@stratusagent/channel-slack 0.12.0 → 0.12.2

package/dist/index.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { lstat, open, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, readFile, realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
@@ -92,6 +93,12 @@ const NO_REPLY_TEXT = '(no reply)';
 const EARLIER_MESSAGE_LIMIT = 40;
 /** The most pages of 200 read from a thread for that: 4,000 replies. */
 const EARLIER_THREAD_PAGES = 20;
+/**
+ * The holder-record name for a bot this adapter does not serve: an agent on
+ * another gateway, or any other app. The colon keeps it from ever equaling
+ * an agent id, so the holder rule reads it as "somebody else's".
+ */
+const FOREIGN_SPEAKER_PREFIX = 'slack-bot:';
 /**
  * At the top of a channel, how many of its most recent messages a mention
  * opens with, and how many are read to find them.
@@ -1646,6 +1653,136 @@ const TEXT_ATTACHMENT_MAX_BYTES = 100 * 1024;
  * is a cost decision as much as a context one.
  */
 const TEXT_ATTACHMENTS_MAX_TOTAL_BYTES = 200 * 1024;
+/**
+ * The most a text attachment may weigh to be saved to the agent's
+ * workspace when it is too large to read into the message. A 251 KB
+ * Markdown spec reached an agent as a filename and it had no way to open
+ * it; saved, the agent reads it with its file tools, in parts.
+ */
+const TEXT_ATTACHMENT_SAVE_MAX_BYTES = 10 * 1024 * 1024;
+/** The default bound on one agent's saved attachments, all together. */
+const SAVED_ATTACHMENTS_MAX_BYTES = 256 * 1024 * 1024;
+/**
+ * The most saved attachments one agent keeps, whatever they weigh. A file
+ * crowded out of a full message is saved however small it is, and each save
+ * is a ledger record, so the count is bounded as well as the bytes.
+ */
+const SAVED_ATTACHMENTS_MAX_FILES = 1_000;
+/** Under the agent's workspace, where saved attachments go. */
+const SAVED_ATTACHMENTS_DIR = path.join('attachments', 'slack');
+/**
+ * A file name safe to join under a directory: Slack's name is whatever the
+ * uploader's client sent, so separators, `..`, and control characters are
+ * replaced rather than trusted. Stamped, so the same file shared twice is
+ * two saves rather than a name already taken.
+ */
+const savedAttachmentName = (file, now) => {
+    const base = ((file.name ?? file.title ?? '').split(/[\\/]/).pop() ?? '').replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^[._]+/, '').slice(0, 120);
+    const id = (file.id ?? '').replace(/[^A-Za-z0-9]+/g, '').slice(0, 32);
+    return [now.toString(36), ...(id.length > 0 ? [id] : []), base.length > 0 ? base : 'attachment'].join('-');
+};
+/**
+ * Refuses a save that would take the directory's regular files past
+ * `maxBytes` together, or its entries past `SAVED_ATTACHMENTS_MAX_FILES`. Refused rather than making room: deleting on a
+ * Slack member's say is a worse failure than a full directory, and with
+ * nothing removed every ledger record still names a file that exists.
+ */
+const ensureRoom = async (dir, incoming, maxBytes) => {
+    let total = 0;
+    const names = await readdir(dir);
+    for (const name of names) {
+        const info = await lstat(path.join(dir, name)).catch(() => undefined);
+        total += info?.isFile() ? info.size : 0;
+    }
+    if (names.length >= SAVED_ATTACHMENTS_MAX_FILES) {
+        throw new Error(`${dir} already holds ${SAVED_ATTACHMENTS_MAX_FILES} saved attachments; remove files there to save more`);
+    }
+    if (total + incoming > maxBytes) {
+        throw new Error(`saved attachments in ${dir} would pass their ${maxBytes}-byte bound; remove files there to save more`);
+    }
+};
+/**
+ * One save at a time per directory, across messages and sessions: two
+ * concurrent saves would each measure the same free space and both write.
