hive-am 1.5.0 → 1.7.0

package/CHANGELOG.md

@@ -6,6 +6,35 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## [Unreleased]
 
+## [1.7.0] - 2026-10-21
+
+### Added
+
+- **Compact chat view.** A **Normal / Compact** switch under the chat box, next to **Expand all tools**, is remembered in the browser for every agent's chat (Normal stays the default and unchanged). In Compact each reasoning block and tool call is a small pill with a grey icon on the agent's row, with a short label and the full command or path as tooltip; clicking it opens the usual detail (command and output with copy buttons, diffs) under the row, and several can be open at once. Earlier replies fold into one summary pill (`3 steps · 1 tool · 4.9s`) that shows their pills on click; failed steps and the summaries that hide them are tinted red with the failed count; a running tool keeps the honey border and live timer and is never folded; **Files changed** is a pill with the `+added −removed` totals that stays visible. **Expand all tools** also opens every pill and unfolds every summary. Opening a pill higher up no longer moves the view.
+
+## [1.6.0] - 2026-10-20
+
+### Added
+
+- **Fold the main menu to icons.** A button next to the hive-am name folds the sidebar from 220 px to a 64 px column of icons, giving the chat and every other screen more room. Each icon keeps its name as a tooltip and for screen readers, counts stay as small badges and the EN/ES switch stays at hand. The choice is remembered and applied before the page paints, so a reload never flashes the wide menu. On narrow screens (under 760 px) the menu stays the top bar with its labels.
+- **Fold the colony groups of the chat's agent list.** Each colony heading in the side list of the chat is now a button that folds or unfolds its group (mouse or keyboard), and the folded groups are remembered. A folded group still shows the agent you are on and a pulsing dot when one of its agents is working; while searching every group with a match is open. The collapsed list (avatars only) keeps the groups apart with a compact heading per colony (its initials in its color and the count, the full name on hover) that folds the same groups. Orchestrators come first in each group in both modes, the headings are larger and easier to read, and a hive with no agents says "No agents yet" instead of an empty search message.
+- **Slack connections.** A connection can now link an agent to a Slack app, with everything Telegram does: DMs and channels, the allow list (Slack member and channel ids), files in and out, reactions (by Slack name) and the shared single conversation. It runs over **Socket Mode**, so no public URL is needed and hive-am can stay on a laptop; the socket is refreshed and reconnected on its own, and a wrong token says which one. The agent answers **in a thread opened on the message** and keeps answering there; scheduled messages, reminders and the `wake_when_done` notice go to the channel. Replies are sent as `mrkdwn`. The connection form has a working platform selector, the two tokens and Slack's own words; the manual explains how to create the app. Tested against a fake Slack (`sim-slack.ts`).
+- **`/help` and `/id` commands, and `/clear` and `/reset` as other names for `/new`**, on Telegram and Slack alike. `/id` answers the sender's id and the chat's, so an admin can add them. On Slack they come as slash commands (`/hive status`, `/hive-status` or `/status`).
+- **Limit who can talk inside an authorized group or channel.** Each allowed Telegram group or Slack channel now has a mode in the connection form: **Everyone in it** (the default, and what every saved chat keeps, with no migration) or **Only these people**, with its own list of person ids (Telegram user ids, Slack member ids `U…` or `W…`). In a restricted chat only those people can talk, in every topic and thread of it; a member is an admin (`/new`) only if they are also on the connection's people list with **Admin**. Anyone else is ignored, and if they call the agent they are told that the chat only admits its list, with their id and the chat's. With "Listens and chimes in" their messages do not reach the agent even as context. DMs are unchanged. The server refuses an unknown mode, more than 50 members per chat and ids that do not look like the platform's. Tested in `test-chat-access.ts` (no model).
