shraga 0.0.3 → 0.1.2

package/src/server/slack/bot.ts

@@ -0,0 +1,391 @@
+// Slack agent-glue — the app-side half of the Slack bot. The Slack transport/protocol (routes, HMAC
+// verify, dedupe, DM identity, file hydrate, streamer wiring, reaction lifecycle) lives in the
+// mcp-slack-use package `ingress`. This module owns only what this app owns: sessions, locks, contacts,
+// thread-context sync, artifacts, broadcast, and message persistence — surfaced to the ingress as
+// callbacks (shouldRespond / onMessage / onReplied) plus the crash-recovery resume path.
+import crypto from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { streamChat, type AttachmentMeta, type WsEvent } from '../claude.ts';
+import { handleArtifactToolUse } from '../artifacts/artifacts.handler.ts';
+import { getMcpConfig } from '../mcp.ts';
+import { dataPath } from '../paths.ts';
+import { appendMessage, setSlackContext, setRunStatus, setVisibleTo, writePartial, clearPartial, registerLivePartial, unregisterLivePartial, acquireSessionLock, releaseSessionLock, getSession, recordSeenSlackTs, type ConvBlock, type SessionMeta } from '../sessions.ts';
+import { injectFile } from '../file-inject.ts';
+import {
+  postMessage, addReaction, removeReaction, getBotUserId, getAgentUserId, getThreadMessages, getMessage,
+  getChannelName, getUserName, getUserProfile, resolveUserMentions, isSupportedFile, SUPPORTED_FILE_MIMES,
+  downloadSlackFileBuffer,
+} from './api.ts';
+import { pipeAgentReply, type AgentEvent, type IngressMessage } from 'mcp-slack-use/src/ingress.ts';
+import { makeSlackQuestionHandler } from './questions.ts';
+import * as contacts from '../contacts.ts';
+import { getChannelContext, invalidateChannelContext } from './context-cache.ts';
+import { getOrCreateSession, registerThreadAlias, setLastMessageTs, setUseUserToken, findSlackSessionBySessionId, getProactiveOrigin, hasSessionForThread, isSlackBotPlaceholderEmail } from './sessions.ts';
+
+const MAX_DOWNLOAD_SIZE = 25 * 1024 * 1024;
+const isDownloadable = (f: { url_private?: string; mimetype?: string; size?: number; name?: string }): boolean =>
+  !!(f.url_private && f.mimetype) &&
+  (isSupportedFile(f as any) || (!SUPPORTED_FILE_MIMES.has(f.mimetype) && (f.size ?? 0) <= MAX_DOWNLOAD_SIZE));
+
+const AGENT_CHANNEL = 'C0AT9K7AXEZ';
+const SLACK_UID = 'slack-bot';
+
+type Broadcast = (data: object) => void;
+let broadcastFn: Broadcast = () => {};
+export function setBroadcast(fn: Broadcast): void { broadcastFn = fn; }
+
+const mdText = (b: ConvBlock): b is { type: 'text'; text: string } => b.type === 'text';
+
+// ── Semantic gate ─────────────────────────────────────────────────────────────
+// Protocol-level routing (bot echoes, DM identity, dedupe) is the ingress's job. This is the app-side
+// half: agent-channel summon rules + threads the agent already owns. Referenced app session state
+// (proactive origins, known threads) is why it can't live in the package.
+export function shouldRespond(msg: IngressMessage): boolean {
+  const isAgentChannel = msg.channel === AGENT_CHANNEL;
+  const isAgentOriginatedThread = msg.isThreadReply && !!(msg.rawThreadTs && getProactiveOrigin(msg.channel, msg.rawThreadTs));
+  const isKnownAgentChannelThread = isAgentChannel && msg.isThreadReply && !!(msg.rawThreadTs && hasSessionForThread(msg.channel, msg.rawThreadTs));
+  if (isAgentChannel && msg.isThreadReply && !msg.isMention && !msg.textMentionsAgent && !isAgentOriginatedThread && !isKnownAgentChannelThread) {
+    console.log(`[slack-bot] Skipping thread reply without mention in agent channel (user=${msg.user} thread=${msg.rawThreadTs})`);
+    return false;
+  }
+  const agentChannelAutoRespond = process.env.SLACK_AGENT_CHANNEL_AUTORESPOND === '1';
+  const isAgentChannelSummon = isAgentChannel && (agentChannelAutoRespond || isKnownAgentChannelThread);
+  if (!(isAgentChannelSummon || msg.isMention || msg.textMentionsAgent || msg.isDM || isAgentOriginatedThread)) return false;
+  return true;
+}
+
+// ── Shared stream pump ─────────────────────────────────────────────────────────
+// Drive a streamChat generator: accumulate assistant blocks, mirror to the web UI via broadcast,
+// yield the events the SlackStreamer consumes (text_delta / tool_use), then persist the assistant
+// message. The ingress finishes the streamer after this generator returns.