+ */
+const saveChains = new Map();
+const serialized = (key, run) => {
+    const previous = saveChains.get(key) ?? Promise.resolve();
+    const next = previous.catch(() => undefined).then(run);
+    const settled = next.catch(() => undefined);
+    saveChains.set(key, settled);
+    void settled.then(() => {
+        if (saveChains.get(key) === settled) {
+            saveChains.delete(key);
+        }
+    });
+    return next;
+};
+/**
+ * The saver for one agent and one sender. The directory is canonical
+ * because the ledger is keyed the way `fs.read` looks a path up, through
+ * `realpath`. The path is recorded before the bytes land, so a crash
+ * between the two leaves a labelled path with no file, never a file with
+ * no label; and the file is created exclusively, so a link planted at the
+ * name fails the save rather than carrying the bytes somewhere the ledger
+ * never saw.
+ */
+const createAttachmentSaver = (store, agentId, trust, now) => async (file, body) => {
+    const workspace = store.workspaces.prepare(agentId);
+    const lexical = path.join(workspace, SAVED_ATTACHMENTS_DIR);
+    // One component at a time, never through a link: a recursive mkdir would
+    // follow a link planted at `attachments` and create `slack` wherever it
+    // points before the check below could refuse it.
+    await mkdir(workspace, { recursive: true, mode: 0o700 });
+    let at = workspace;
+    for (const part of SAVED_ATTACHMENTS_DIR.split(path.sep)) {
+        at = path.join(at, part);
+        await mkdir(at, { mode: 0o700 }).catch((error) => {
+            if (error.code !== 'EEXIST') {
+                throw error;
+            }
+        });
+        const info = await lstat(at);
+        if (!info.isDirectory()) {
+            throw new Error(`${at} is not a directory of the workspace's own`);
+        }
+    }
+    // The directory must be exactly where the workspace says, through no link
+    // of its own: one already planted at `attachments` or `attachments/slack`
+    // would put the file outside the workspace, where the agent's file tools
+    // cannot read it and nothing should be written on a Slack member's say.
+    const dir = await realpath(lexical);
+    if (dir !== path.join(await realpath(workspace), SAVED_ATTACHMENTS_DIR)) {
+        throw new Error(`${lexical} is a link, not the workspace's own directory`);
+    }
+    return serialized(dir, async () => {
+        await ensureRoom(dir, body.length, store.maxBytes ?? SAVED_ATTACHMENTS_MAX_BYTES);
+        const target = path.join(dir, savedAttachmentName(file, now()));
+        await store.ledger.recordWrite(agentId, target, trust);
+        // O_EXCL and O_NOFOLLOW guard only the last component. A directory on the
+        // way swapped for a link after the record would send the create somewhere
+        // else, so the open file is checked against the recorded name before a
+        // byte is written (the same check as the plugins package's
+        // `nameIdentifiesHandle`). A refused save leaves the empty file rather
+        // than unlinking through a name that just proved it can move.
+        const handle = await open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            const [canonical, atName, held] = await Promise.all([
+                realpath(target).catch(() => undefined),
+                lstat(target).catch(() => undefined),
+                handle.stat(),
+            ]);
+            if (canonical !== target || atName === undefined || atName.dev !== held.dev || atName.ino !== held.ino) {
+                throw new Error(`${target} moved between its provenance record and its write`);
+            }
+            await handle.writeFile(body);
+        }
+        finally {
+            await handle.close();
+        }
+        return target;
+    });
+};
 const TEXT_APPLICATION_TYPES = new Set([
     'application/json',
     'application/xml',
@@ -1683,8 +1820,9 @@ const isTextAttachment = (file) => {
  * caps, or comes back as a page stays in `unread` and is named in the
  * note, exactly as before; the warning says why.
  */
-const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadline, warn, reasons) => {
+const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadline, warn, reasons, save) => {
     const texts = [];
+    const saved = [];
     const unread = [];
     const skip = (file, reason) => {
         unread.push(file);
@@ -1706,8 +1844,13 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             continue;
         }
         const maxBytes = Math.min(TEXT_ATTACHMENT_MAX_BYTES, TEXT_ATTACHMENTS_MAX_TOTAL_BYTES - total);
-        if (file.size !== undefined && file.size > maxBytes) {
-            warn(`slack: ${fileLabel(file)} is ${file.size} bytes, over the ${maxBytes} bytes of text this message could still take; the turn is told it cannot be read. Paste the part that matters, or split the file.`);
+        // Over the inline cap, a file is still downloaded when it can be saved
+        // to the workspace instead; only over that cap too is it a name.
