feat(slack): multi-workspace Socket Mode (semantic port of #20587)

[jordanhubbard]

Supersedes #20587. That PR modified the pre-relocation gateway/platforms/slack.py; commit 5600105 moved the Slack adapter to the bundled plugin, so this is a semantic re-implementation against plugins/platforms/slack/adapter.py that also resolves the hermes-sweeper review findings.

Stack

Stacked on #20583 (scopes Slack sessions/routing by workspace). Review/merge #20583 first; the meaningful diff here is the single top commit on top of that branch. main has advanced since the stack was cut, so a rebase onto latest main is needed before merge (same situation as #20587). Advances #10099.

What this adds

• ~/.hermes/slack_accounts.json: one AsyncApp + Socket Mode websocket per account. Slack distributes a single app token's events across competing sockets, so each workspace needs its own app-token connection to receive reliably.
• The primary account keeps the legacy self._app/_handler/_socket_mode_task fields and lock, so existing single-workspace behavior (and its tests) are unchanged; extra accounts live in self._extra_connections with their own scoped slack-app-token locks.
• _register_app_handlers(app) shares handler registration across every account's app.
• Channel→team routing is persisted to ~/.hermes/slack_channel_teams.json and reloaded on connect, so outbound sends after a restart reach the right workspace client.

Addresses the hermes-sweeper review on #20587

• Ported into the bundled plugin, not the relocated gateway/platforms/slack.py.
• Retains per-socket recovery: the existing Socket Mode watchdog now monitors every extra connection and restarts dead/disconnected ones per-account (_restart_extra_connection) — the original PR's raw create_task() path had no monitor.
• Session/routing key changes stay Slack-scoped (scope_id); Discord and other platforms keep their existing key format (via the fix(slack): scope sessions and routing by workspace #20583 base this is stacked on) — no cross-platform session-key regression.
• Preserves file_shared → _handle_slack_file_shared (the original PR regressed it to a no-op pass) and all newer handlers.

Tests

tests/gateway/test_slack.py::TestSlackMultiAccountSocketMode (9 tests):

• one connection per account; each holds its own app-token lock
• watchdog restarts a dead extra connection; restart rebuilds the socket
• file_shared dispatches to the real handler; action handlers registered per app
• colliding workspace IDs still open both sockets; duplicate app token in config is skipped; channel→team routing survives a restart

Full tests/gateway/test_slack.py + test_session.py + test_slack_approval_buttons.py: 403 passed (394 pre-existing + 9 new).

🤖 Generated with Claude Code

[alt-glitch]

This was generated by AI during triage.

Related to #20587 and stacked on #20583, rather than a duplicate: this is a plugin-path semantic port with additional workspace-scoped routing/session migration and recovery behavior. Please review/rebase the stack together.

[jordanhubbard]

Merged latest main and resolved conflicts (no longer CONFLICTING). Resolutions:

• gateway/session.py: kept the new transcript-retry __init__ fields alongside the workspace legacy-key claim state; wrapped session recovery in main's new try/except (honoring raise_on_lookup_error) while preserving the migrated_legacy tracking.
• plugins/platforms/slack/adapter.py: kept the multi-account _load_accounts() flow and folded main's secret-scope SLACK_APP_TOKEN resolution (get_secret / UnscopedSecretError, Multiplex: Slack adapter reads SLACK_APP_TOKEN from process env — all profiles connect Socket Mode to the default profile's Slack app #59739) into the env-var fallback; took main's _env(...) allowlist helper.

ruff check clean; tests/gateway/test_slack.py + test_session.py + test_slack_approval_buttons.py → 410 passed.

[teknium1]

Thanks for the semantic port and for retaining the per-socket recovery design. The multi-account receive premise remains real on current main: website/docs/user-guide/messaging/slack.md:564-605 configures multiple bot tokens but one Socket Mode app token.

Problems

• gateway/session.py:1527-1533 catches every find_latest_gateway_session_for_peer failure in _find_gateway_session_row() and returns None. This bypasses _recover_session_from_db(..., raise_on_lookup_error=True) at gateway/session.py:1541-1569. Current main's startup prune deliberately catches that propagated failure and retains the stale route (gateway/session.py:1203-1220); with this change, an unavailable/failed DB lookup is indistinguishable from no recoverable session and can remove the route.

Suggested changes

• Preserve the existing fail-closed propagation path, then add a regression test for a raised recovery lookup during stale-route pruning.

Automated hermes-sweeper review.

[teknium1]

This catch makes raise_on_lookup_error=True ineffective: _recover_session_from_db() receives None rather than the DB exception. Current startup pruning relies on that exception to retain a stale route rather than remove it. Please propagate errors for the fail-closed caller (or parameterize this helper) and add coverage.

[teknium1]

Closing as superseded by #70190 (merged): the session-scoping correctness half landed via #70190 with your authorship; the multi-app Socket Mode feature half remains open for the multi-tenant feature review.

Thanks for the work — it's credited in #70190's summary.