+- **Delegate in the background.** `dispatch` now returns at once with a task id by default (`background` is true unless you pass `background: false` to wait for the answer), the orchestrator can keep answering the person or delegate to other subagents, and when the subagent finishes the orchestrator receives a message with the task id, the subagent and the result, in the place where it was asked (its web conversation, or the same Telegram or Slack thread). The new `dispatch_status` tool reads the state of a task (queued, running, done, failed or interrupted) and its result, and can wait up to 60 seconds for the end. The result lives in hive-am, not in the call: it is announced exactly once, even across a restart; a task left running by a restart is marked interrupted and its orchestrator is told to check the work and send it again; pruning keeps a result nobody has had yet. An orchestrator can have up to 10 unfinished background tasks. The orchestrator's instructions tell it to wait with `background: false` only for a very short task whose answer it needs right now. Tested in `test-dispatch-background.ts` (no model).
+
+### Changed
+
+- **The agent and agent-type forms are one component.** The types screen now renders the agent form (`AgentForm`) in type mode instead of its own copy of the fields, so a new agent field is written once. Nothing visible changes, and saving a type sends only the fields a type stores.
+- **The connection's people list is for direct messages, and each authorized group follows its own rule.** In the form it is now **People (direct messages)**, apart from **Groups** and **Allowed groups** (**Allowed channels** on Slack), each with its own help. The people list still talks in DMs and in groups that are not listed, but no longer opens a group limited to **Only these people**: only that group's members get in, and an empty member list admits nobody. If you already limited a group and someone on the people list talked there, add them to the group's list too. Rows wrap in a narrow drawer.
+- **Someone without access is told at every message aimed at the agent**, not only the first time, so the bot no longer looks dead. To keep a stranger from flooding a chat, it sends at most 5 notices per person and chat and 20 per chat in a minute, then stays silent. The notice of a limited chat now only points to the chat's members ("channel" on Slack).
+
+### Fixed
+
+- **Picking an agent in the chat's side list no longer sends the list back to the top.** The whole agent page was remounted for each agent, list included, so after scrolling down and choosing an agent the list jumped to the start and the chosen agent went out of view. The list now stays mounted (it keeps its scroll and its search text) while the chat still resets its draft, tab and viewed session, and opening or reloading an agent further down scrolls the list just enough to show it.
+- **A long answer from a delegated task, a wake-up or a schedule is no longer refused in a chat.** These notices went through the 8000 character limit of incoming messages, so a subagent's answer longer than that came back as "Message too long." and never reached the orchestrator in its Telegram or Slack thread (it stayed readable with `dispatch_status`). The limit now applies only to what people write.
+- **A delegation longer than five minutes no longer fails with `fetch failed` and loses the answer.** The synchronous `dispatch` held one HTTP request until the subagent finished, and Node's `fetch` gives up after 300 seconds without an answer. It now starts the task and waits with short `dispatch_status` calls (25 seconds each), so it returns the subagent's answer however long it takes. The orchestrator's own CLI is still cut after 10 minutes of silence while it waits on a tool, which is why `dispatch` goes in the background by default. The Recent delegations list shows a task waiting behind a busy subagent as queued (it used to look failed), and its status on hover.
+
 ## [1.5.0] - 2026-10-19
 
