // message would keep claiming a refused tool is running, and the
             // model's follow-up would fuse with the text before the attempt.
             this.toolLine = undefined;
+            this.runningTool = undefined;
             this.turnBreakPending = true;
             this.scheduleEdit();
             return;
         }
         if (event.type === 'tool.completed') {
             this.toolLine = undefined;
+            this.runningTool = undefined;
             // Also a boundary, and not only for symmetry: a call rejected before
             // execution settles as tool.completed without ever having emitted
             // tool.called, so this is the only mark that attempt leaves.
@@ -348,8 +496,10 @@ class ReplyRenderer {
         // it, and an upload that then waited for that handover would be a
         // cycle nothing breaks (see `queueEdit`).
         const handover = this.handover;
+        const after = this.streaming ? undefined : this.after;
         this.uploadChain = this.uploadChain
             .then(() => handover)
+            .then(() => after)
             // Read as file DATA inside the chain: the Web API takes contents,
             // not a path, and a missing file surfaces as this upload's own
             // failure instead of an unhandled stream error.
@@ -372,6 +522,9 @@ class ReplyRenderer {
                 ...(this.threadTs ? { thread_ts: this.threadTs } : {}),
             });
             this.uploaded = true;
+            // The upload is a post of the app's in this thread, which takes
+            // the status down with it while the turn is still working.
+            this.refreshLoading();
             const placed = uploadPlace(result, this.channel) ?? before;
             if (this.uploadedAt === undefined || placed > this.uploadedAt) {
                 this.uploadedAt = placed;
@@ -384,6 +537,15 @@ class ReplyRenderer {
         return parts.length > 0 ? parts.join('\n\n') : PLACEHOLDER_TEXT;
     }
     scheduleEdit() {
+        if (!this.streaming) {
+            // Nothing to edit: what the turn is doing goes into the status line,
+            // and only once the turn is this renderer's own (see `beginTurn`).
+            const status = this.runningTool !== undefined ? toolStatus(this.runningTool) : THINKING_STATUS;
+            if (this.loading && this.statusTimer && this.turnStarted && !this.finalized && status !== this.statusText) {
+                this.setStatus(status);
+            }
+            return;
+        }
         // Not gated on having a placeholder: during a handover there is none
         // for a moment, and the edit reads the fresh one when its turn comes.
         if (this.pendingEdit) {
@@ -464,8 +626,25 @@ class ReplyRenderer {
      * refused sentence is still the last thing said, for the thread rule.
      */
     async finalize(reply) {
+        try {
+            return await this.finalizeInOrder(reply);
+        }
+        finally {
+            this.settle();
+        }
+    }
+    async finalizeInOrder(reply) {
         await this.handover;
+        // Shown, not merely wanted: a turn still queued behind another never
+        // published one, and a clear from it would take down the running
+        // turn's status instead.
+        const hadStatus = this.statusTimer !== undefined;
+        this.stopLoading();
         this.finalized = true;
+        if (!this.streaming) {
+            await this.after;
+            await this.statusChain;
+        }
         if (this.pendingEdit) {
             clearTimeout(this.pendingEdit);
             this.pendingEdit = undefined;
@@ -523,6 +702,15 @@ class ReplyRenderer {
                 this.placeText(this.ref?.ts);
             }
         }
+        // A reply posted clears the status itself; one Slack refused would
+        // leave "is thinking…" standing over a turn that has ended.
+        if (hadStatus && !landed) {
+            this.setStatus('');
+            // Awaited: the turn queued behind this one re-shows its own status
+            // once this renderer is done, and a clear that reached Slack after
+            // that would take the next turn's status down with it.
+            await this.statusChain;
+        }
         return this.outcome(published, landed || this.edited || this.uploaded || stranded);
     }
     placeText(ts) {
@@ -709,343 +897,6 @@ const safeCutIndex = (text, index) => {
 const truncateForSlack = (text) => text.length <= SLACK_MAX_MESSAGE_CHARS
     ? text
     : `${text.slice(0, safeCutIndex(text, SLACK_MAX_MESSAGE_CHARS - 1))}…`;
-/**
- * Where the run of exactly `length` backticks that closes an open one
- * begins, or -1. Exactly: a longer run is not a closer, which is the whole
- * point of writing a span as ``code with a ` in it`` and a fence as ````
- * when the block itself contains ```.
