@stratusagent/channel-slack 0.12.3 → 0.12.4

package/dist/index.js

@@ -3,7 +3,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, readdir, readFile, realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
+import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, RunAbortedError, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
 import { admitsSender, channelSessionKey, senderTrustFor, } from '@stratusagent/channels';
 import { codeRunsOf, toSlackMrkdwn } from "./mrkdwn.js";
 /**
@@ -44,6 +44,13 @@ const COLD_VERDICT_CAPACITY = 256;
  * socket stays behind for all of them.
  */
 const THREAD_HANDOVER_DEPTH = 32;
+/**
+ * How many agent mentions one thread admits in a row before a person has
+ * to speak there again (card 513): enough for a question, an answer and a
+ * follow-up each way, and a stop to two agents tagging each other forever.
+ * Counted per daemon, in memory; a restart starts it again.
+ */
+export const AGENT_MENTION_HOP_LIMIT = 4;
 /**
  * How many files an unrendered turn may queue for its outcome. Nothing
  * drains that queue until the outcome arrives, so a session whose outcome
@@ -323,6 +330,14 @@ class ReplyRenderer {
      * not be this one.
      */
     turnId = randomUUID();
+    /**
+     * What a Slack stop aborts (card 337): the signal this renderer's dispatch
+     * runs under, so a stop cancels this turn whether it is running or still
+     * queued behind another.
+     */
+    controller = new AbortController();
+    /** The Slack user who stopped this turn, once someone has. */
+    stoppedBy;
     buffer = '';
     /**
      * In `final` mode, what the model has said since its last tool call. A
@@ -1113,6 +1128,18 @@ class ReplyRenderer {
             this.settle();
         }
     }
+    /**
+     * Ends a turn an approver stopped from Slack: says who stopped it where
+     * the reply would have gone. A turn nobody asked for that had said
+     * nothing stays silent, as its failure would.
+     */
+    async stopped(by) {
+        await this.editChain;
+        if (this.lazy && !this.ref && this.buffer.trim().length === 0) {
+            return this.finalize('');
+        }
+        return this.finalize(`Stopped by <@${by}>.`);
+    }
     async fail(message) {
         // The same wait `finalize` takes, for the same reason: a lazy turn's
         // first text may be opening its placeholder right now, and a failure
@@ -1411,6 +1438,8 @@ const alwaysOutcome = (always, agentName, agentId) => {
             return 'Allowed, and this site is now acted on without asking — until revoked';
         case 'tool':
             return `Allowed, and granted to ${escapeSlackText(agentName)} until revoked (stratus grants ${escapeSlackText(agentId)})`;
+        case 'destination':
+            return `Allowed, and granted to ${escapeSlackText(agentName)} for this conversation until revoked (stratus grants ${escapeSlackText(agentId)})`;
         case 'session':
             return 'Allowed for the rest of this session';
         default:
@@ -1430,6 +1459,8 @@ const alwaysOffer = (always, agentName) => {
     switch (always) {
         case 'tool':
             return `*Always allow* grants this tool to ${escapeSlackText(agentName)} until an operator revokes it.`;
+        case 'destination':
+            return `*Always allow* lets ${escapeSlackText(agentName)} use this tool on this conversation without asking, until revoked.`;
         case 'session':
             return '*Always allow* stops this tool asking again for the rest of this session.';
         case 'scope':
@@ -1458,6 +1489,12 @@ const APPROVAL_SUMMARY_LIMIT = 160;
  * words, and marked only by how it is rendered.
  */
 const HUMAN_MESSAGE_SUBTYPES = new Set(['file_share', 'me_message', 'thread_broadcast']);
+/**
+ * Message subtypes that are another agent's bot speaking (card 513): a plain
+ * bot post, an upload with a comment, or a thread reply also sent to the
+ * channel. Edits, deletions and joins are never a mention to answer.
+ */
+const AGENT_SPEECH_SUBTYPES = new Set(['bot_message', 'file_share', 'thread_broadcast']);
 const isPersonSpeaking = (event) => event.subtype === undefined || HUMAN_MESSAGE_SUBTYPES.has(event.subtype);
 /** At most this many attachment names are listed; the rest are counted. */
 const MAX_LISTED_ATTACHMENTS = 5;
@@ -1921,6 +1958,20 @@ const textAttachmentBlocks = (texts) => texts.map(({ name, text }) => `\n[Attach
  * sees.