 ### Added
@@ -212,7 +241,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 - Complete documentation in English and Spanish.
 - npm package with the `hive-am` command.
 
-[Unreleased]: https://github.com/hughcbscrt/hive-am/compare/v1.5.0...HEAD
+[Unreleased]: https://github.com/hughcbscrt/hive-am/compare/v1.7.0...HEAD
+[1.7.0]: https://github.com/hughcbscrt/hive-am/compare/v1.6.0...v1.7.0
+[1.6.0]: https://github.com/hughcbscrt/hive-am/compare/v1.5.0...v1.6.0
 [1.5.0]: https://github.com/hughcbscrt/hive-am/compare/v1.4.0...v1.5.0
 [1.4.0]: https://github.com/hughcbscrt/hive-am/compare/v1.3.0...v1.4.0
 [1.3.0]: https://github.com/hughcbscrt/hive-am/compare/v1.2.2...v1.3.0

package/README.md

@@ -33,6 +33,7 @@ have installed; it does not replace them and it never copies your conversations
 - **Skills.** Ten skills ship with hive-am (all ordinary: edit or delete them). Assign them to an agent, a type or a colony, and choose per assignment whether they are **always** in the instructions or loaded **on demand** with a `skill_read` tool. Searchable picker with token weights.
 - **Notebook.** An agent can keep a persistent notebook of what it learns (no credentials, no duplicates, every note with its source). You can read and edit it from the agent's settings.
 - **Telegram.** Link a bot to an agent: private chats, groups and topics, one shared session across all of them. In groups the agent can listen to everything and speak only when it adds something; people can mute it per thread and bring it back.
+- **Slack.** The same over Socket Mode (no public URL): DMs and channels, the agent answers in a thread opened on the message, scheduled messages land in the channel, `/hive` slash commands.
 - **Files and images.** People send documents and photos to the agent; the agent sends files back. An optional image model can describe pictures for models that cannot see them.
 - **Permissions that hold.** *Read-only*, *Edit files* and *Full access* are enforced by the CLI itself in all three providers.
 - **Changes explorer.** A Git tab per agent: file tree with highlighting, diff viewer, history, commit, pull, push and branches.
@@ -115,14 +116,14 @@ Data lives in `~/.hive-am/hive-am.db` (override with `HIVE_AM_HOME`). The server
 In *Edit files* the agent cannot touch `.git` or private keys (`*.pem`, `*.key`) and cannot write outside its folder. Details and the
 few differences between providers are in [docs/06](docs/reference/en/06-providers.md) and [docs/12](docs/reference/en/12-operations-and-troubleshooting.md).
 
-## Connections (Telegram)
+## Connections (Telegram and Slack)
 
-1. Create a bot with @BotFather and copy its token.
-2. In **Connections**, add a Telegram connection, pick the agent that answers, and list the people (and groups) allowed to talk to it.
+1. Create a bot with @BotFather and copy its token, or create a Slack app with Socket Mode and copy its bot token (`xoxb-`) and app token (`xapp-`) ([manual, chapter 9](docs/manual/en/09-telegram-connections.md#slack)).
+2. In **Connections**, add a Telegram or Slack connection, pick the agent that answers, and list the people (and groups or channels) allowed to talk to it.
 3. Optional: set the group mode (`mention` or `open`), an alias, whether files are accepted, and an image model.
 
 The agent answers through a `channel_reply` tool: its plain text is never delivered. Only authorized people and groups reach it,
-checked on the server. The bot token is stored in `~/.hive-am/hive-am.db` and never returned by the API; see the note about it in
+checked on the server. Tokens are stored in `~/.hive-am/hive-am.db` and never returned by the API; see the note about it in
 [docs/14](docs/reference/en/14-external-connections.md).
 
 ## How it is built

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hive-am",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "A colony of coding agents: orchestrators and subagents over Claude Code, OpenCode and Kiro, with real session resume, a browser UI and Telegram.",
   "keywords": [
     "ai-agents",