+async function* pumpStream(
+  gen: AsyncGenerator<WsEvent>,
+  sessionId: string,
+  opts: { partial?: boolean; artifacts?: boolean } = {},
+): AsyncGenerator<AgentEvent> {
+  let assistantText = '';
+  const assistantBlocks: ConvBlock[] = [];
+  const collect = () => [...assistantBlocks, ...(assistantText ? [{ type: 'text' as const, text: assistantText }] : [])];
+  let partialInterval: ReturnType<typeof setInterval> | undefined;
+  if (opts.partial) {
+    registerLivePartial(sessionId, collect);
+    partialInterval = setInterval(() => { const b = collect(); if (b.length) writePartial(sessionId, b); }, 5_000);
+  }
+  let stopReason = '';
+  try {
+    for await (const ev of gen) {
+      if (ev.type === 'text_delta') {
+        assistantText += ev.text;
+        broadcastFn({ type: 'session_stream', sessionId, event: { type: 'text_delta', text: ev.text } });
+        yield { type: 'text_delta', text: ev.text };
+      } else if (ev.type === 'tool_use') {
+        if (assistantText) { assistantBlocks.push({ type: 'text', text: assistantText }); assistantText = ''; }
+        assistantBlocks.push({ type: 'tool_use', tool: ev.tool, toolUseId: ev.toolUseId, input: ev.input });
+        broadcastFn({ type: 'session_stream', sessionId, event: { type: 'tool_use', tool: ev.tool, toolUseId: ev.toolUseId, input: ev.input } });
+        if (opts.artifacts) { const e = handleArtifactToolUse(sessionId, ev.tool, ev.input); if (e) broadcastFn(e); }
+        yield { type: 'tool_use', tool: ev.tool, toolUseId: ev.toolUseId, input: ev.input };
+      } else if (ev.type === 'tool_result') {
+        assistantBlocks.push({ type: 'tool_result', toolUseId: ev.toolUseId, output: ev.output });
+        const trimmed = ev.output.length > 2000 ? ev.output.slice(0, 2000) + '…' : ev.output;
+        broadcastFn({ type: 'session_stream', sessionId, event: { type: 'tool_result', toolUseId: ev.toolUseId, output: trimmed } });
+      } else if (ev.type === 'tool_result_image') {
+        assistantBlocks.push({ type: 'image', src: ev.dataUrl });
+      } else if (ev.type === 'done') {
+        stopReason = ev.stopReason ?? 'end_turn';
+        break;
+      } else if (ev.type === 'error') {
+        const t = `\n⚠️ ${ev.message}`;
+        assistantText += t;
+        yield { type: 'text_delta', text: t };
+        break;
+      }
+    }
+    if (stopReason === 'max_turns_reached') {
+      const notice = '\n\n---\n⚠️ _Reached the maximum number of steps for this turn. Reply "continue" to pick up where I left off._';
+      assistantText += notice;
+      yield { type: 'text_delta', text: notice };
+    }
+  } finally {
+    if (partialInterval) clearInterval(partialInterval);
+    if (opts.partial) unregisterLivePartial(sessionId);
+  }
+
+  if (assistantText) assistantBlocks.push({ type: 'text', text: assistantText });
+  for (const b of assistantBlocks) if (mdText(b)) (b as any).text = await resolveUserMentions(b.text);
+  if (assistantBlocks.length) {
+    if (opts.partial) clearPartial(sessionId);
+    appendMessage(sessionId, { id: crypto.randomUUID(), role: 'assistant', blocks: assistantBlocks });
+    broadcastFn({ type: 'session_messages_changed', sessionId });
+  }
+}
+
+// ── onMessage: one agent turn as an AsyncIterable<AgentEvent> ──────────────────────
+export async function* runAgentTurn(msg: IngressMessage): AsyncGenerator<AgentEvent> {
+  const channel = msg.channel;
+  const isDM = msg.isDM;
+  const threadTs = msg.threadTs;
+  const useUserToken = msg.useUserToken;
+
+  const botId = await getBotUserId();
+  const agentUserId = await getAgentUserId();
+  let text = (msg.text || '').replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
+  if (agentUserId) text = text.replace(new RegExp(`<@${agentUserId}>\\s*`, 'g'), '').trim();
+
+  // Files are already hydrated by the ingress; this app downloads + saves them into the session dir.