  */
 const mentions = (text, botUserId) => botUserId.length > 0 && text.includes(`<@${botUserId}>`);
+/**
+ * Whether a message asks this agent to stop (card 337): the word "stop"
+ * and nothing else but mentions and closing punctuation, in any case. A
+ * message that mentions someone and not this agent is for them. Exported
+ * for tests.
+ */
+export const isStopRequest = (text, botUserId) => {
+    const mentioned = [...text.matchAll(/<@([^>|]+)(?:\|[^>]*)?>/g)].map((match) => match[1]);
+    if (mentioned.length > 0 && !mentioned.includes(botUserId)) {
+        return false;
+    }
+    const words = text.replace(/<@[^>|]+(?:\|[^>]*)?>/g, ' ').trim().replace(/[.!]+$/, '').trim();
+    return words.toLowerCase() === 'stop';
+};
 /**
  * Slack's three markup characters. Tool input is written by a model, so it
  * reaches this message as untrusted text: unescaped, `<@U123>` becomes a
@@ -2124,6 +2175,19 @@ const credentialModal = (post, requestId) => ({
  */
 /** Uncached author names one `message.read` looks up; the rest keep their id. */
 const READ_NAME_LOOKUPS = 10;
+/**
+ * Orders two Slack message timestamps ("seconds.micros"). Compared as
+ * integers, not floats: a current ts has more digits than a double holds.
+ */
+const compareSlackTs = (left, right) => {
+    const [leftSeconds = '0', leftMicros = ''] = left.split('.');
+    const [rightSeconds = '0', rightMicros = ''] = right.split('.');
+    const seconds = Number(leftSeconds) - Number(rightSeconds);
+    if (seconds !== 0) {
+        return Math.sign(seconds);
+    }
+    return Math.sign(Number(leftMicros.padEnd(6, '0').slice(0, 6)) - Number(rightMicros.padEnd(6, '0').slice(0, 6)));
+};
 export const createSlackChannelAdapter = (options) => {
     const log = options.log ?? (() => { });
     const warn = options.warn ?? (() => { });
@@ -2161,6 +2225,15 @@ export const createSlackChannelAdapter = (options) => {
     // Per-session intake chains: the pre-dispatch pipeline (lookups,
     // placeholder, dispatch call) runs in Slack receipt order.
     const intakeChains = new Map();
+    /**
+     * Stop (card 337), for messages still in intake: how many each session
+     * has between claiming a place on its chain and reaching `renderers`, and
+     * the latest stop to land there. A message compares the stop it claimed
+     * its place under with the one in force when it is about to dispatch, so a
+     * stop also cancels a message whose lookups were still running.
+     */
+    const intakeInFlight = new Map();
+    const stopsBySession = new Map();
     const displayNames = new Map();
     // Socket Mode redelivers on missed acks; a slow turn must not run twice.
     const seenEvents = new Set();
@@ -2382,8 +2455,12 @@ export const createSlackChannelAdapter = (options) => {
                 // as an unlisted person. This fleet's own agents are not: they are
                 // the conversation the mention joins — an authenticated peer whose
                 // socket failed to start included, since what it said is still its.
+                // Nor is a remote team agent this one answers (card 513): its
+                // mention is admitted, so what it said before the mention is too.
                 return admitsSender(connection.config, message.user ?? '')
-                    || (message.user !== undefined && [...botIdentities.values()].some((peer) => peer.teamId === connection.teamId && peer.botUserId === message.user));
+                    || (message.user !== undefined && [...botIdentities.values()].some((peer) => peer.teamId === connection.teamId && peer.botUserId === message.user))
+                    || (message.user !== undefined && connection.teamId !== undefined
+                        && answersAgentMention(connection.config.agentId, connection.teamId, message.user));
             }
             return message.user !== undefined
                 && isPersonSpeaking({ type: 'message', ts: message.ts, channel, ...(message.subtype ? { subtype: message.subtype } : {}) })
@@ -3972,6 +4049,13 @@ export const createSlackChannelAdapter = (options) => {
      * their sessions answer for them after a restart.