package/server/dist/connections/format.js

@@ -37,3 +37,29 @@ export function mdToTelegramHtml(md) {
     s = s.replace(/^#{1,6}\s+(.+)$/gm, '<b>$1</b>');
     return s.replace(/\u0000(\d+)\u0000/g, (_m, i) => stash[Number(i)]);
 }
+/** Slack's three control characters; everything else goes as it is. */
+export const escapeSlack = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+/**
+ * Markdown → Slack's `mrkdwn`: `*bold*`, `_italic_`, `~strike~`, code as it is, `<url|label>` links, headings as bold lines.
+ * Slack's own tokens the agent may write (`<@U123>`, `<#C123>`, `<!here>`, `<https://…|…>`) are kept; any other `&`, `<`, `>` is escaped.
+ */
+export function mdToSlackMrkdwn(md) {
+    md = emojiPresentation(md);
+    const stash = [];
+    const keep = (s) => `\u0000${stash.push(s) - 1}\u0000`;
+    let s = md.replace(/```[^\n]*\n?([\s\S]*?)```/g, (_m, code) => keep(`\`\`\`\n${escapeSlack(code.replace(/\n$/, ''))}\n\`\`\``));
+    s = s.replace(/`([^`\n]+)`/g, (_m, code) => keep(`\`${escapeSlack(code)}\``));
+    s = s.replace(/<(?:[@#][A-Z0-9]+(?:\|[^>\n]*)?|![a-z]+(?:\^[A-Z0-9]+)?(?:\|[^>\n]*)?|(?:https?|mailto):[^\s|>]+(?:\|[^>\n]+)?)>/g, (t) => keep(t));
+    s = s.replace(/\[([^\]\n]+)\]\(((?:https?:\/\/|mailto:)[^\s)]+)\)/g, (_m, label, url) => keep(`<${url}|${escapeSlack(label).replace(/\|/g, '¦')}>`));
+    s = escapeSlack(s);
+    s = s.replace(/^#{1,6}\s+(.+)$/gm, (_m, h) => keep(`*${h.replace(/\*\*/g, '').trim()}*`));
+    s = s.replace(/(^|[\s(])\*([^*\n]+)\*(?=$|[\s).,!?:;])/gm, '$1_$2_');
+    s = s.replace(/\*\*([^*\n]+)\*\*/g, (_m, b) => keep(`*${b}*`)).replace(/__([^_\n]+)__/g, (_m, b) => keep(`*${b}*`));
+    s = s.replace(/~~([^~\n]+)~~/g, '~$1~');
+    s = s.replace(/^(\s*)[-*]\s+/gm, '$1• ');
+    s = s.replace(/^&gt;\s?/gm, '> ');
+    // Stashed pieces can hold other stashed pieces (a link inside a heading): resolve until none is left.
+    for (let i = 0; i < 3 && s.includes('\u0000'); i++)
+        s = s.replace(/\u0000(\d+)\u0000/g, (_m, n) => stash[Number(n)]);
+    return s;
+}

package/server/dist/connections/index.js

@@ -1,3 +1,5 @@
 import { registerFactory } from './manager.js';
+import { SlackAdapter } from './slack.js';
 import { TelegramAdapter } from './telegram.js';
 registerFactory('telegram', (c) => new TelegramAdapter(c));
+registerFactory('slack', (c) => new SlackAdapter(c));

package/server/dist/connections/manager.js

@@ -126,7 +126,7 @@ export async function channelReply(agentId, text) {
         console.warn(`[connections] blocked a reply of agent ${agentId}: it seemed to contain ${leak}`);
         throw new ChannelError(SECRET_REFUSAL(leak));
     }
-    const { externalId } = await adapter.send(thread.target, text);
+    const { externalId } = await adapter.send(origin.target ?? thread.target, text);
     threadMessages.record(thread.id, 'out', externalId, { name: agents.get(agentId)?.name }, text);
     origin.replied = true;
     return { sent: true, parts: 1 };
@@ -148,7 +148,7 @@ export async function channelReact(agentId, emoji) {
     if (!thread)
         throw new ChannelError('The thread no longer exists.');
     try {
-        await adapter.react(thread.target, origin.messageId, e);
+        await adapter.react(origin.target ?? thread.target, origin.messageId, e);
     }
     catch (err) {
         throw new ChannelError(err instanceof Error ? err.message : 'The reaction failed');
@@ -176,7 +176,7 @@ export async function channelSendFile(agentId, path, caption) {
         console.warn(`[connections] blocked a file of agent ${agentId}: it seemed to contain ${leak}`);
         throw new ChannelError(SECRET_REFUSAL(leak).replace('the message', `the ${caption && findSecret(caption) ? 'caption' : 'file'}`));
     }
-    const { externalId } = await adapter.sendFile(thread.target, file, caption?.trim() || undefined);
+    const { externalId } = await adapter.sendFile(origin.target ?? thread.target, file, caption?.trim() || undefined);
     threadMessages.record(thread.id, 'out', externalId, { name: agent.name }, `${caption?.trim() ? `${caption.trim()} ` : ''}[sent file: ${file.name}]`);
     origin.replied = true;
     return { sent: true, name: file.name, kind: file.kind };