+  const files = msg.files;
+  const downloadableFiles = files.filter(isDownloadable);
+  const skippedFiles = files.filter((f: any) => !isDownloadable(f));
+  if (skippedFiles.length) {
+    const labels = skippedFiles.map((f: any) => f.mimetype
+      ? `[Attached file: ${f.name} (${f.mimetype}, ${Math.round(f.size / 1024)}KB) — too large to download]`
+      : `[Attached file: could not be retrieved from Slack]`);
+    text = text ? `${text}\n${labels.join('\n')}` : labels.join('\n');
+  }
+  if (!text && !downloadableFiles.length) return;
+
+  const downloadedFiles = downloadableFiles.length
+    ? (await Promise.all(downloadableFiles.map(async (f: any) => {
+        const allowHtml = f.mimetype === 'text/html' || /\.html?$/i.test(f.name);
+        try { return { buffer: await downloadSlackFileBuffer(f.url_private, useUserToken, allowHtml), name: f.name, mimeType: f.mimetype }; }
+        catch (err: any) { console.warn(`[slack-bot] File download failed: ${err.message}`); return null; }
+      }))).filter((f): f is { buffer: Buffer; name: string; mimeType: string } => !!f)
+    : [];
+  if (!text && !downloadedFiles.length) return;
+  if (!text) text = 'Describe this attachment.';
+
+  const userMessageTs = msg.ts;
+  const isAgentChannel = channel === AGENT_CHANNEL;
+  const isMention = msg.isMention;
+  const resolvedText = await resolveUserMentions(text);
+
+  // Attribute the session to the real human (enables nightly reconcile user-scope writes).
+  let contact: contacts.Contact | null = null;
+  if (msg.user) {
+    const profile = await getUserProfile(msg.user).catch(err => { console.error('[slack-bot] getUserProfile failed:', err.message); return { name: null, email: null }; });
+    contact = contacts.upsert({ slackId: msg.user, email: profile.email || undefined, name: profile.name || undefined });
+  }
+  const sessionUser = contact?.emails.length ? { uid: contact.id, email: contact.emails[0], name: contact.name } : undefined;
+
+  let isNew: boolean;
+  let sessionId: string;
+  ({ sessionId, isNew } = getOrCreateSession(channel, threadTs, resolvedText, false, isDM ? 'user' : 'system', sessionUser));
+  msg.sessionId = sessionId;
+
+  if (isNew && isDM && contact?.emails.length) setVisibleTo(sessionId, contact.emails);
+
+  if (isNew) {
+    const ctxType = isDM ? 'dm' as const : isMention ? 'mention' as const : 'channel' as const;
+    const [channelName, channelCtx] = await Promise.all([
+      isDM ? null : getChannelName(channel).catch(err => { console.error('[slack-bot] getChannelName failed:', err.message); return null; }),
+      isDM ? null : getChannelContext(channel).catch(err => { console.error('[slack-bot] getChannelContext failed:', err.message); return null; }),
+    ]);
+    const userName = contact?.name || null;
+    const resolvedChannel = isDM ? undefined : (channelName || undefined);
+    setSlackContext(sessionId, { type: ctxType, ...(resolvedChannel ? { channelName: resolvedChannel } : {}), ...(userName ? { userName } : {}) });
+    if (channelCtx) {
+      const label = isMention && !isAgentChannel
+        ? `@mentioned in${channelName ? ` #${channelName}` : ' channel'}`
+        : `#${channelName || 'channel'} context`;
+      appendMessage(sessionId, {
+        id: crypto.randomUUID(), role: 'user',
+        blocks: [{ type: 'context', label, text: `${channelCtx}\n\n[Use mcp-slack tools (get_slack_history_by_channel, post_slack_message) for further context or replies. Always read channel history before posting.]` }],
+      });
+    }
+  }
+
+  // Sync the live Slack thread into context on every reply — sibling bot messages from other
+  // sessions in the same human-visible thread are invisible to this session's JSONL. Dedup by ts.