      */
     const isFleetBot = (team, user) => user !== undefined && [...botIdentities.values()].some((identity) => identity.teamId === team && identity.botUserId === user);
+    /**
+     * Whether a bot message is a team agent asking one of this daemon's
+     * agents something (card 513): a question, not another voice taking the
+     * thread. The agent asked answers it, and the thread stays with whoever
+     * held it. Used live and when a thread is read back after a restart.
+     */
+    const asksAgentHere = (team, asker, text) => asker !== undefined && [...botIdentities].some(([agentId, identity]) => identity.teamId === team && mentions(text ?? '', identity.botUserId) && answersAgentMention(agentId, team, asker));
     /**
      * Records a bot this adapter does not serve as the thread's holder from
      * the message it posted. An agent on another gateway answers in the same
@@ -4000,6 +4084,9 @@ export const createSlackChannelAdapter = (options) => {
         if (speaker === undefined || isFleetBot(team, event.user)) {
             return;
         }
+        if (asksAgentHere(team, event.user, event.text)) {
+            return;
+        }
         const thread = event.thread_ts ?? event.ts;
         rememberAddressee(threadKeyFor({ team, conversation: event.channel, thread }), `${FOREIGN_SPEAKER_PREFIX}${speaker}`, event.ts);
     };
@@ -4069,7 +4156,7 @@ export const createSlackChannelAdapter = (options) => {
                     if (bot) {
                         // A bot's mention hands nothing over live (admit ignores bots),
                         // so here it is only another app speaking, or a peer's words.
-                        if (!isFleetBot(parts.team, message.user)) {
+                        if (!isFleetBot(parts.team, message.user) && !asksAgentHere(parts.team, message.user, message.text)) {
                             foreign = Math.max(foreign, at);
                         }
                         continue;
@@ -4388,11 +4475,178 @@ export const createSlackChannelAdapter = (options) => {
      * case, where by definition no message of this thread has been seen in
      * this process.
      */
+    /**
+     * Stop (card 337): cancels every turn this agent is running or has queued
+     * in this conversation, including messages still in intake, and says
+     * nothing was stopped when there was nothing to stop. Synchronous, and
+     * called off the intake chain before any dispatch, so a stop is never
+     * queued behind the turn it stops nor merged into the next one. The
+     * caller has checked that the sender is an approver: a stop throws away
+     * work someone else asked for.
+     *
+     * `fromIntake` is a stop that could only be placed on the intake chain,
+     * once the sessions named this agent (the cold case). Everything ahead of
+     * it on the chain has already been dispatched, and everything still in
+     * intake arrived after it, so it cancels the dispatched turns only.
+     */
+    const stopTurns = (connection, sessionId, userId, channel, fromIntake = false) => {
+        const running = renderers.get(sessionId) ?? [];
+        const inIntake = fromIntake ? 0 : intakeInFlight.get(sessionId) ?? 0;
+        if (running.length === 0 && inIntake === 0) {
+            return false;
+        }
+        for (const renderer of running) {
+            if (renderer.stoppedBy === undefined) {
+                renderer.stoppedBy = userId;
+                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${userId}`));
+            }
+        }
+        if (inIntake > 0) {
+            stopsBySession.set(sessionId, { count: (stopsBySession.get(sessionId)?.count ?? 0) + 1, by: userId });
+        }
+        log(`slack: ${userId} stopped ${running.length + inIntake} turn(s) of ${connection.config.agentId} in ${channel}`);
+        return true;
+    };
+    /**
+     * Agent mentions admitted per thread since a person last spoke there, by
+     * message ts (card 513). A copy of one message reaching a second socket,
+     * or redelivered, is the same hop. Bounded like the addressee map.
+     */
+    const agentHops = new Map();
+    /**
+     * Which team agent a bot user in `team` is, for the agent configured by
+     * `config` in workspace `agentTeam`, if any. A configured id counts only
+     * in that agent's own workspace: user ids are unique per workspace, so the
+     * same id elsewhere is some other bot.