- */
-const closingBacktickRun = (text, from, length, limit) => {
-    const run = '`'.repeat(length);
-    for (let at = text.indexOf(run, from); at !== -1 && at + length <= limit; at = text.indexOf(run, at + 1)) {
-        if (text[at - 1] !== '`' && text[at + length] !== '`') {
-            return at;
-        }
-    }
-    return -1;
-};
-/**
- * The text as alternating prose and code — even indices prose, odd code.
- *
- * Code is the one place a reader means the characters themselves: `**` in a
- * shell snippet is the snippet, so nothing below rewrites it. A run of N
- * backticks opens code and the next run of exactly N closes it, which is
- * the same rule for a span and for a fence and is why a longer delimiter
- * can carry a shorter one inside it.
- *
- * A span may close on a later line, and is protected the whole way. That
- * looks wasteful — two stray backticks paragraphs apart become one long
- * "span" whose contents are left unconverted — and it was briefly changed
- * to end a span at its line for exactly that reason. That was wrong, and
- * the reason is the rule this whole file answers to: what Slack does with
- * the message decides, not what Markdown says. Slack pairs those backticks
- * too, so the text between them is what it renders as code, and rewriting
- * a `**bold**` in there would alter the contents of somebody's snippet.
- * Leaving prose unconverted is a cosmetic loss; changing what a reader is
- * told is code is not, so the doubt resolves toward protecting more.
- *
- * A fence with no closer runs to the end on purpose: a model that forgets
- * to close one, and every partially streamed block on its way to being
- * closed, would otherwise have its contents rewritten as prose. One or two
- * unmatched backticks are the opposite case — literal text, since "use the
- * ` character" must not swallow what follows.
- */
-const proseAndCode = (text) => {
-    const segments = [];
-    let prose = 0;
-    let cursor = 0;
-    while (cursor < text.length) {
-        const open = text.indexOf('`', cursor);
-        if (open === -1) {
-            break;
-        }
-        let length = 1;
-        while (text[open + length] === '`') {
-            length += 1;
-        }
-        const close = closingBacktickRun(text, open + length, length, text.length);
-        if (close === -1) {
-            if (length < 3) {
-                cursor = open + length;
-                continue;
-            }
-            segments.push(text.slice(prose, open), text.slice(open));
-            return segments;
-        }
-        segments.push(text.slice(prose, open), text.slice(open, close + length));
-        prose = close + length;
-        cursor = prose;
-    }
-    segments.push(text.slice(prose));
-    return segments;
-};
-/**
- * The spellings that differ, applied to prose only, in an order that matters.
- *
- * Single-asterisk emphasis goes first and is barred from crossing a `*`, so
- * `**bold**` cannot be read as an italic run that happens to begin with one.
- * Bold then rewrites what is left, and its output is never rescanned.
- *
- * Each delimiter has to hug its content — `3 * 4 * 5` is arithmetic, not
- * emphasis — and none may span a line, so one stray marker cannot italicize
- * the rest of a message.
- */
-const MRKDWN_REWRITES = [
-    // Both at once, before either rule can take half of it and leave the
-    // other half as literal asterisks. Its output is why the italic rule
-    // below refuses content that already opens with an underscore.
-    [/\*\*\*([^\s*][^*\n]*[^\s*]|[^\s*])\*\*\*/g, '*_$1_*'],
-    [/(^|[^*])\*([^\s*_][^*\n]*[^\s*]|[^\s*_])\*(?!\*)/g, '$1_$2_'],
-    [/\*\*([^\s*][^*\n]*[^\s*]|[^\s*])\*\*/g, '*$1*'],
-    [/(^|[^_])__([^\s_][^_\n]*[^\s_]|[^\s_])__(?!_)/g, '$1*$2*'],
-    [/~~([^\s~][^~\n]*[^\s~]|[^\s~])~~/g, '~$1~'],
-    // The one construct Slack spells backwards. A scheme is required: a
-    // bare `[1](2)` in prose is not a link anybody meant to follow.
-    [/\[([^\]\n]+)\]\(((?:https?:\/\/|mailto:)[^()\s]+)\)/g, '<$2|$1>'],
-];
-/**
- * `## Heading`, which mrkdwn has no spelling for at all.
- *
- * The optional closing hashes have to be spaced off the text, as Markdown
- * requires: without that, `# C#` is a heading whose name loses its last
- * character.
- *
- * What they and any trailing spaces cover is captured rather than dropped,
- * because dropping is only right when they are the heading's own syntax. A
- * heading that opens a code span reaches its end inside one, and there the
- * same characters are the snippet: `` # show `value # `` has a hash that
- * belongs to whoever wrote the code.