+  if (msg.rawThreadTs) {
+    const threadMsgs = await getThreadMessages(channel, msg.rawThreadTs, useUserToken).catch(err => {
+      console.error(`[slack] Failed to fetch thread messages for ${channel}:${msg.rawThreadTs}:`, err?.message || err);
+      return [];
+    });
+    if (threadMsgs.length > 0) {
+      const seen = new Set(getSession(sessionId)?.seenSlackTs ?? []);
+      const seedOnly = !isNew && seen.size === 0;
+      const processedTs: string[] = [];
+      for (const m of threadMsgs) {
+        if (m.ts) processedTs.push(m.ts);
+        if (m.ts === msg.ts || (m.ts && seen.has(m.ts)) || seedOnly) continue;
+        const isBot = m.bot_id || m.user === botId || (agentUserId && m.user === agentUserId);
+        const role = isBot ? 'assistant' : 'user';
+        let msgText = (m.text || '').replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
+        if (agentUserId) msgText = msgText.replace(new RegExp(`<@${agentUserId}>\\s*`, 'g'), '').trim();
+        if (!msgText) continue;
+        const resolved = await resolveUserMentions(msgText);
+        const speakerName = !isBot && m.user ? await getUserName(m.user).catch(() => null) : null;
+        const prefixed = speakerName ? `[${speakerName}]: ${resolved}` : resolved;
+        appendMessage(sessionId, { id: crypto.randomUUID(), role, blocks: [{ type: 'text', text: prefixed }], channel: 'slack' });
+      }
+      recordSeenSlackTs(sessionId, [...processedTs, msg.ts]);
+    } else if (isNew) {
+      const rootText = await getMessage(channel, msg.rawThreadTs, useUserToken).catch(err => {
+        console.error(`[slack] Failed to fetch root message for ${channel}:${msg.rawThreadTs}:`, err?.message || err);
+        return null;
+      });
+      if (rootText) {
+        let cleanRoot = rootText.replace(new RegExp(`<@${botId}>\\s*`, 'g'), '').trim();
+        if (agentUserId) cleanRoot = cleanRoot.replace(new RegExp(`<@${agentUserId}>\\s*`, 'g'), '').trim();
+        const resolved = await resolveUserMentions(cleanRoot);
+        if (resolved) appendMessage(sessionId, { id: crypto.randomUUID(), role: 'user', blocks: [{ type: 'context', label: 'Thread root message', text: resolved }], channel: 'slack' });
+      }
+    }
+  }
+
+  if (isNew && msg.rawThreadTs) {
+    const origin = getProactiveOrigin(channel, msg.rawThreadTs);
+    if (origin) {
+      const convoPath = dataPath(`conversations/${origin.sessionId}.jsonl`);
+      const snippet = injectFile(convoPath, { label: 'origin-conversation', maxChars: 1500, transform: 'conversation' });
+      const t = [
+        `IMPORTANT: This Slack thread was started by YOU (the agent) during session "${origin.sessionTitle}" (${origin.sessionId}).`,
+        `The user is replying to a proactive message you sent. The conversation below is YOUR prior session — treat all facts, data, and statements in it as context you already know.`,
+        `If the user asks about something mentioned in that session, answer from this context. For full detail, Read the file path in the snippet tag.`,
+        snippet || '(origin conversation not found)',
+      ].join('\n');
+      appendMessage(sessionId, { id: crypto.randomUUID(), role: 'user', blocks: [{ type: 'context', label: 'Origin', text: t }] });
+    }
+  }
+
+  const replyCtx = `Slack channel: ${channel}, thread_ts: ${threadTs}`;
+  appendMessage(sessionId, {
+    id: crypto.randomUUID(), role: 'user',
+    blocks: [{ type: 'context', label: 'Slack reply coordinates', text: `${replyCtx}\nYour text responses are AUTOMATICALLY streamed to this Slack conversation — do NOT use post_slack_message to reply. Only use post_slack_files (with these coordinates) to share files/images, or post_slack_message to post in a DIFFERENT channel.` }],
+    channel: 'slack',
+  });
+
+  // Save downloaded files to data/uploads/{sid}/ (same as the web UI).