+        const limit = save === undefined ? maxBytes : Math.max(maxBytes, TEXT_ATTACHMENT_SAVE_MAX_BYTES);
+        if (file.size !== undefined && file.size > limit) {
+            warn(save === undefined
+                ? `slack: ${fileLabel(file)} is ${file.size} bytes, over the ${maxBytes} bytes of text this message could still take; the turn is told it cannot be read. Paste the part that matters, or split the file.`
+                : `slack: ${fileLabel(file)} is ${file.size} bytes, over the ${limit} bytes a text attachment may be saved at; the turn is told it cannot be read. Paste the part that matters, or split the file.`);
             skip(file, 'too-large');
             continue;
         }
@@ -1718,7 +1861,7 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
         }
         let download;
         try {
-            download = await fetchFile(url, botToken, deadline, maxBytes);
+            download = await fetchFile(url, botToken, deadline, limit);
         }
         catch (error) {
             const reason = error instanceof Error && error.name === 'TimeoutError'
@@ -1737,8 +1880,8 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             skip(file, 'failed');
             continue;
         }
-        if (download.truncated === true || download.body.length > maxBytes) {
-            warn(`slack: ${fileLabel(file)} is larger than the ${maxBytes} bytes of text this message could still take; the download was abandoned and the turn is told it cannot be read.`);
+        if (download.truncated === true || download.body.length > limit) {
+            warn(`slack: ${fileLabel(file)} is larger than the ${limit} bytes ${save === undefined ? 'of text this message could still take' : 'a text attachment may be saved at'}; the download was abandoned and the turn is told it cannot be read.`);
             skip(file, 'too-large');
             continue;
         }
@@ -1751,11 +1894,24 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             skip(file, 'unreadable');
             continue;
         }
+        if (download.body.length > maxBytes) {
+            // Only reachable with a saver: `limit` is `maxBytes` without one.
+            try {
+                saved.push({ name: fileLabel(file), path: await save(file, download.body), bytes: download.body.length });
+            }
+            catch (error) {
+                warn(`slack: could not save ${fileLabel(file)} to the agent's workspace: ${error instanceof Error ? error.message : String(error)}. The turn is told it cannot be read.`);
+                skip(file, 'too-large');
+            }
+            continue;
+        }
         total += download.body.length;
         texts.push({ name: fileLabel(file), text });
     }
-    return { texts, unread };
+    return { texts, saved, unread };
 };
+/** Saved attachments, named with where each is, after what was said. */
+const savedAttachmentBlocks = (saved) => saved.map(({ name, path: at, bytes }) => `\n[Attached: ${name}, ${Math.ceil(bytes / 1024)} KB, too large to include here. It is saved in full at ${at}. Read it with your file tools, in parts if it is long.]`).join('');
 /** Read text attachments, set into the message after what was said. */
 const textAttachmentBlocks = (texts) => texts.map(({ name, text }) => `\n[Attached: ${name}. Its contents follow.]\n${text.replace(/\s+$/, '')}\n[End of ${name}]`).join('');
 /**
@@ -2080,6 +2236,12 @@ export const createSlackChannelAdapter = (options) => {
     const botIdentities = new Map();
     // Rendered approval requests, keyed by the gateway's request id — the
     // same id the buttons carry back.
+    //
+    // In memory only, and that is an open gap: a prompt posted by a process
+    // that died is never retracted unless someone clicks it (a click on a
+    // prompt this process never posted rewrites it from the click's own
+    // coordinates). Retracting the ones nobody clicks needs a durable index
+    // of these posts that survives the process that made them.