- */
-const MARKDOWN_HEADING = /^ {0,3}#{1,6}[ \t]+(.+?)((?:[ \t]+#+)?[ \t]*)$/gm;
-const convertInline = (segment) => {
-    let converted = segment;
-    for (const [pattern, replacement] of MRKDWN_REWRITES) {
-        converted = converted.replace(pattern, replacement);
-    }
-    return converted;
-};
-/**
- * Headings, found on the text's own lines rather than inside each prose
- * fragment.
- *
- * A fragment is not a line: inline code cuts one in two, and the halves
- * begin wherever the code ended. Matched per fragment, `^` then lied in
- * both directions — the tail of `` `status` # not a heading `` looked like a
- * line of its own and lost its hash, and ``## Run `npm test` now`` was only
- * ever half a line, so only the half before the code was wrapped.
- *
- * So the whole text is matched instead, with the code spans it now contains
- * passed in: a `#` whose line begins inside one is a comment in somebody's
- * snippet, not a heading. A heading that merely *contains* code is a
- * heading, and its code goes along untouched.
- *
- * Emphasis inside is already converted by here, so the line is only wrapped
- * when nothing in it can pair with the wrapper. Slack has one bold
- * delimiter and no way to nest it: wrapping `*Run* the thing` again yields
- * `**Run* the thing*`, which it renders as literal asterisks rather than as
- * anything bold. A heading that already carries emphasis therefore keeps
- * exactly the emphasis it has — `## **Title**` is bold by now and needs
- * nothing more, and `# glob *.ts` keeps an asterisk that was never a marker
- * at all. An unbolded heading reads fine; a heading full of stray asterisks
- * does not, and one with characters removed to make room is worse than both.
- *
- * An asterisk inside a code span is not one of those: Slack does not read
- * markup there, so it cannot pair with anything, and ``## Match `*.ts` files``
- * is bolded like any other heading.
- *
- * Both walks are cursors rather than searches: `replace` reports matches in
- * increasing offset, and the spans were collected in that order too, so
- * neither has to be looked at twice. The same work as a scan per heading,
- * without its quadratic on a reply that is mostly headings and snippets.
- */
-/** What could pair with a heading's wrapper, or with something out of sight. */
-const PAIRABLE_MARKER = /[*`]/g;
-const convertHeadings = (text, code) => {
-    let span = 0;
-    const startsInside = (position, from) => position >= (code[from]?.[0] ?? Number.POSITIVE_INFINITY);
-    return text.replace(MARKDOWN_HEADING, (line, body, tail, offset) => {
-        while (span < code.length && (code[span]?.[1] ?? 0) <= offset) {
-            span += 1;
-        }
-        // A `#` whose line begins inside a span is a comment in somebody's code.
-        if (startsInside(offset, span)) {
-            return line;
-        }
-        const heading = body.trim();
-        if (heading.length === 0) {
-            return line;
-        }
-        // Where everything this would drop from the line's end begins: the
-        // closing hashes and spaces the pattern captured, and whatever else
-        // `trimEnd` would take with them. The two are not the same set — the
-        // pattern knows only spaces and tabs, while trimming also takes a
-        // no-break space, an ideographic space, and the rest of what
-        // ECMAScript counts as whitespace — and the difference is exactly
-        // where a character goes missing.
-        //
-        // Dropping any of it is the heading's own syntax being removed, but
-        // only while it is the heading's: a line that opens a span reaches its
-        // end inside one, and there the same characters are somebody's
-        // snippet. Nothing on this line is safe to strip then, so it is left
-        // exactly as written. (The front needs no such care: the body starts
-        // where the hashes stop, which this line has already been shown to
-        // reach in prose.)
-        const dropped = tail.length + (body.length - body.trimEnd().length);
-        if (dropped > 0) {
-            const droppedAt = offset + line.length - dropped;
-            let over = span;
-            while (over < code.length && (code[over]?.[1] ?? 0) <= droppedAt) {
-                over += 1;
-            }
-            if (startsInside(droppedAt, over)) {
-                return line;
-            }
-        }
-        // Anything left on the line that a delimiter could pair with, walked
-        // from where the heading cursor already stands rather than from the
-        // beginning. An asterisk is the obvious one — it would pair with the
-        // wrapper. A backtick counts too: one this side found no partner for is
-        // a literal character here, but Slack parses the message itself and may
-        // pair it with a backtick further down, and the wrapper's closing `*`
-        // would then be written inside what Slack reads as code, where it is
-        // ignored — leaving the opening one with nothing to close it. Both are
-        // spent characters inside a span, which is why the ranges are consulted
-        // rather than the text alone.