+  const attachments: AttachmentMeta[] = [];
+  if (downloadedFiles.length) {
+    const uploadsDir = dataPath(`uploads/${sessionId}`);
+    mkdirSync(uploadsDir, { recursive: true });
+    for (const f of downloadedFiles) {
+      const id = crypto.randomUUID().slice(0, 8);
+      const safeName = path.basename(f.name);
+      const filename = `${id}-${safeName}`;
+      const dest = path.join(uploadsDir, filename);
+      writeFileSync(dest, f.buffer);
+      attachments.push({ url: `/uploads/${sessionId}/${filename}`, name: safeName, mimeType: f.mimeType, path: dest });
+    }
+  }
+
+  const userBlocks: ConvBlock[] = [
+    ...attachments.map(a => a.mimeType.startsWith('image/')
+      ? { type: 'image' as const, src: a.url }
+      : { type: 'file' as const, src: a.url, name: a.name, mimeType: a.mimeType }),
+    { type: 'text' as const, text: resolvedText },
+  ];
+  const senderName = contact?.name || contact?.emails[0]?.split('@')[0] || undefined;
+  appendMessage(sessionId, { id: crypto.randomUUID(), role: 'user', blocks: userBlocks, channel: 'slack', senderName });
+  setLastMessageTs(channel, threadTs, userMessageTs);
+  if (useUserToken) setUseUserToken(channel, threadTs, true);
+
+  const mcpServers = getMcpConfig(SLACK_UID);
+  const sessionChannelName = getSession(sessionId)?.slackContext?.channelName;
+  const triggerContext: Record<string, string> = { source: 'slack' };
+  if (isDM) triggerContext.dm = 'true';
+  if (sessionChannelName) triggerContext.channel = `#${sessionChannelName}`;
+  if (msg.rawThreadTs) triggerContext.thread = msg.rawThreadTs;
+  if (contact?.emails[0]) triggerContext.user = contact.emails[0];
+
+  const abortController = new AbortController();
+  if (!acquireSessionLock(sessionId, 'slack', abortController)) {
+    console.warn(`[slack-bot] Session ${sessionId.slice(0, 8)} already locked, queuing in Slack thread`);
+    await postMessage(channel, '⏳ _Session is busy — please wait for the current task to finish._', threadTs, useUserToken);
+    msg.sessionId = undefined; // nothing to bookkeep — no reply produced
+    return;
+  }
+  setRunStatus(sessionId, 'running', 'slack');
+  broadcastFn({ type: 'session_messages_changed', sessionId });
+  broadcastFn({ type: 'session_busy', sessionId, busy: true });
+
+  try {
+    yield* pumpStream(
+      streamChat({
+        prompt: resolvedText,
+        attachments: attachments.length ? attachments : undefined,
+        sessionId,
+        uid: SLACK_UID,
+        userEmail: contact?.emails[0],
+        userName: contact?.name,
+        mcpServers,
+        abortController,
+        context: triggerContext,
+        onPermissionRequest: async () => ({ allow: true }),
+        onUserQuestion: makeSlackQuestionHandler({ channel, threadTs, useUserToken }),
+      }),
+      sessionId,
+      { partial: true, artifacts: true },
+    );
+  } finally {
+    if (releaseSessionLock(sessionId, abortController)) {
+      setRunStatus(sessionId, 'idle');
+      broadcastFn({ type: 'session_busy', sessionId, busy: false });
+    }
+  }
+}
+
+// ── onReplied: post-reply bookkeeping once the streamed reply ts is known ───────
+export function onReplied(msg: IngressMessage, replyTs: string | null): void {
+  if (!replyTs || !msg.sessionId) return;
+  registerThreadAlias(msg.channel, replyTs, msg.sessionId);
+  recordSeenSlackTs(msg.sessionId, [replyTs]);
+  invalidateChannelContext(msg.channel);
+  console.log(`[slack-bot] Reply posted via ${msg.useUserToken ? 'user' : 'bot'} token: ${msg.channel} ts=${replyTs}`);
+}
+
+// ── Crash-recovery resume ───────────────────────────────────────────────────────
+export async function retrySlackSession(session: SessionMeta, prompt: string): Promise<void> {
+  const slackInfo = findSlackSessionBySessionId(session.sessionId);
+  if (!slackInfo) {
+    console.warn(`[slack-bot] recovery: no slack mapping for ${session.sessionId.slice(0, 8)}`);
+    setRunStatus(session.sessionId, 'idle');
+    return;
+  }
+  const { channel, threadTs, lastMessageTs, useUserToken } = slackInfo;
+  console.log(`[slack-bot] recovery: retrying ${session.sessionId.slice(0, 8)} in ${channel} (${useUserToken ? 'user' : 'bot'} token)`);
+
+  const recoveryAc = new AbortController();
+  if (!acquireSessionLock(session.sessionId, 'slack', recoveryAc)) {
+    console.warn(`[slack-bot] recovery: session ${session.sessionId.slice(0, 8)} already locked, skipping`);
+    return;
+  }
+  setRunStatus(session.sessionId, 'running', 'slack');
+
+  const recoveryContext: Record<string, string> = { source: 'slack' };
+  if (session.slackContext?.channelName) recoveryContext.channel = `#${session.slackContext.channelName}`;
