Send hosted Slack replies, files, and notifications through the gateway

[alex-clickhouse]

Stacked on #465 (alex/hosted-channel-intake); #467 is stacked on this one. The gateway side of these operations is in review in ClickHouse/nerve-private#71, in the stack ClickHouse/nerve-private#63 to ClickHouse/nerve-private#77.

In hosted mode, Nerve now sends its outbound work to Slack through the gateway. Each action is a channel contract operation on a gateway stream. Self-hosted Slack is unchanged.

Why

After #465, a hosted agent can read Slack but cannot answer. This PR gives it the same outbound features as Socket Mode: replies, streaming edits, typing, send_channel_message, send_file, attachments, and notification cards.

What it does

• OperationRunner sends each operation on a stream that advertised it for the connection, within the stream and connection in-flight limits. The gateway gets the connection's deadline as its budget.
• When a result is lost, a retry-safe operation is sent again. A side-effecting operation is reported as ambiguous and is never sent again, because it may already be in Slack. A rate-limited operation is sent again after the advised delay.
• Replies are split at the connection's text limit. Streamed replies use a placeholder, paced edits, and a delete. When a connection that can send lacks edit or delete, there is no placeholder, and the reply is sent once when the turn ends. That path is in the shared StreamAdapter, which sends the buffered reply whenever no placeholder exists. Typing is an eyes reaction on the message that started the turn.
• While slack.enabled is false, the hosted channel sends no notifications and refuses send_channel_message. A turn that is already running still sends its reply.
• send_channel_message keeps the slack.allow_outbound switch. When allow_channels or deny_channels is set, the conversation ID must also pass them. The gateway decides in every case, and the agent gets a refusal without the gateway's reason.
• send_file uploads in chunks after its operation, within the connection's file limit and the gateway's memory limit.
• Attachments of a message that starts a turn are read through the gateway before the turn, with the Socket Mode rules for text, images, PDF, and ZIP files, and a limit for each file and each message.
• A notification is a card with one button for each answer, in the same conversation as in Socket Mode. A press answers the notification only in the conversation where it was delivered, and the card then shows the answer without buttons.
• The gateway closes a stream on any frame that fails its checks. Nerve checks the values that the agent chooses before it sends them: target and message IDs, reaction names, upload file names, button labels and answers, and empty text. A bad value fails one operation, not the stream.
• The contract adds the operation, result, and transfer records that Nerve uses. A result must answer its operation's kind with a known outcome, and carry the target or transfer that Nerve reads; capabilities must give usable limits.
• nerve doctor reports the hosted send tool settings and the notification conversation, and says that /nerve commands are not available in hosted mode.

How it was tested

• The fake gateway serves operations from scripted replies, serves attachment reads, and collects uploads, against the real application under uvicorn.
• Tests cover lost results for retry-safe and side-effecting operations, rate limits, in-flight limits, split replies, streamed edits, uploads with an early result, attachment limits, and notification presses.
• Full backend suite at this branch: 4723 passed. One login timing test failed once while three suites ran in parallel, and passed three times alone. At the top of this stack: 4725 passed.
• With Take hosted Slack events from a shared channel gateway #465 and Take the self mention flag from hosted events and trust their admission #467, this stack ran end to end against a development build of the gateway (see Take hosted Slack events from a shared channel gateway #465): replies in a channel thread and a direct message, and attachment reads, in a real Slack workspace.
• CI for this head, started by hand because the base is not main: run 36739445939. Backend and frontend jobs passed.

Known gaps

• send_interaction is not implemented. The engine offers interactive tool prompts to the web channel only.
• A lost file_send is reported as ambiguous, even when the last chunk was not sent.
• After a restart, a notification card gets its text from the event content. If the gateway sends no content, the card shows only the answer.
• An option value longer than 256 bytes gets no button, and hosted mode has no /nerve reply.
• A press does not check that the pressed message is the delivered card.
• Without allow_channels or deny_channels, Nerve does not limit where the send tool may post, direct messages included. Socket Mode refuses unsolicited direct messages. The gateway decides.
• nerve doctor reports settings only, not live streams.

🤖 Generated with Claude Code