-        let within = span;
-        for (const marker of line.matchAll(PAIRABLE_MARKER)) {
-            const position = offset + (marker.index ?? 0);
-            while (within < code.length && (code[within]?.[1] ?? 0) <= position) {
-                within += 1;
-            }
-            if (!startsInside(position, within)) {
-                return heading;
-            }
-        }
-        // Both markers have to land in prose, not just the opening one. A fence
-        // opened on this line — by a model mid-answer, or by a block still being
-        // streamed — runs past its end, so the closing `*` would be written
-        // inside the code and ignored there, leaving the opening one unpaired.
-        // The line began in prose or this never ran, so it is the end that is
-        // in question: where the marker would go, one past the line's last
-        // character, and not that character itself — a span that closes exactly
-        // at the line's end leaves the marker just outside it, which is fine.
-        const closer = offset + line.length;
-        while (within < code.length && (code[within]?.[1] ?? 0) <= closer) {
-            within += 1;
-        }
-        return startsInside(closer, within) ? heading : `*${heading}*`;
-    });
-};
-/**
- * A stand-in for one code segment while the prose around it is rewritten.
- *
- * Emphasis was converted one prose fragment at a time until this existed,
- * and a fragment is not a run: inline code cuts one in two, so the `**`
- * opening a bold run and the `**` closing it land in different fragments
- * whenever a snippet sits between them, and neither half ever finds its
- * partner. ``**the `fs.read` tool**`` reached a reader as four literal
- * asterisks around a snippet, and so did every link, italic and
- * strikethrough written the same way. It is the defect #142 found in
- * headings, in the rule right next to it, and it has the same answer:
- * rewrite the whole text, with code held out of the rewrite rather than
- * cut out of the text.
- *
- * A mask names its segment rather than merely standing in for one, because
- * a rewrite is allowed to move it: the link rule writes its two captures
- * back in the other order, so `[use `a`](https://host/`b`)` hands the URL's
- * snippet to the label and the label's to the URL, and a snippet that
- * arrives somewhere else is the same defect as one that is rewritten. Named,
- * it comes back to the place holding its own name. No rewrite can damage
- * the name itself: none of the delimiters they look for appear in it, and
- * every rule copies what it matched through to its replacement.
- *
- * A mask also carries whether its segment holds whitespace, because three
- * rules refuse to cross it — a destination is `[^()\s]+`, a label and an
- * emphasis run stop at a newline — and a name alone has none to stop them.
- * `[label](https://host/`a b`)` is not a destination and was never meant to
- * convert; masked shapelessly it did, and came back rearranged into a link
- * Slack cannot render. Only whitespace is carried, and only ever so a rule
- * refuses: a `*` in a snippet must still not act like one. Both ends of a
- * mask stay the mask character, so a run that has to hug its content still
- * hugs it — a segment opens and closes with a backtick, so that is not a
- * lie about its ends.
- *
- * The character is chosen against the text rather than fixed, because a
- * reply that already contained it would have a snippet spliced in where
- * the writer's own character stood — the one thing this conversion must
- * never do. A reply holding all 6400 of the private-use characters has no
- * mask to be given and is left in Markdown instead: prose that reads as it
- * was written is a cosmetic loss, and a snippet spliced somewhere else is
- * not.
- */
-const maskFor = (text) => {
-    for (let point = 0xe000; point <= 0xf8ff; point += 1) {
-        const candidate = String.fromCharCode(point);
-        if (!text.includes(candidate)) {
-            return candidate;
-        }
-    }
-    return undefined;
-};
-/**
- * Markdown as a model writes it, in the spelling Slack actually renders.
- *
- * Slack's mrkdwn is not Markdown, and the gap is not cosmetic: `**bold**`
- * reaches a reader as four literal asterisks, and `## Heading` as a line
- * that starts with two hashes. Models write Markdown because that is what
- * every other surface here renders, and a soul should not have to know
- * which channel is carrying it, so the translation happens at the edge that
- * does know.
- *
- * Only what differs is touched. Lists, block quotes, and inline code
- * already mean in mrkdwn what they mean in Markdown; rewriting them would
- * add ways to be wrong and fix nothing.