+     */
+    const teamAgentFor = (config, agentTeam, team, botUser) => {
+        for (const [agentId, identity] of botIdentities) {
+            if (identity.teamId === team && identity.botUserId === botUser) {
+                return agentId;
+            }
+        }
+        if (agentTeam === undefined || agentTeam !== team) {
+            return undefined;
+        }
+        for (const [name, id] of Object.entries(config.agentMentions?.team ?? {})) {
+            if (id === botUser) {
+                return name;
+            }
+        }
+        return undefined;
+    };
+    /**
+     * Whether `agentId` answers a mention from `botUser` in `team`: it has
+     * agent mentions on, the bot is a team agent to it, and on its list if it
+     * keeps one. The hop limit is not asked here.
+     */
+    const answersAgentMention = (agentId, team, botUser) => {
+        const config = agentConfigFor(agentId);
+        const settings = config?.agentMentions;
+        if (!config || !settings) {
+            return false;
+        }
+        const name = teamAgentFor(config, botIdentities.get(agentId)?.teamId, team, botUser);
+        return name !== undefined && (settings.only === undefined || settings.only.includes(name));
+    };
+    /**
+     * A message another agent's bot posted, for an agent that answers team
+     * agents (`agentMentions`, card 513). Admitted only when it names this
+     * agent, comes from a team agent this one listens to, and the thread is
+     * under its hop limit; anything else from a bot is dropped, as every
+     * bot message was before. Never part of the holder rule: a bot naming an
+     * agent asks it one thing, and hands it nothing.
+     */
+    const admitAgentMention = (connection, args) => {
+        const event = args.event;
+        const settings = connection.config.agentMentions;
+        if (!settings || !event || event.user === undefined || event.user === connection.botUserId) {
+            return undefined;
+        }
+        if ((event.type !== 'app_mention' && event.type !== 'message') || event.channel_type === 'im') {
+            return undefined;
+        }
+        if (event.subtype !== undefined && !AGENT_SPEECH_SUBTYPES.has(event.subtype)) {
+            return undefined;
+        }
+        const text = event.text ?? '';
+        if (!mentions(text, connection.botUserId)) {
+            return undefined;
+        }
+        const team = args.body?.team_id ?? connection.teamId;
+        const name = teamAgentFor(connection.config, connection.teamId, team, event.user);
+        if (name === undefined) {
+            return undefined;
+        }
+        const eventKey = `${connection.config.agentId}:${event.channel}:${event.ts}`;
+        if (settings.only !== undefined && !settings.only.includes(name)) {
+            if (!alreadySeen(eventKey)) {
+                log(`slack: ${connection.config.agentId} ignored a mention from agent ${name}: not on its agent mention list`);
+            }
+            return undefined;
+        }
+        const thread = event.thread_ts ?? event.ts;
+        const threadKey = threadKeyFor({ team, conversation: event.channel, thread });
+        const hops = agentHops.get(threadKey) ?? [];
+        if (!hops.includes(event.ts)) {
+            if (hops.length >= AGENT_MENTION_HOP_LIMIT) {
+                if (!alreadySeen(eventKey)) {
+                    log(`slack: ${connection.config.agentId} ignored a mention from agent ${name}: the thread reached its hop limit of ${AGENT_MENTION_HOP_LIMIT} agent mentions; a person has to speak there first`);
+                }
+                return undefined;
+            }
+            agentHops.delete(threadKey);
+            agentHops.set(threadKey, [...hops, event.ts]);
+            if (agentHops.size > THREAD_ADDRESSEE_CAPACITY) {
+                const oldest = agentHops.keys().next();
+                if (!oldest.done) {
+                    agentHops.delete(oldest.value);
+                }
+            }
+        }
+        if (alreadySeen(eventKey)) {
+            return undefined;
+        }
+        return {
+            event,
+            isDm: false,
+            team,
+            eventKey,
+            userId: event.user,
+            sessionId: channelSessionKey({ channel: 'slack', agentId: connection.config.agentId, team, conversation: event.channel, thread }),
+            thread,
+            threadKey,
+            settled: true,
+            overhear: false,
+            judge: false,
+            fromAgent: name,
+        };
+    };
     const admit = (connection, args) => {
         const event = args.event;
         if (gatewayRef) {
             noteForeignSpeaker(connection, args);
         }
+        if (gatewayRef && event && (event.bot_id !== undefined || event.subtype === 'bot_message')) {
+            return admitAgentMention(connection, args);
+        }
+        if (event && event.user !== undefined && event.channel_type !== 'im' && isPersonSpeaking(event) && admitsSender(connection.config, event.user)) {
+            // A person this agent admits, speaking in a thread, ends a run of
+            // agent mentions there. Someone it refuses can't restart one. Only
+            // hops before the person's message reset: another agent's socket can
+            // deliver an older human message late, after newer hops.