     const approvalPosts = new Map();
     // Credential requests whose post is in flight: Slack can show the message,
     // and take a click on it, before postMessage resolves here. The same
@@ -3306,7 +3468,8 @@ export const createSlackChannelAdapter = (options) => {
             // "Said nothing" as the session can tell it: no reply saved for the
             // turn. A line the old process had streamed into a placeholder and
             // never saved is invisible here — the session records what was
-            // said, not what Slack took (roadmap 31's open item) — so such a
+            // said, not what Slack took (the open delivery-record item at the
+            // gateway's lastSpokeAt) — so such a
             // turn is failed without a note under that line. Taken over the
             // alternative on purpose: a note for every judged turn a restart
             // caught turns a silent turn, the common case, into the
@@ -3374,9 +3537,13 @@ export const createSlackChannelAdapter = (options) => {
             return { said: routing.unaddressed === true, landed };
         }
         // A reply the thread's other agents hear like any other, taking their
-        // place for it before the post, as `handleInbound` does.
+        // place for it before the post, as `handleInbound` does. A DM thread
+        // has nobody else in it to hear, as on the live path.
         const published = postAheadOf(behind, connection, channel, thread, posting, uploads);
-        const heard = routing.reply !== undefined && thread !== undefined
+        const conversation = metadata[CONVERSATION_METADATA_KEY];
+        const isDm = typeof conversation === 'object' && conversation !== null && !Array.isArray(conversation)
+            && conversation.kind === 'direct';
+        const heard = routing.reply !== undefined && thread !== undefined && !isDm
             ? overhearReply(connection, channel, thread, routing.reply, routing, published)
             : undefined;
         const delivered = await published;
@@ -3799,6 +3966,142 @@ export const createSlackChannelAdapter = (options) => {
         }
         return undefined;
     };
+    /**
+     * Whether `user` is one of this adapter's own agents in `team`. Their
+     * replies reach the holder record through `ReplyOutcome.spokeAt`, and
+     * their sessions answer for them after a restart.
+     */
+    const isFleetBot = (team, user) => user !== undefined && [...botIdentities.values()].some((identity) => identity.teamId === team && identity.botUserId === user);
+    /**
+     * Records a bot this adapter does not serve as the thread's holder from
+     * the message it posted. An agent on another gateway answers in the same
+     * threads, and nothing in this process's sessions knows it spoke: without
+     * this, an agent here that spoke earlier keeps taking every untagged reply,
+     * and the reply meant for the other agent is answered twice. Only who
+     * spoke and when is kept, never what was said; the bot's message itself is
+     * still dropped by `admit`. Any app counts, an integration included: an
+     * untagged reply right after another app posted is not plainly this
+     * agent's, and naming the agent hands the thread back.
+     */
+    const noteForeignSpeaker = (connection, args) => {
+        const event = args.event;
+        if (!event || event.type !== 'message' || event.channel_type === 'im') {
+            return;
+        }
+        if (event.bot_id === undefined && event.subtype !== 'bot_message') {
+            return;
+        }
+        if (event.subtype !== undefined && event.subtype !== 'bot_message' && !HUMAN_MESSAGE_SUBTYPES.has(event.subtype)) {
+            // An edit, a deletion, a join: not somebody speaking.
+            return;
+        }
+        const team = args.body?.team_id ?? connection.teamId;
+        const speaker = event.user ?? event.bot_id;
+        if (speaker === undefined || isFleetBot(team, event.user)) {
+            return;
+        }
+        const thread = event.thread_ts ?? event.ts;
+        rememberAddressee(threadKeyFor({ team, conversation: event.channel, thread }), `${FOREIGN_SPEAKER_PREFIX}${speaker}`, event.ts);
+    };
+    /**
+     * The durable half of `noteForeignSpeaker`, for a thread this process has
+     * no record of: where each of `candidates` last held the thread, and where
+     * a bot this adapter does not serve last spoke, read from the thread
+     * itself. Held means an agent's own message there or a person's message
+     * naming it that it would admit, by position in the thread (its session's
+     * `lastSpokeAt` only when its bot user id is unknown). Undefined whenever
+     * it cannot tell: no thread read, a failed read, or a thread too long to
+     * reach its newest replies. Then the reply is routed as it was before
+     * this check.