package/server/dist/connections/router.js

@@ -10,6 +10,8 @@ import { connections, threadMessages, threads } from './store.js';
 const MAX_INPUT = 8000;
 const DEFAULT_RATE = 20; // messages per user per minute
 const DEFAULT_CHATTER_PER_MINUTE = 10; // times per minute that chatter nobody aimed at the agent may wake it, per thread
+const DENIED_PER_MINUTE = 5; // access notices per person and chat per minute, so a stranger can't make the bot spam a chat
+const DENIED_CHAT_PER_MINUTE = 20; // access notices per chat per minute, whoever asks
 /** Sent once when a turn aimed at the agent ended without a reply. */
 const NUDGE = '[hive:channel] System reminder: your last turn ended without calling `channel_reply`, so the person received nothing. If you had an answer, send it now with `channel_reply` (if the tool says it is unknown, call it again: it was still connecting). If you chose not to answer, say so in one short sentence with `channel_reply`.';
 import { validEffort } from '../efforts.js';
@@ -34,8 +36,15 @@ const T = {
     newDone: { es: '🆕 Conversación nueva.', en: '🆕 New conversation.' },
     muted: { es: '🔇 Me quedo callado en este hilo. Menciónenme o respondan a un mensaje mío para que vuelva a hablar.', en: '🔇 I\'ll stay quiet in this thread. Mention me or reply to one of my messages to bring me back.' },
     unmuted: { es: '🔊 Listo, vuelvo a participar en este hilo.', en: '🔊 Done, I\'m back in this thread.' },
+    help: { es: 'Comandos: /new (o /clear, /reset) empieza una conversación nueva (solo administradores) · /stop detiene el turno en curso · /status estado del agente · /mute y /unmute me callan o me reactivan en este hilo · /id tu id y el de este chat · /help esta ayuda.', en: 'Commands: /new (or /clear, /reset) starts a new conversation (admins only) · /stop stops the turn in progress · /status the agent\'s state · /mute and /unmute silence me or bring me back in this thread · /id your id and this chat\'s · /help this help.' },
+    ids: (user, chat) => ({ es: `Tu id: ${user} · este chat: ${chat}`, en: `Your id: ${user} · this chat: ${chat}` }),
     notAllowedChat: (user, chat) => ({ es: `No tienes acceso. Para usarme aquí, añade tu id (${user}) o este chat (${chat}) en la conexión.`, en: `You don't have access. To use me here, add your id (${user}) or this chat (${chat}) to the connection.` }),
+    notAllowedMember: (user, chat, slack) => slack
+        ? { es: `Este canal solo admite a personas de su lista. Para usarme aquí, añade tu id (${user}) a los miembros de este canal (${chat}).`, en: `This channel only admits the people on its list. To use me here, add your id (${user}) to this channel's members (${chat}).` }
+        : { es: `Este chat solo admite a personas de su lista. Para usarme aquí, añade tu id (${user}) a los miembros de este chat (${chat}).`, en: `This chat only admits the people on its list. To use me here, add your id (${user}) to this chat's members (${chat}).` },
 };
+/** The same commands on every platform; these are other names for them. */
+const COMMAND_ALIASES = { clear: 'new', reset: 'new' };
 const say = (c, m) => (c.config.lang === 'en' ? m.en : m.es);
 const hits = new Map();
 function tooFast(connId, user, limit) {
@@ -45,8 +54,20 @@ function tooFast(connId, user, limit) {
     hits.set(key, arr);
     return arr.length > limit;
 }
-const told = new Set(); // users already told how to get access, so strangers can't make us spam them
 const chatsOf = (c) => (Array.isArray(c.config.chats) ? c.config.chats : []);