+            const hopKey = threadKeyFor({ team: args.body?.team_id ?? connection.teamId, conversation: event.channel, thread: event.thread_ts ?? event.ts });
+            const hops = agentHops.get(hopKey);
+            if (hops) {
+                const newer = hops.filter((hop) => compareSlackTs(hop, event.ts) > 0);
+                if (newer.length > 0) {
+                    agentHops.set(hopKey, newer);
+                }
+                else {
+                    agentHops.delete(hopKey);
+                }
+            }
+        }
         if (!gatewayRef || !event || !event.user || event.bot_id || !isPersonSpeaking(event)) {
             return undefined;
         }
@@ -4496,6 +4750,27 @@ export const createSlackChannelAdapter = (options) => {
         // Consuming the key here is safe because a refused message records
         // nothing a later copy could be needed for.
         if (!admitsSender(connection.config, sender)) {
+            // An approver the operator did not list as a principal can still stop
+            // the agent (card 337): approving is its own grant. Only when the
+            // message names this agent (or is a DM to it), and nothing else they
+            // say gets through.
+            if (addressed &&
+                (connection.config.approvers ?? []).includes(sender) &&
+                isStopRequest(text, connection.botUserId) &&
+                !alreadySeen(eventKey)) {
+                const stopSession = channelSessionKey({
+                    channel: 'slack',
+                    agentId: connection.config.agentId,
+                    team,
+                    conversation: event.channel,
+                    ...(thread ? { thread } : {}),
+                });
+                if (stopTurns(connection, stopSession, sender, event.channel)) {
+                    return undefined;
+                }
+                log(`slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`);
+                return undefined;
+            }
             const refusal = `slack: ${connection.config.agentId} refused a message from ${sender}: not a listed principal, and admit is "principals"`;
             const held = threadKey !== undefined ? holderAt(threadKey, event.ts) : undefined;
             if (addressed || held === connection.config.agentId) {
@@ -4592,11 +4867,25 @@ export const createSlackChannelAdapter = (options) => {
         // "whose is an untagged reply", and for these two agents the soul has
         // already answered.
         const listens = listensOf(connection.config.agentId);
-        if (listens === 'mentions') {
-            return { ...admission, overhear: true };
-        }
-        if (listens === 'judge') {
-            return { ...admission, overhear: true, judge: true };
+        if (listens === 'mentions' || listens === 'judge') {
+            // Except a stop (card 337): the holder rule decides whose it is, as
+            // for any agent, and it only acts if there is something to stop. A
+            // thread the record has forgotten is left to the sessions, as below,
+            // so a stop for a turn that outlived its record still reaches it.
+            const approverStop = threadKey !== undefined &&
+                (connection.config.approvers ?? []).includes(sender) &&
+                isStopRequest(text, connection.botUserId);
+            const stopHolder = approverStop ? holderAt(threadKey, event.ts) : undefined;
+            // A stop held by another agent is only heard: judging it would let an
+            // attentive agent take a turn on a stop that was never its own.
+            const stopForAnother = stopHolder !== undefined && stopHolder !== connection.config.agentId;
+            return {
+                ...admission,
+                overhear: true,
+                ...(listens === 'judge' && !stopForAnother ? { judge: true } : {}),
+                ...(stopHolder === connection.config.agentId ? { holderStop: true } : {}),
+                ...(approverStop && stopHolder === undefined ? { settled: false } : {}),
+            };
         }
         // The record is what this process has actually seen, in the order it
         // saw it — right even inside the window before a handover reaches the
@@ -4652,6 +4941,19 @@ export const createSlackChannelAdapter = (options) => {
             return;
         }
         const { event, isDm, team, userId, thread, sessionId, threadKey, eventKey } = admitted;
+        // Stop (card 337), see `stopTurns`. Only a message addressed to this
+        // agent: an untagged reply this agent merely overhears is the holder's
+        // (unless this agent is the holder and only `listens` made it an
+        // overhear, see `holderStop`), and one only the sessions can place is
+        // not this agent's to act on yet.