+  if (session.slackContext?.type === 'dm') recoveryContext.dm = 'true';
+  if (threadTs) recoveryContext.thread = threadTs;
+
+  try {
+    const replyTs = await pipeAgentReply(
+      { channel, threadTs, useUserToken, transform: undefined, finalTransform: resolveUserMentions },
+      pumpStream(
+        streamChat({
+          prompt,
+          sessionId: session.sessionId,
+          uid: SLACK_UID,
+          userEmail: isSlackBotPlaceholderEmail(session.userEmail) ? undefined : session.userEmail,
+          userName: session.slackContext?.userName,
+          mcpServers: getMcpConfig(SLACK_UID),
+          abortController: recoveryAc,
+          context: recoveryContext,
+          onPermissionRequest: async () => ({ allow: true }),
+          onUserQuestion: makeSlackQuestionHandler({ channel, threadTs, useUserToken }),
+        }),
+        session.sessionId,
+        { partial: false, artifacts: false },
+      ),
+    );
+    if (replyTs) { console.log(`[slack-bot] recovery reply posted: ${channel} ts=${replyTs}`); invalidateChannelContext(channel); }
+  } catch (err: any) {
+    console.error(`[slack-bot] recovery error for ${session.sessionId.slice(0, 8)}:`, err.message);
+  } finally {
+    if (releaseSessionLock(session.sessionId, recoveryAc)) {
+      setRunStatus(session.sessionId, 'idle');
+      broadcastFn({ type: 'session_busy', sessionId: session.sessionId, busy: false });
+    }
+    if (lastMessageTs) await removeReaction(channel, lastMessageTs, 'hourglass_flowing_sand', useUserToken).catch(() => {});
+  }
+}

package/src/server/slack/context-cache.ts

@@ -0,0 +1,42 @@
+import { getChannelHistory, getBotUserId, getAgentUserId, getUserName } from './api.ts';
+import { summarizeText } from '../summarize.ts';
+
+interface CacheEntry {
+  summary: string;
+  expiresAt: number;
+}
+
+const TTL_MS = 5 * 60 * 1000;
+const cache = new Map<string, CacheEntry>();
+
+export async function getChannelContext(channel: string): Promise<string | null> {
+  const cached = cache.get(channel);
+  if (cached && cached.expiresAt > Date.now()) return cached.summary;
+
+  const messages = await getChannelHistory(channel, 20).catch(() => []);
+  if (!messages.length) return null;
+
+  const botId = await getBotUserId();
+  const agentUid = await getAgentUserId();
+  const lines: string[] = [];
+  for (const msg of messages) {
+    const isBot = !!msg.bot_id || msg.user === botId || (agentUid && msg.user === agentUid);
+    const name = isBot ? 'Bot' : (msg.user ? await getUserName(msg.user).catch(() => null) ?? 'User' : 'User');
+    const text = (msg.text || '').replace(/<@[A-Z0-9]+>/g, '@user').trim();
+    if (text) lines.push(`${name}: ${text}`);
+  }
+  if (!lines.length) return null;
+
+  const summary = await summarizeText(
+    lines.join('\n'),
+    'Summarize this Slack channel conversation in 2-4 sentences. Capture the key topics, questions, and any pending action items. Be concise.'
+  );
+  if (!summary) return null;
+
+  cache.set(channel, { summary, expiresAt: Date.now() + TTL_MS });
+  return summary;
+}
+
+export function invalidateChannelContext(channel: string): void {
+  cache.delete(channel);
+}

package/src/server/slack/feature.ts

@@ -0,0 +1,59 @@
+// slackFeature — the ServerFeature that mounts Slack in this app. It wires the mcp-slack package
+// `ingress` (protocol) to the agent-glue (bot.ts) and subscribes the data-sync deploy notifier
+// (event bus → owner DMs). Slack ships in this app, so index.ts registers this directly.
+import type { ServerFeature, FeatureContext } from '../features.ts';
+import { registerSlackIngress } from 'mcp-slack-use/src/ingress.ts';
+import { subscribeEvents } from '../events/bus.ts';
+import { postMessage, resolveUserMentions } from './api.ts';
+import { runAgentTurn, shouldRespond, onReplied, retrySlackSession, setBroadcast } from './bot.ts';
+import { handleSlackInteraction } from './questions.ts';
+import { registerSlackOAuthRoutes } from './oauth.ts';
+import type { SessionMeta } from '../sessions.ts';
+
+interface DeployNotice { kind: 'deploy'; owners: { name?: string; slackId: string }[]; text: string }
+
+// mountFeatures can run twice in the passive→active promotion path; guard the once-only wiring.
+let oauthMounted = false;
+let ingressMounted = false;
+let busSubscribed = false;
+
+export const slackFeature: ServerFeature = {
+  name: 'slack',
+
+  register(ctx: FeatureContext): void {
+    setBroadcast(ctx.broadcast);
+
+    if (!oauthMounted) { oauthMounted = true; registerSlackOAuthRoutes(ctx.app); }
+
+    // Data-sync deploy notices arrive on the event bus (data-sync.ts has no Slack coupling); DM owners.