+/** Who may talk: in a DM and in a group with no entry of its own, the connection's people list (with their admin flag); in a listed group, that group's own rule: everyone in it, or only its members (the people list does not open it, and an empty list admits nobody). A member keeps admin only if the people list gives it. The chat is `target.chat`, so a rule covers every topic and thread in it. */
+export function senderOf(c, m) {
+    const listed = c.allowed.find((u) => u.id === m.userId);
+    if (!m.group)
+        return listed;
+    const chat = chatsOf(c).find((x) => x.id === m.target.chat);
+    if (!chat)
+        return listed;
+    if (chat.mode !== 'members')
+        return listed ?? { id: m.userId, name: m.userName };
+    const member = (Array.isArray(chat.members) ? chat.members : []).find((x) => x.id === m.userId);
+    return member ? { id: m.userId, name: member.name ?? m.userName, ...(listed?.admin ? { admin: true } : {}) } : undefined;
+}
 const aliasesOf = (c) => (Array.isArray(c.config.aliases) ? c.config.aliases : []).map((a) => String(a).trim()).filter(Boolean);
 /** Group chatter that speaks TO the agent by one of its aliases counts as aimed at it, even without @mention. */
 const selfNames = (c) => { const n = (c.agent_id ? agents.get(c.agent_id)?.name : '') ?? ''; return n ? [n, n.split(/\s+/)[0]] : []; };
@@ -72,16 +93,16 @@ export async function handleInbound(connectionId, adapter, m) {
     // Group chatter is only heard when the connection is open to it.
     if (group && !addressed && conn.config.group_mode !== 'open')
         return;
-    const user = conn.allowed.find((u) => u.id === m.userId)
-        ?? (group && chatsOf(conn).some((c) => c.id === m.target.chat) ? { id: m.userId, name: m.userName } : undefined);
+    const user = senderOf(conn, m);
     if (!user) {
         if (!addressed)
             return; // never answer strangers' chatter
-        const key = `${connectionId}:${m.userId}`;
-        if (!told.has(key)) {
-            told.add(key);
-            await reply(say(conn, group ? T.notAllowedChat(m.userId, m.target.chat) : T.notAllowed(m.userId)));
+        // Told at every message, so the bot never looks dead; capped per person and per chat (topics and threads share it) so nobody can make it flood a chat.
+        if (!allow(`denied:${connectionId}:${m.userId}:${m.target.chat}`, DENIED_PER_MINUTE) || !allow(`denied-chat:${connectionId}:${m.target.chat}`, DENIED_CHAT_PER_MINUTE)) {
+            return;
         }
+        const restricted = group && chatsOf(conn).some((c) => c.id === m.target.chat && c.mode === 'members');
+        await reply(say(conn, restricted ? T.notAllowedMember(m.userId, m.target.chat, conn.kind === 'slack') : group ? T.notAllowedChat(m.userId, m.target.chat) : T.notAllowed(m.userId)));
         return;
     }
     const thread = threads.touch(connectionId, m.externalKey, { title: m.place, target: m.target, user: m.userName });
@@ -117,7 +138,16 @@ export async function handleInbound(connectionId, adapter, m) {
         } // only files, and none could be saved: nothing to hand over
     }
     if (m.command) {
-        const { name, args } = m.command;
+        const { args } = m.command;
+        const name = COMMAND_ALIASES[m.command.name] ?? m.command.name;
+        if (name === 'help') {
+            await reply(say(conn, T.help));
+            return;
+        }
+        if (name === 'id') {
+            await reply(say(conn, T.ids(m.userId, m.target.chat)));
+            return;
+        }
         if (name === 'stop') {
             await reply(say(conn, stopAgent(agent.id) ? T.stopped : T.nothingToStop));