+        if ((!admitted.overhear || admitted.holderStop === true) &&
+            admitted.settled &&
+            admitted.fromAgent === undefined &&
+            (connection.config.approvers ?? []).includes(userId) &&
+            isStopRequest(event.text ?? '', connection.botUserId) &&
+            stopTurns(connection, sessionId, userId, event.channel)) {
+            return;
+        }
         // What the gateway knows this message by (see `dispatchKeyFor`).
         const dispatchKey = dispatchKeyFor(eventKey);
         // Everything up to (and including) the dispatch call is serialized per
@@ -4661,6 +4963,30 @@ export const createSlackChannelAdapter = (options) => {
         // reverse order in durable history. The chain is claimed here,
         // synchronously, so a message's place in it is fixed by when Slack
         // delivered it and not by how long anything it does takes.
+        const stopsAtClaim = stopsBySession.get(sessionId)?.count ?? 0;
+        // Only intake that can still become a turn is something a stop can
+        // cancel. A settled overhear that is not judged only ever reaches
+        // `gateway.observe`, so counting it would let a stop with nothing to
+        // stop be consumed instead of passing on as an ordinary message.
+        const mayRun = !admitted.overhear || admitted.judge || !admitted.settled;
+        if (mayRun) {
+            intakeInFlight.set(sessionId, (intakeInFlight.get(sessionId) ?? 0) + 1);
+        }
+        let leftIntake = !mayRun;
+        const leaveIntake = () => {
+            if (leftIntake) {
+                return;
+            }
+            leftIntake = true;
+            const left = (intakeInFlight.get(sessionId) ?? 1) - 1;
+            if (left > 0) {
+                intakeInFlight.set(sessionId, left);
+            }
+            else {
+                intakeInFlight.delete(sessionId);
+                stopsBySession.delete(sessionId);
+            }
+        };
         const intake = onIntakeChain(sessionId, async () => {
             // The durable half of addressing runs INSIDE the chain, for the same
             // reason: it awaits, and a message that had to ask the sessions must
@@ -4703,13 +5029,26 @@ export const createSlackChannelAdapter = (options) => {
                 }, event.ts);
                 if (winner !== connection.config.agentId) {
                     // Not this agent's to answer — and, if it is in the thread,
-                    // this agent's to hear, same as the two warm stand-downs.
+                    // this agent's to hear, same as the two warm stand-downs. Only a
+                    // stop sends a judging agent here, and a stop the sessions place
+                    // with another agent is heard, never judged, as it is warm.
+                    judged = false;
                     overhear = true;
                 }
-                else if (threadKey) {
-                    // Answered from the store rather than from memory: hold it, so
-                    // the rest of the thread is ordered by receipt like any other.
-                    rememberAddressee(threadKey, connection.config.agentId, event.ts);
+                else {
+                    if (threadKey) {
+                        // Answered from the store rather than from memory: hold it, so
+                        // the rest of the thread is ordered by receipt like any other.
+                        rememberAddressee(threadKey, connection.config.agentId, event.ts);
+                    }
+                    // Stop (card 337) for a message only the sessions could place:
+                    // now that they say it is this agent's, it is a stop like the
+                    // warm one above, not a message to queue behind the turn it stops.
+                    if ((connection.config.approvers ?? []).includes(userId) &&
+                        isStopRequest(event.text ?? '', connection.botUserId) &&
+                        stopTurns(connection, sessionId, userId, event.channel, true)) {
+                        return undefined;
+                    }
                 }
             }
             const cleaned = await humanizeMentions(connection, event.text ?? '');
@@ -4737,7 +5076,7 @@ export const createSlackChannelAdapter = (options) => {
             const { texts, saved, unread } = overhear || judged
                 ? { texts: [], saved: [], unread: notImages }
                 : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons, options.attachmentStore
-                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, senderTrustFor(connection.config, userId), options.now ?? Date.now)
+                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, admitted.fromAgent !== undefined ? 'unknown' : senderTrustFor(connection.config, userId), options.now ?? Date.now)
                     : undefined);
             // An image or a document with nothing said is still a question
             // ("what's this?"); a file the turn could not open with nothing said
@@ -4745,7 +5084,14 @@ export const createSlackChannelAdapter = (options) => {
             if (cleaned.length === 0 && images.length === 0 && texts.length === 0 && saved.length === 0) {
                 return undefined;
             }
-            const author = await authorFor(connection, userId);
+            // A team agent goes by the name the operator gave it, not a profile
+            // its own app chose.