- */
-const toSlackMrkdwn = (text) => {
-    const mask = maskFor(text);
-    if (mask === undefined) {
-        return text;
-    }
-    const segments = proseAndCode(text);
-    const code = [];
-    let masked = '';
-    for (const [index, segment] of segments.entries()) {
-        if (index % 2 === 1) {
-            const shape = /\n/.test(segment) ? '\n' : /\s/.test(segment) ? ' ' : '';
-            masked += `${mask}${code.length}${shape}${mask}`;
-            code.push(segment);
-            continue;
-        }
-        masked += segment;
-    }
-    // A code segment that ends the text is the unterminated fence: every
-    // closed run is followed by a prose slice, even an empty one, so only an
-    // unclosed one leaves the segments ending on a code index. Named, not
-    // last: a rewrite may have moved it, and it is the segment that ran to
-    // the text's end when it was cut, wherever it now sits.
-    const unterminated = segments.length % 2 === 0 ? code.length - 1 : -1;
-    // Where each code segment ends up in the converted text, which is not
-    // where it started: the prose around it changes length as it is
-    // rewritten, and the masks are the only record of where it went. Split
-    // on the names, so the pieces alternate prose and the name of the
-    // segment that follows it.
-    const pieces = convertInline(masked).split(new RegExp(`${mask}(\\d+)[ \\n]?${mask}`));
-    const spans = [];
-    let converted = pieces[0] ?? '';
-    for (let piece = 1; piece < pieces.length; piece += 2) {
-        const named = Number(pieces[piece]);
-        const segment = code[named] ?? '';
-        // The unterminated fence has no end to be past, so nothing may be
-        // appended after it either — recording the end as it looks would say a
-        // marker placed at the text's end was safely outside.
-        const ends = named === unterminated
-            ? Number.POSITIVE_INFINITY
-            : converted.length + segment.length;
-        spans.push([converted.length, ends]);
-        converted += `${segment}${pieces[piece + 1] ?? ''}`;
-    }
-    return convertHeadings(converted, spans);
-};
 const splitForSlack = (text) => {
     if (text.length <= SLACK_MAX_MESSAGE_CHARS) {
         return [text];
@@ -1452,7 +1303,9 @@ const approvalBlocks = (agentName, toolName, risk, requestId, input, origin, one
  * Session keys are `slack:<agent>:<team>:<channel>:<thread_ts ?? ts>`
  * (DMs: the DM channel id alone), so threads are resumable conversations
  * and two agents sharing a thread keep fully separate sessions. Replies
- * stream via placeholder-then-edit, throttled for chat.update limits.
+ * post once, finished, behind Slack's loading status — or, in the `stream`
+ * reply mode, stream via placeholder-then-edit, throttled for chat.update
+ * limits.
  *
  * A mention starts a thread conversation; inside one, the agent keeps
  * listening without being tagged again — see `couldBeFollowUp` and
@@ -1480,6 +1333,12 @@ export const createSlackChannelAdapter = (options) => {
     // to the FIRST registered renderer (the running turn), never a later
     // message's placeholder. Each handler removes exactly its own renderer.
     const renderers = new Map();
+    /**
+     * Per session, what the newest `final` reply has left to post. A `final`
+     * turn holds no place in the thread until it posts, so each waits for
+     * the one queued ahead of it — see `ReplyRenderer.after`.
+     */
+    const replyOrder = new Map();
     /**
      * Files a turn nobody here rendered produced — a recovery's screenshot,
      * say — keyed by session, waiting for the turn's outcome to be posted so
@@ -1630,6 +1489,39 @@ export const createSlackChannelAdapter = (options) => {
             return userId;
         }
     };
+    /**
+     * A display name as the model may read it: one line, bounded. It is text
+     * its owner typed into their profile, and it lands in the speaker
+     * position of a user turn (`Name: text`) or as `@Name` inside one — where
+     * a newline, or a name long enough to be a paragraph, would let its owner
+     * speak in a place nobody vouched for. Escaped rather than dropped, the
+     * way memory entries are, so a strange name still reads as strange.
+     */
+    const boundedDisplayName = (name) => {
+        // Code points, not UTF-16 units: an emoji is one character of a name,
+        // and a cut inside a surrogate pair is a malformed speaker.
+        const characters = Array.from(escapeControlCharacters(name).trim());
+        return characters.length > MAX_DISPLAY_NAME_LENGTH
+            ? `${characters.slice(0, MAX_DISPLAY_NAME_LENGTH - 1).join('')}…`
+            : characters.join('');
+    };
+    /**
+     * Who is speaking, as the model reads it. A principal's profile is
+     * trusted the way their messages are, so it is their display name. With
+     * a principals list in force everyone else is their stable id, as a
+     * mention of them already is: named, not quoted. With no list at all
+     * there is nobody to prefer, so every author keeps their name — the turn
+     * is labelled `unknown` either way. "No list" is the key being absent:
+     * an explicit empty list is how an agent is excluded from a shared one,
+     * and it means nobody is preferred, not that nobody has been named.