             return;
@@ -190,7 +220,7 @@ async function deliver(conn, adapter, thread, m, msgId, addressed, scheduled = f
         return;
     const reply = (text) => adapter.send(m.target, text).catch(() => undefined);
     const fresh = threads.get(thread.id) ?? thread;
-    if (m.text.length > MAX_INPUT) {
+    if (!scheduled && m.text.length > MAX_INPUT) {
         if (addressed)
             await reply(say(conn, T.tooLong));
         return;
@@ -205,7 +235,7 @@ async function deliver(conn, adapter, thread, m, msgId, addressed, scheduled = f
         await reply(say(conn, T.queued(ahead)));
     const unseen = threadMessages.unseen(thread.id, fresh.seen_id, msgId).map((r) => ({ name: r.user_name ?? r.user_id ?? '?', text: r.text, files: r.files ? parseJson(r.files, undefined, `thread message ${r.id} files`) : undefined }));
     threads.markSeen(thread.id, msgId);
-    const origin = { connectionId: conn.id, threadId: thread.id, externalKey: m.externalKey, platform: conn.kind, place: m.place, userName: m.userName, userId: m.userId, group: !!m.group, mention: m.mention, addressed, replied: false, messageId: m.externalId, effort: validEffort(conn.config.effort) ? conn.config.effort : undefined };
+    const origin = { connectionId: conn.id, threadId: thread.id, externalKey: m.externalKey, platform: conn.kind, place: m.place, userName: m.userName, userId: m.userId, group: !!m.group, mention: m.mention, addressed, replied: false, messageId: m.externalId, target: m.target, effort: validEffort(conn.config.effort) ? conn.config.effort : undefined };
     if (addressed)
         await adapter.busy(m.target, 'working', m.externalId).catch(() => undefined);
     const startedAt = Date.now();
@@ -248,10 +278,10 @@ async function deliver(conn, adapter, thread, m, msgId, addressed, scheduled = f
             await adapter.busy(m.target, 'done', m.externalId).catch(() => undefined);
     }
 }
-/** A message the agent asked to receive later (a wake-up, a schedule): it reaches the agent like a message of that thread, so it can answer there. */
+/** A message the agent asked to receive later (a wake-up, a schedule): it reaches the agent like a message of that thread, so it can answer there (on Slack, in the channel: see `ChannelAdapter.proactive`). */
 export async function deliverScheduled(conn, adapter, thread, text, mention) {
     const m = {
-        externalId: `sched-${Date.now()}`, externalKey: thread.external_key, userId: '', userName: 'hive-am (scheduled)', place: thread.title || 'chat', target: thread.target, addressed: true, text, mention,
+        externalId: `sched-${Date.now()}`, externalKey: thread.external_key, userId: '', userName: 'hive-am (scheduled)', place: thread.title || 'chat', target: adapter.proactive?.(thread.target) ?? thread.target, addressed: true, text, mention,
     };
     await deliver(conn, adapter, thread, m, threadMessages.lastId(thread.id), true, true);
 }

package/server/dist/connections/secrets.js

@@ -11,7 +11,7 @@ const SHAPES = [
     [/\b\d{8,10}:[A-Za-z0-9_-]{30,}\b/, 'a Telegram bot token'],
     [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/, 'an AWS access key'],
     [/\bgh[pousr]_[A-Za-z0-9]{30,}\b|\bgithub_pat_[A-Za-z0-9_]{30,}\b/, 'a GitHub token'],
-    [/\bxox[abprs]-[A-Za-z0-9-]{10,}\b/, 'a Slack token'],
+    [/\bxox[abprs]-[A-Za-z0-9-]{10,}\b|\bxapp-\d+-[A-Za-z0-9-]{10,}\b/, 'a Slack token'],
     [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/, 'a Stripe key'],
     [/\bsk-[A-Za-z0-9_-]{32,}\b/, 'an API key'],
     [/\bAIza[0-9A-Za-z_-]{35}\b/, 'a Google API key'],