+            // A team agent's daemon hears only what tags its bot (card 513), so
+            // the model gets that tag and decides whether its answer needs it
+            // (Dylan, 2026-10-15: the model tags back, the adapter never does).
+            const author = admitted.fromAgent !== undefined
+                ? `${admitted.fromAgent} (an agent; it sees your answer only if you tag <@${userId}>)`
+                : await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
             // unambiguous. A bare image in a channel still says who sent it.
             const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
@@ -4756,7 +5102,10 @@ export const createSlackChannelAdapter = (options) => {
             // `unknown` exactly as a channel mention would be. The same label
             // whether the agent answers or only hears: the text is in its
             // transcript either way.
-            const senderTrust = senderTrustFor(connection.config, userId);
+            // A team agent is below a principal whatever the list says: its
+            // words carry whatever its own session was exposed to, which nothing
+            // here can see (card 513).
+            const senderTrust = admitted.fromAgent !== undefined ? 'unknown' : senderTrustFor(connection.config, userId);
             // Who can read this, so the agent writes for them, and a thread says
             // it is one. A DM names the other person only when they are one of
             // the operator's principals: this lands in the system prompt, and
@@ -4889,6 +5238,14 @@ export const createSlackChannelAdapter = (options) => {
             const queue = renderers.get(sessionId) ?? [];
             queue.push(renderer);
             renderers.set(sessionId, queue);
+            // Stopped while its lookups ran: dispatched under an aborted signal,
+            // so it ends the way a queued turn a stop reached does.
+            const stopped = stopsBySession.get(sessionId);
+            leaveIntake();
+            if (stopped !== undefined && stopped.count !== stopsAtClaim && renderer.stoppedBy === undefined) {
+                renderer.stoppedBy = stopped.by;
+                renderer.controller.abort(new RunAbortedError(`Stopped from Slack by ${stopped.by}`));
+            }
             // In a DM each message is its own status key, and Slack stops showing
             // the running turn's once a newer message sits below it — so a
             // message queued there that stayed dark read as the agent having
@@ -4906,6 +5263,7 @@ export const createSlackChannelAdapter = (options) => {
                 ...(earlier.length > 0 ? { earlier } : {}),
                 turnId: renderer.turnId,
                 metadata,
+                signal: renderer.controller.signal,
                 // A redelivery this process no longer remembers (it restarted, or
                 // the dedupe evicted it) is still the message it was: the gateway
                 // runs no second turn for it, and says so through `onRepeat`.
@@ -4922,6 +5280,8 @@ export const createSlackChannelAdapter = (options) => {
             });
             return { renderer, turn, repeat: () => repeat, absorbed: () => absorbed };
         });
+        // Whatever way the intake ended, it is no longer in flight.
+        void intake.then(leaveIntake, leaveIntake);
         const started = await intake;
         if (!started) {
             return;
@@ -5071,9 +5431,11 @@ export const createSlackChannelAdapter = (options) => {
             // not a failure of the agent. Matched by name, as this package does
             // not import the gateway. A turn nobody asked for stays silent.
             const pausedReply = failure instanceof Error && failure.name === 'IntakePausedError';
-            const { spoke, spokeAt } = pausedReply
-                ? await renderer.finalize(renderer.lazy ? '' : failure.message)
-                : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            const { spoke, spokeAt } = renderer.stoppedBy !== undefined
+                ? await renderer.stopped(renderer.stoppedBy)
+                : pausedReply
+                    ? await renderer.finalize(renderer.lazy ? '' : failure.message)
+                    : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
             if (spoke && threadKey !== undefined) {
                 // A file it posted before breaking is still the last thing said.
                 rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
@@ -5085,6 +5447,9 @@ export const createSlackChannelAdapter = (options) => {
         name: 'slack',
         resolveOutbound,
         readConversation,
+        // A channel id is unique only within its workspace, so a standing
+        // grant on one is bound to the team the agent's app authenticated in.
+        accountFor: (agentId) => botIdentities.get(agentId)?.teamId || undefined,
         requestCredential,
         async start(gateway) {
             gatewayRef = gateway;