+    if (!ctx.passive && !busSubscribed) {
+      busSubscribed = true;
+      subscribeEvents((evt) => {
+        if (evt.source !== 'data-sync') return;
+        const payload = evt.payload as DeployNotice;
+        if (payload?.kind !== 'deploy' || !payload.owners?.length) return;
+        for (const owner of payload.owners) {
+          postMessage(owner.slackId, payload.text)
+            .then(() => console.log(`[slack] Notified ${owner.name ?? owner.slackId} via Slack DM`))
+            .catch((err) => console.warn(`[slack] Deploy DM to ${owner.name ?? owner.slackId} failed:`, (err as Error).message));
+        }
+      });
+    }
+
+    if (ctx.passive || !process.env.SLACK_SIGNING_SECRET || ingressMounted) return;
+    ingressMounted = true;
+    registerSlackIngress(ctx.app as any, {
+      shouldRespond,
+      onMessage: runAgentTurn,
+      onReplied,
+      // ingress expects a void-returning handler; handleSlackInteraction's boolean is
+      // unobserved here, so await it and discard — same execution, no behavior change.
+      onInteraction: async (p: any) => { await handleSlackInteraction(p); },
+      finalTransform: resolveUserMentions,
+    });
+  },
+
+  resumeSession(session: unknown, prompt: string): Promise<void> {
+    return retrySlackSession(session as SessionMeta, prompt);
+  },
+};

package/src/server/slack/mention-rewrite.ts

@@ -0,0 +1,59 @@
+/**
+ * Outbound Slack mention resolution — the reverse of `resolveUserMentions`.
+ *
+ * `resolveUserMentions` (api.ts) rewrites inbound Slack `<@U…>` tokens into the
+ * human-readable display form the agent reads, e.g. `@talshriki (operator)`.
+ * There was no reverse step, so when the agent pasted that display string back
+ * into an outbound message, Slack posted it as literal text and nobody got
+ * pinged. This closes that asymmetry: it turns the display form back into a
+ * real `<@U…>` mention token using the same contacts registry that produced it.
+ *
+ * Handles the two display shapes the agent ever sees:
+ *   "@talshriki (operator)"  ->  "<@U0731UGPPMY>"
+ *   "@talshriki"             ->  "<@U0731UGPPMY>"
+ *
+ * Safety: only rewrites a name that maps to exactly ONE contact slackId
+ * (unambiguous). Slack keywords (@channel/@here/@everyone) and already-tokenized
+ * `<@U…>` mentions are left untouched.
+ */
+import { getAll } from '../contacts.ts';
+
+const SLACK_KEYWORDS = new Set(['channel', 'here', 'everyone']);
+
+function escapeRegex(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+export function rewriteSlackMentions(text: string): { text: string; changed: boolean } {
+  if (!text || !text.includes('@')) return { text, changed: false };
+
+  // Aggregate slackIds per display name to detect ambiguity (same name, two people).
+  const byName = new Map<string, Set<string>>();
+  for (const c of getAll()) {
+    if (!c.slackIds.length) continue;
+    const key = c.name?.trim();
+    if (!key || SLACK_KEYWORDS.has(key.toLowerCase())) continue;
+    let set = byName.get(key);
+    if (!set) { set = new Set(); byName.set(key, set); }
+    for (const s of c.slackIds) set.add(s);
+  }
+
+  let result = text;
+  let changed = false;
+  // Longest names first so a longer name is consumed before a shorter one it contains.
+  const names = [...byName.keys()].sort((a, b) => b.length - a.length);
+  for (const name of names) {
+    const ids = byName.get(name)!;
+    if (ids.size !== 1) continue; // ambiguous — leave as-is
+    const token = `<@${[...ids][0]}>`;
+    const n = escapeRegex(name);
+    // Tagged form first: "@name (operator|owner|contact)" — highly specific.
+    const tagged = new RegExp(`@${n}\\s*\\((?:operator|owner|contact)\\)`, 'g');
+    if (tagged.test(result)) { result = result.replace(tagged, token); changed = true; }
+    // Bare form: "@name" not followed by a word/handle char, so "@Adam" never
+    // matches inside "@Adamson" or an email/handle.