+     */
+    const authorFor = async (connection, userId) => {
+        const principals = connection.config.principals;
+        if (principals !== undefined && !principals.includes(userId)) {
+            return userId;
+        }
+        return boundedDisplayName(await displayNameFor(connection, userId));
+    };
     // Mentions arrive as <@U123> markup; the model should read names.
     /**
      * `<@U…>` mentions become `@name` — for principals only. A display name
@@ -1648,12 +1540,25 @@ export const createSlackChannelAdapter = (options) => {
         let result = withoutBot;
         for (const id of new Set(ids)) {
             if (principals.has(id)) {
-                result = result.replaceAll(`<@${id}>`, `@${await displayNameFor(connection, id)}`);
+                result = result.replaceAll(`<@${id}>`, `@${boundedDisplayName(await displayNameFor(connection, id))}`);
             }
         }
         return result.trim();
     };
     const connectionFor = (agentId) => connections.find((candidate) => candidate.config.agentId === agentId);
+    /** An agent's configuration, whether or not its socket came up. */
+    const agentConfigFor = (agentId) => options.agents.find((candidate) => candidate.agentId === agentId);
+    /**
+     * Whether an agent takes a message from this sender at all — judged on
+     * its configuration, not on a live connection: an agent whose socket
+     * failed to start is still recognizable in a mention, and its door is
+     * still its own. An agent this adapter was never configured for is
+     * nobody's to refuse here, so it admits — the answer from before the
+     * door existed.
+     */
+    const admitsSender = (config, userId) => config === undefined
+        || config.admit !== 'principals'
+        || (config.principals ?? []).includes(userId);
     /**
      * How an agent listens, from its soul — read per message, so a roster
      * reload takes effect on the next one. `thread` when the soul says
@@ -2116,7 +2021,14 @@ export const createSlackChannelAdapter = (options) => {
             : event.reason === 'decided' && event.answer === 'always'
                 ? alwaysOutcome(post.always, post.agentName, post.agentId)
                 : OUTCOME_TEXT[`${event.reason}:${event.answer}`] ?? 'Resolved';
-        const by = event.actor ? ` by <@${event.actor}>` : '';
+        // A mention only for an actor this post knows as a Slack user — its
+        // approvers, which is the only set a click can come from. An approval
+        // decided through the control API arrives as `api:…` or `dashboard`,
+        // and `<@api:ops-bot>` is not a mention, it is a broken one; escaped
+        // plain text says who it was.
+        const by = event.actor
+            ? ` by ${post.approvers.has(event.actor) ? `<@${event.actor}>` : escapeSlackText(event.actor)}`
+            : '';
         const text = `*${escapeSlackText(post.agentName)}* — \`${escapeSlackText(post.toolName)}\` (${post.risk}): ${outcome}${by}.`;
         try {
             await post.connection.web.chat.update({
@@ -2472,10 +2384,17 @@ export const createSlackChannelAdapter = (options) => {
      * so is one whose `auth.test` itself failed, since its bot id was never
      * learned.
      */
-    const agentNamedIn = (text, team) => {
+    const agentNamedIn = (text, team, 
+    /**
+     * Whether a named agent would take this message at all. A message
+     * naming two agents hands the thread to one that admits the sender,
+     * not to the first one named: the agent that refuses will not answer,
+     * and a handover to it is a thread nobody holds.
+     */
+    admits = () => true) => {
         let offline;
         for (const [agentId, identity] of botIdentities) {
-            if (identity.teamId !== team || !mentions(text, identity.botUserId)) {
+            if (identity.teamId !== team || !mentions(text, identity.botUserId) || !admits(agentId)) {
                 continue;
             }
             if (connections.some((live) => live.config.agentId === agentId)) {
@@ -2664,6 +2583,9 @@ export const createSlackChannelAdapter = (options) => {
         if (event.user === connection.botUserId) {
             return undefined;
         }
+        // Bound once the guard above has run: the closures below cannot see
+        // that narrowing.
+        const sender = event.user;
         const isDm = event.channel_type === 'im';
         const team = args.body?.team_id ?? connection.teamId;
         // A top-level mention has no thread_ts; its own ts roots the reply
@@ -2684,9 +2606,76 @@ export const createSlackChannelAdapter = (options) => {
         // handover, Ava could take the next untagged reply while Bea's socket
         // was still behind, and answer a question that had just been handed
         // away. The message Ava must record is exactly the one Ava ignores.