+     */
+    const threadPositions = async (candidates, parts, ts) => {
+        const connection = connections.find((candidate) => candidate.config.agentId === candidates[0]?.agentId)
+            ?? connections.find((candidate) => candidate.teamId === parts.team);
+        const replies = connection?.web.conversations.replies;
+        if (!connection || !replies) {
+            return undefined;
+        }
+        // Positions in the thread, as the live record keeps them: a reply that
+        // filled a placeholder sits where the placeholder was posted, above
+        // anything posted while it was being written, though the transcript
+        // dates it later. `lastSpokeAt` stands in only when an agent's own
+        // messages can't be told apart in the read.
+        const held = new Map();
+        const byBotUser = new Map();
+        for (const candidate of candidates) {
+            const botUserId = botIdentities.get(candidate.agentId)?.botUserId;
+            if (botUserId !== undefined) {
+                byBotUser.set(botUserId, candidate.agentId);
+                held.set(candidate.agentId, 0);
+                continue;
+            }
+            const spoke = candidate.lastSpokeAt === undefined ? Number.NaN : Date.parse(candidate.lastSpokeAt) / 1000;
+            held.set(candidate.agentId, Number.isFinite(spoke) ? spoke : 0);
+        }
+        const place = (agentId, at) => {
+            held.set(agentId, Math.max(held.get(agentId) ?? 0, at));
+        };
+        let foreign = 0;
+        try {
+            let cursor;
+            let pages = 0;
+            do {
+                const page = await replies.call(connection.web.conversations, {
+                    channel: parts.conversation,
+                    ts: parts.thread,
+                    latest: ts,
+                    inclusive: false,
+                    limit: 200,
+                    ...(cursor ? { cursor } : {}),
+                });
+                pages += 1;
+                for (const message of page.messages ?? []) {
+                    const at = Number(message.ts);
+                    if (!Number.isFinite(at) || !(at < Number(ts))) {
+                        continue;
+                    }
+                    const own = message.user === undefined ? undefined : byBotUser.get(message.user);
+                    if (own !== undefined) {
+                        place(own, at);
+                        continue;
+                    }
+                    const bot = message.bot_id !== undefined || message.subtype === 'bot_message';
+                    if (bot) {
+                        // A bot's mention hands nothing over live (admit ignores bots),
+                        // so here it is only another app speaking, or a peer's words.
+                        if (!isFleetBot(parts.team, message.user)) {
+                            foreign = Math.max(foreign, at);
+                        }
+                        continue;
+                    }
+                    // A person naming an agent takes the thread for it only if that
+                    // agent would admit them, as the live handover does.
+                    const sender = message.user;
+                    if (sender === undefined) {
+                        continue;
+                    }
+                    const named = agentNamedIn(message.text ?? '', parts.team, (agentId) => admitsSender(agentConfigFor(agentId), sender));
+                    if (named !== undefined && held.has(named) && botIdentities.get(named)?.botUserId !== undefined) {
+                        place(named, at);
+                    }
+                }
+                cursor = page.response_metadata?.next_cursor || undefined;
+            } while (cursor && pages < EARLIER_THREAD_PAGES);
+            if (cursor) {
+                return undefined;
+            }
+        }
+        catch (error) {
+            warn(`slack: could not read thread ${parts.thread} in ${parts.conversation} to see who spoke last, so it is routed as before: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+        return { held, foreign };
+    };
+    /** Whether another app spoke in the thread after `agentId` last held it. */
+    const foreignSpokeSince = async (agentId, parts, ts, lastSpokeAt) => {
+        const read = await threadPositions([{ agentId, ...(lastSpokeAt !== undefined ? { lastSpokeAt } : {}) }], parts, ts);
+        return read !== undefined && read.foreign > (read.held.get(agentId) ?? 0);
+    };
     /**
      * Which of this process's agents a message names, or undefined if it
      * names none of them.
@@ -3959,13 +4262,13 @@ export const createSlackChannelAdapter = (options) => {
             }
             for (const [agentId, identity] of botIdentities) {
                 if (identity.teamId === parts.team && identity.botUserId === parts.parentUser) {
-                    return agentId;
+                    return await foreignSpokeSince(agentId, parts, ts, undefined) ? undefined : agentId;
                 }
             }
             return undefined;
         }
         if (engaged.length === 1) {
-            return first.agentId;
+            return await foreignSpokeSince(first.agentId, parts, ts, first.lastSpokeAt) ? undefined : first.agentId;
         }
         let latest;
         let tied = false;
@@ -3985,7 +4288,34 @@ export const createSlackChannelAdapter = (options) => {
                 tied = true;
             }
         }
-        return tied ? undefined : latest?.agentId;
+        const bySession = tied ? undefined : latest?.agentId;
+        // Sessions date a reply by when it finished, the thread by where its
+        // placeholder went up, and an agent on another gateway may have spoken
+        // since: only the thread can say who holds it. When it can't be read,
+        // the sessions decide, as before.