+    const bare = new RegExp(`@${n}(?![\\w@.\\-])`, 'g');
+    if (bare.test(result)) { result = result.replace(bare, token); changed = true; }
+  }
+  return { text: result, changed };
+}

package/src/server/slack/oauth.ts

@@ -0,0 +1,102 @@
+import type { Express } from 'express';
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { requireAuth } from '../auth.ts';
+import { dataPath } from '../paths.ts';
+
+const TOKENS_FILE = 'slack-tokens.json';
+const TOKENS_PATH = () => dataPath(TOKENS_FILE);
+
+interface SlackTokens {
+  botToken?: string;
+  userToken?: string;
+  authedUser?: { id: string; scope: string };
+  updatedAt?: string;
+}
+
+function loadTokens(): SlackTokens {
+  const p = TOKENS_PATH();
+  if (!existsSync(p)) return {};
+  try { return JSON.parse(readFileSync(p, 'utf8')); }
+  catch (e) { console.warn(`[slack-oauth] Failed to parse ${TOKENS_FILE}:`, e); return {}; }
+}
+
+function saveTokens(tokens: SlackTokens) {
+  writeFileSync(TOKENS_PATH(), JSON.stringify(tokens, null, 2));
+}
+
+function getBaseUrl(req: { protocol: string; get(name: string): string | undefined }): string {
+  const proto = req.get('x-forwarded-proto') || req.protocol;
+  return `${proto}://${req.get('host')}`;
+}
+
+/** Load file-based tokens into process.env if not already set. */
+export function hydrateSlackTokens() {
+  const tokens = loadTokens();
+  if (!process.env.SLACK_USER_TOKEN && tokens.userToken) {
+    process.env.SLACK_USER_TOKEN = tokens.userToken;
+    console.log(`[slack-oauth] Hydrated SLACK_USER_TOKEN from ${TOKENS_FILE} (user=${tokens.authedUser?.id})`);
+  }
+  if (!process.env.SLACK_BOT_TOKEN && tokens.botToken) {
+    process.env.SLACK_BOT_TOKEN = tokens.botToken;
+    console.log(`[slack-oauth] Hydrated SLACK_BOT_TOKEN from ${TOKENS_FILE}`);
+  }
+}
+/** @deprecated Use hydrateSlackTokens */
+export const hydrateSlackUserToken = hydrateSlackTokens;
+
+export function registerSlackOAuthRoutes(app: Express) {
+  const clientId = process.env.SLACK_CLIENT_ID;
+  const clientSecret = process.env.SLACK_CLIENT_SECRET;
+  if (!clientId || !clientSecret) return;
+
+  const USER_SCOPES = 'search:read,chat:write,groups:read,im:history,im:read,im:write,links:read,links:write,users:read,users:read.email,users:write,reactions:write,reactions:read';
+
+  app.get('/api/slack/oauth/start', (req, res) => {
+    const redirectUri = `${getBaseUrl(req)}/api/slack/oauth/callback`;
+    const url = `https://slack.com/oauth/v2/authorize?client_id=${clientId}&user_scope=${encodeURIComponent(USER_SCOPES)}&redirect_uri=${encodeURIComponent(redirectUri)}`;
+    res.redirect(url);
+  });
+
+  app.get('/api/slack/oauth/callback', async (req, res) => {
+    const { code, error } = req.query;
+    if (error) return res.status(400).send(`OAuth error: ${error}`);
+    if (!code || typeof code !== 'string') return res.status(400).send('Missing code');
+
+    const redirectUri = `${getBaseUrl(req)}/api/slack/oauth/callback`;
+    try {
+      const resp = await fetch('https://slack.com/api/oauth.v2.access', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_id: clientId, client_secret: clientSecret, code, redirect_uri: redirectUri }).toString(),
+      });
+      const data = await resp.json() as any;
+      if (!data.ok) return res.status(400).send(`Slack error: ${data.error}`);
+
+      const tokens = loadTokens();
+      if (data.authed_user?.access_token) {
+        tokens.userToken = data.authed_user.access_token;
+        tokens.authedUser = { id: data.authed_user.id, scope: data.authed_user.scope };
+        process.env.SLACK_USER_TOKEN = tokens.userToken;
+      }
+      if (data.access_token) tokens.botToken = data.access_token;
+      tokens.updatedAt = new Date().toISOString();
+      saveTokens(tokens);
+
+      console.log(`[slack-oauth] Token exchange success — user=${data.authed_user?.id}, scopes=${data.authed_user?.scope}`);
+      res.send(`<h2>Slack OAuth complete</h2><p>User token saved for ${data.authed_user?.id || 'bot'}.</p><p>You can close this tab.</p>`);
+    } catch (e: any) {
+      console.error('[slack-oauth] Token exchange failed:', e.message);
+      res.status(500).send(`Token exchange failed: ${e.message}`);
+    }
+  });
+
+  app.get('/api/slack/oauth/status', requireAuth, (_req, res) => {
+    const tokens = loadTokens();
+    res.json({
+      hasUserToken: !!tokens.userToken,
+      hasEnvUserToken: !!process.env.SLACK_USER_TOKEN,
+      authedUser: tokens.authedUser || null,
+      updatedAt: tokens.updatedAt || null,
+    });
+  });
+}