-        const named = agentNamedIn(text, team);
-        if (threadKey && named) {
-            rememberAddressee(threadKey, named, event.ts);
+        // Who the message is for, judged on the named agents' own terms rather
+        // than this one's: agents may list different principals, and a sender
+        // Ava admits but Bea refuses must not be able to hand Bea the thread
+        // from Ava's socket — Bea's own socket refuses the same message, and
+        // the map is shared. A message naming Bea and Cy is Cy's, who will
+        // answer it and hold the thread. One naming only agents that refuse
+        // the sender is still theirs and not this agent's to answer — so the
+        // refusing agent stays `named`, and only the handover is withheld.
+        const handoverTo = agentNamedIn(text, team, (agentId) => admitsSender(agentConfigFor(agentId), sender));
+        const named = handoverTo ?? agentNamedIn(text, team);
+        // The key one Slack MESSAGE is known by, whichever delivery carried
+        // it; see the dedupe below for why it is not the event id.
+        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
+        // Recorded ahead of this agent's own refusal below, and on the named
+        // agent's admission rather than this one's: a sender Ava refuses and
+        // Bea admits has handed Bea the thread, and Ava's socket may be the
+        // one that hears it first. If Ava withheld the record, a fast untagged
+        // follow-up from someone Ava does admit would go to the old holder on
+        // Ava's socket and to Bea once Bea's socket caught up — two answers to
+        // one message. The refused message itself still takes no place in
+        // Ava's transcript; only the map learns who holds the thread.
+        if (threadKey && handoverTo) {
+            rememberAddressee(threadKey, handoverTo, event.ts);
+        }
+        // Who may speak at all, judged before anything below remembers this
+        // message. The adapter's own checks establish nothing about who is
+        // typing; under `admit: 'principals'` the operator's list is the door,
+        // not a label, and a sender not on it gets neither a turn nor a place
+        // in a transcript the agent reads — nor a say in who holds the thread
+        // beyond what the named agent's own admission above allowed.
+        // Logged rather than answered — a reply is a conversation with someone
+        // the operator chose not to have one with — and logged only for a
+        // message this agent would have taken up: a mention, or an untagged
+        // reply inside a thread this agent is known to hold. A channel
+        // subscribed for thread follow-through delivers every post and every
+        // reply in every thread, including the threads this agent was never
+        // part of, and a line per stranger per reply is a log with nothing
+        // left to read. Known from what this process has seen, as the
+        // admitted path below judges it; a thread nothing here remembers is
+        // one the sessions would have to be asked about, and a refused message
+        // does not get a place in that queue. Once per MESSAGE, on the same key
+        // the admitted path dedupes on: a mention arrives twice under both
+        // subscriptions, and a delivery Slack did not see acknowledged arrives
+        // again, and each copy would otherwise write its own line during
+        // exactly the traffic an operator reads the log to understand.
+        // Consuming the key here is safe because a refused message records
+        // nothing a later copy could be needed for.
+        if (!admitsSender(connection.config, sender)) {
+            const refusal = `slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`;
+            const held = threadKey !== undefined ? holderAt(threadKey, event.ts) : undefined;
+            if (addressed || held === connection.config.agentId) {
+                if (!alreadySeen(eventKey)) {
+                    log(refusal);
+                }
+            }
+            else if (held === undefined && event.thread_ts !== undefined && !alreadySeen(eventKey)) {
+                // Nothing in memory says whose thread this is — after a restart, or
+                // once the record was evicted — but the sessions may: the durable
+                // half of the question the admitted path asks, and the same
+                // verdict. Off the intake chain, because a refused message gets no
+                // place in that queue, and the line is an audit, not a turn; `track`
+                // holds it so `stop()` drains it like any other background work.
+                const thread = event.thread_ts;
+                track(followUpWinner({ team, conversation: event.channel, thread }, event.ts).then((winner) => {
+                    if (winner === connection.config.agentId) {
+                        log(refusal);
+                    }
+                }));
+            }
+            return undefined;
         }
         if (!addressed) {
             if (event.thread_ts === undefined) {
@@ -2708,7 +2697,6 @@ export const createSlackChannelAdapter = (options) => {
         // the one a connection sees second. And before every stand-down below,
         // because standing down is no longer nothing: an agent that hears a
         // message it is not answering must hear it once.