+        const read = await threadPositions(engaged, parts, ts);
+        if (!read) {
+            return bySession;
+        }
+        let holder;
+        let tiedAt = false;
+        for (const entry of engaged) {
+            const at = read.held.get(entry.agentId) ?? 0;
+            if (at <= 0) {
+                continue;
+            }
+            if (!holder || at > holder.at) {
+                holder = { agentId: entry.agentId, at };
+                tiedAt = false;
+            }
+            else if (at === holder.at) {
+                tiedAt = true;
+            }
+        }
+        if (!holder) {
+            return read.foreign > 0 ? undefined : bySession;
+        }
+        return tiedAt || read.foreign > holder.at ? undefined : holder.agentId;
     };
     /**
      * `resolveFollowUpWinner`, resolved ONCE PER MESSAGE and shared by every
@@ -4060,6 +4390,9 @@ export const createSlackChannelAdapter = (options) => {
      */
     const admit = (connection, args) => {
         const event = args.event;
+        if (gatewayRef) {
+            noteForeignSpeaker(connection, args);
+        }
         if (!gatewayRef || !event || !event.user || event.bot_id || !isPersonSpeaking(event)) {
             return undefined;
         }
@@ -4075,9 +4408,10 @@ export const createSlackChannelAdapter = (options) => {
         const isDm = event.channel_type === 'im';
         const team = args.body?.team_id ?? connection.teamId;
         // A top-level mention has no thread_ts; its own ts roots the reply
-        // thread that becomes the conversation. DMs are one conversation per
-        // peer, unkeyed by thread.
-        const thread = isDm ? undefined : event.thread_ts ?? event.ts;
+        // thread that becomes the conversation. A DM's top level is one
+        // conversation per peer, unkeyed by thread; a thread inside the DM is a
+        // conversation of its own, answered in that thread.
+        const thread = isDm ? event.thread_ts : event.thread_ts ?? event.ts;
         // Threads only: a DM has one agent by construction.
         const threadKey = thread !== undefined && !isDm
             ? threadKeyFor({ team, conversation: event.channel, thread })
@@ -4400,20 +4734,22 @@ export const createSlackChannelAdapter = (options) => {
             const { images, unread: notImages } = overhear || judged
                 ? { images: [], unread: event.files ?? [] }
                 : await readImageAttachments(event.files ?? [], connection.config.botToken, fetchFile, fileDownloadTimeoutMs, warn, reasons, deadline);
-            const { texts, unread } = overhear || judged
-                ? { texts: [], unread: notImages }
-                : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons);
+            const { texts, saved, unread } = overhear || judged
+                ? { texts: [], saved: [], unread: notImages }
+                : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons, options.attachmentStore
+                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, senderTrustFor(connection.config, userId), options.now ?? Date.now)
+                    : undefined);
             // An image or a document with nothing said is still a question
             // ("what's this?"); a file the turn could not open with nothing said
             // is not one, and gets no reply.
-            if (cleaned.length === 0 && images.length === 0 && texts.length === 0) {
+            if (cleaned.length === 0 && images.length === 0 && texts.length === 0 && saved.length === 0) {
                 return undefined;
             }
             const author = await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
             // unambiguous. A bare image in a channel still says who sent it.
             const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
-            const userMessage = `${spoken}${textAttachmentBlocks(texts)}${attachmentNote(unread, reasons)}`;
+            const userMessage = `${spoken}${textAttachmentBlocks(texts)}${savedAttachmentBlocks(saved)}${attachmentNote(unread, reasons)}`;
             // Who sent this, judged against the operator's list — per message,
             // never remembered from the first one in the thread. A DM proves
             // nothing about who is typing, so a DM from an unlisted member is
@@ -4432,7 +4768,9 @@ export const createSlackChannelAdapter = (options) => {
                 : {
                     ...room,
                     ...(room.kind === 'direct' && senderTrust === 'user' ? { with: author } : {}),
-                    ...(thread !== undefined && room.kind !== 'direct' ? { thread: true, threadRoot: thread } : {}),
+                    // A DM thread is a thread too, with its own session; core takes
+                    // no root for a direct room, since nothing posts to one by id.
