feat(slack): channel identity, proactive messaging, and per-agent bot icon (#350 Phase 1 & 3, #292)

[dolho]

Advances epic #350 (Slack channel behavior, parallel to the shipped Telegram #349). Lands the two phases that reuse existing shared infra and need no OAuth re-consent. Observation mode (Phase 2) is split to sub-issue #1413 (needs new channels:history scopes → Slack app re-install, message-event subscription, a dual-track migration).

Phase 1 — user identity (AC: agent sees [Channel: #name] [From: Display Name (@username)])

• New async ChannelAdapter.enrich_message hook (default no-op) — parse_message is sync, but Slack events carry only opaque IDs, so identity needs an async API call. The router calls it once after agent resolution.
• SlackAdapter.enrich_message resolves sender display name (users.info) + channel name (conversations.info) into message.metadata; best-effort (degrades to bare IDs, never raises).
• message_router._format_channel_identity prepends the identity block for enriched channel (non-DM) messages. Gated on channel_name presence — so DMs, un-enriched channels, and Telegram are unchanged, and I deliberately do not flip is_group (that would change the email-access-gate/group-bypass semantics — out of scope).
• slack_service: get_user_info / get_channel_info.

Phase 3 — proactive channel messaging (AC: list_channel_groups + send_group_message for Slack, rate-limited)

• Backend: GET /api/agents/{name}/slack/channels (list bound channels) and POST /api/agents/{name}/slack/channels/{channel_id}/messages — owner-gated, rate-limited 10/hr/channel + 100/hr/agent via the shared limiter (refactor(backend): unified Redis sliding-window rate limiter (replace ad-hoc per-endpoint limiters) #1023), optional thread_ts, posts via chat.postMessage with the agent identity.
• db.get_slack_channels_for_agent (cross-workspace); SlackChannelMessageRequest in models.py (Invariant Add internal health route, without which main didn't start #14).
• MCP list_channel_groups / send_group_message now accept channel_type: "telegram" | "slack" (+ Slack thread_ts); new TrinityClient methods. The chat_with_agent/tool bodies are untouched.

Tests

tests/unit/test_350_slack_identity.py — 9 cases (identity-prefix builder incl. DM/empty cases, enrichment metadata population, DM-skips-channel, best-effort error swallow, no-token no-op). Updated the access-gate test double for the new async hook. Full run: 81 passed across the router + slack suites. MCP tsc clean for the changed files (only a pre-existing unrelated yaml dep error remains).

Scope notes

• Phase 2 (observation) → feat(slack): Phase 2 — channel observation mode (agent sees non-@mention messages) #1413.
• Backend is_group semantics unchanged (access-gate safety).
• No OAuth scope changes in this PR.

Related to #350

🤖 Generated with Claude Code

---

Also in this PR — #292 (Slack bot icon)

Bundled per request (same adapter, same Slack identity surface). The bot username was already correct (send_response passes username=agent_name since #63; chat:write.customize is in the requested scopes) — the gap was the icon: nothing populated agent_avatar_url, so icon_url was always None. message_router now attaches a best-effort public avatar URL ({public_chat_url}/api/agents/{name}/avatar, cache-busted by avatar_updated_at) which the Slack adapter forwards as icon_url. Channels, DMs, threads. Best-effort (None without a public base URL; 404s fall back to the default icon). 4 unit cases added.

Related to #292

[github-actions]

⚠️ Nightly unit-suite check skipped — merge conflict against dev.

Resolve by running git merge dev locally and pushing the result. The next nightly run will re-test once the conflict is gone.

[vybe]

Validated via /validate-pr: #350 Phase 1&3 + #292 — Slack channel identity, proactive messaging, per-agent bot icon. All CI green (pytest×6, CodeQL, schema-parity, verify-non-root, prod-image-smoke); tests for slack identity + message-router access gate. Three surfaces in sync (router + adapters + MCP channels.ts). Note: #350 is an epic — this is a phase, so no closing keyword by design. Approving for merge to dev.