-        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
         if (alreadySeen(eventKey)) {
             return undefined;
         }
@@ -2889,7 +2877,7 @@ export const createSlackChannelAdapter = (options) => {
             if (cleaned.length === 0 && images.length === 0) {
                 return undefined;
             }
-            const author = await displayNameFor(connection, userId);
+            const author = await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
             // unambiguous. A bare image in a channel still says who sent it.
             const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
@@ -2934,9 +2922,28 @@ export const createSlackChannelAdapter = (options) => {
                 };
             }
             // A turn nobody asked for opens its placeholder on its first text,
-            // if it ever has any — see `ReplyRenderer.lazy`.
-            const renderer = new ReplyRenderer(connection.web, event.channel, thread, editIntervalMs, warn, { lazy: judged, now });
-            if (!judged) {
+            // if it ever has any — see `ReplyRenderer.lazy`. One the agent's
+            // reply mode does not stream opens none at all, and shows the
+            // loading status instead — see `ReplyRenderer.streaming`.
+            const streaming = connection.config.replies === 'stream';
+            const ahead = streaming ? undefined : replyOrder.get(sessionId);
+            const renderer = new ReplyRenderer(connection.web, event.channel, thread, editIntervalMs, warn, {
+                lazy: judged,
+                now,
+                streaming,
+                statusThread: thread ?? event.ts,
+                statusWarned: connection.statusWarned,
+                ...(ahead ? { after: ahead } : {}),
+            });
+            if (!streaming) {
+                replyOrder.set(sessionId, renderer.posted);
+                void renderer.posted.then(() => {
+                    if (replyOrder.get(sessionId) === renderer.posted) {
+                        replyOrder.delete(sessionId);
+                    }
+                });
+            }
+            if (!judged && streaming) {
                 try {
                     await renderer.open();
                 }
@@ -2951,6 +2958,7 @@ export const createSlackChannelAdapter = (options) => {
             const queue = renderers.get(sessionId) ?? [];
             queue.push(renderer);
             renderers.set(sessionId, queue);
+            renderer.showLoading(queue.length === 1);
             const turn = gateway.dispatch({
                 sessionId,
                 agentId: connection.config.agentId,
@@ -3031,6 +3039,9 @@ export const createSlackChannelAdapter = (options) => {
                 // running, which the other may therefore still take.
                 rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
             }
+            // The reply just posted took the thread's status down with it, and a
+            // turn queued behind this one is still working.
+            renderers.get(sessionId)?.[0]?.refreshLoading();
             await heard;
         }
         else {
@@ -3039,6 +3050,7 @@ export const createSlackChannelAdapter = (options) => {
                 // A file it posted before breaking is still the last thing said.
                 rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
             }
+            renderers.get(sessionId)?.[0]?.refreshLoading();
         }
     };
     return {
@@ -3055,7 +3067,9 @@ export const createSlackChannelAdapter = (options) => {
                     return;
                 }
                 if (event.type === 'tool.approval-resolved') {
-                    track(retractApprovalRequest(event));
+                    // The question was posted into the turn's thread, which took the
+                    // loading status down with it; the turn works on once answered.
+                    track(retractApprovalRequest(event).finally(() => renderers.get(event.sessionId)?.[0]?.refreshLoading()));
                     return;
                 }
                 // A turn ends here in one of two hands. One this adapter started
@@ -3126,12 +3140,18 @@ export const createSlackChannelAdapter = (options) => {
                 // connection — never leaves the queued reply stalled behind it.
                 if (event.type === 'session.failed' && !rendered) {
                     const claim = head?.reserveHandover();
-                    track(reportUnrenderedFailure(event, claim, takeUnrenderedFiles(event.sessionId)).finally(() => claim?.release()));
+                    track(reportUnrenderedFailure(event, claim, takeUnrenderedFiles(event.sessionId)).finally(() => {
+                        claim?.release();
+                        head?.refreshLoading();
+                    }));
                     return;
                 }
                 if (event.type === 'session.completed' && !rendered) {
                     const claim = head?.reserveHandover();
-                    track(reportUnrenderedReply(event, claim, takeUnrenderedFiles(event.sessionId)).finally(() => claim?.release()));
+                    track(reportUnrenderedReply(event, claim, takeUnrenderedFiles(event.sessionId)).finally(() => {
+                        claim?.release();
+                        head?.refreshLoading();
+                    }));
                     return;
                 }
                 if ('sessionId' in event) {
@@ -3166,6 +3186,7 @@ export const createSlackChannelAdapter = (options) => {
                         socket: createSocket(config.appToken),
                         botUserId,
                         teamId,
+                        statusWarned: { value: false },
                     });
                 }
                 catch (error) {