+                    ...(thread !== undefined ? { thread: true, ...(room.kind !== 'direct' ? { threadRoot: thread } : {}) } : {}),
                     // People outside this workspace read a Slack Connect channel, and
                     // the event says so itself, even when the lookup failed.
                     ...(room.kind !== 'direct' && args.body?.is_ext_shared_channel === true ? { shared: true } : {}),
@@ -4478,7 +4816,7 @@ export const createSlackChannelAdapter = (options) => {
             // said before this. Inside the chain, before the placeholder, so the
             // read cannot reorder this message against the next one.
             let earlier = [];
-            if (!isDm && thread !== undefined) {
+            if (thread !== undefined) {
                 // A top-level mention roots its own session, so it is new but for
                 // a redelivery, which the gateway answers without reading this.
                 let exists = false;
@@ -4512,7 +4850,8 @@ export const createSlackChannelAdapter = (options) => {
                 // while the tool it preceded is still running. Under the session's
                 // label as stored, lowered by anything that tainted it during this
                 // turn, and the least trusted label where it cannot be read.
-                ...(thread !== undefined
+                // A DM thread has nobody else in it to hear.
+                ...(thread !== undefined && !isDm
                     ? {
                         onInterim: (heard, landed) => {
                             // Tracked, so a shutdown drains it like any other reaction:
@@ -4557,6 +4896,7 @@ export const createSlackChannelAdapter = (options) => {
             // key is shared, and the running turn's status stays up instead.
             renderer.showLoading(queue.length === 1 || queue[0]?.statusThread !== renderer.statusThread);
             let repeat;
+            let absorbed = false;
             const turn = gateway.dispatch({
                 sessionId,
                 agentId: connection.config.agentId,
@@ -4573,8 +4913,14 @@ export const createSlackChannelAdapter = (options) => {
                 onRepeat: (kind) => {
                     repeat = kind;
                 },
+                // Sent while a turn is running, this message is answered by the
+                // next turn together with everything else that queued (card 423);
+                // the first of them renders that answer.
+                onAbsorbed: () => {
+                    absorbed = true;
+                },
             });
-            return { renderer, turn, repeat: () => repeat };
+            return { renderer, turn, repeat: () => repeat, absorbed: () => absorbed };
         });
         const started = await intake;
         if (!started) {
@@ -4592,7 +4938,7 @@ export const createSlackChannelAdapter = (options) => {
             }
             return;
         }
-        const { renderer, turn, repeat } = started;
+        const { renderer, turn, repeat, absorbed } = started;
         const removeFromQueue = () => {
             const current = renderers.get(sessionId);
             if (current) {
@@ -4620,7 +4966,9 @@ export const createSlackChannelAdapter = (options) => {
         // The turn is a live earlier delivery's, and that delivery's renderer
         // posts its answer, or its failure: this one takes down whatever it put
         // up and says nothing.
-        if (repeat() === 'live') {
+        // Likewise a message absorbed into a merged turn: the turn's leading
+        // message's renderer answers for all of them.
+        if (repeat() === 'live' || absorbed()) {
             await renderer.withdraw();
             renderers.get(sessionId)?.[0]?.refreshLoading();
             return;
@@ -4693,7 +5041,7 @@ export const createSlackChannelAdapter = (options) => {
                 replyLanded = outcome.published;
                 return true;
             }, () => true);
-            const heard = thread !== undefined
+            const heard = thread !== undefined && !isDm
                 ? overhearReply(connection, event.channel, thread, () => renderer.spokenText(replyLanded ? reply ?? '' : ''), session, settled)
                 : undefined;
             const { spoke, spokeAt } = await finalized;