@agent-native/core 0.98.6 → 0.98.7

package/dist/integrations/identity.js

@@ -2,6 +2,22 @@ import { getDbExec } from "../db/client.js";
 import { upsertVerifiedIntegrationIdentity } from "./identity-links-store.js";
 import { getActiveIntegrationInstallationByKey, getActiveIntegrationInstallationForTenant, } from "./installations-store.js";
 import { slackInstallationKey } from "./slack-oauth.js";
+/**
+ * Thrown when the default Slack DM identity ladder declines to run a message.
+ * `reason` is a stable machine-readable discriminator (used e.g. to dedupe
+ * decline replies); `userFacingMessage` is safe to send back to the sender as
+ * a polite reply; `message` stays log-only.
+ */
+export class IntegrationIdentityDeclinedError extends Error {
+    reason;
+    userFacingMessage;
+    constructor(reason, message, userFacingMessage) {
+        super(message);
+        this.name = "IntegrationIdentityDeclinedError";
+        this.reason = reason;
+        this.userFacingMessage = userFacingMessage;
+    }
+}
 function serviceOwner(platform) {
     return `integration@${platform}`;
 }
@@ -33,26 +49,26 @@ async function resolveSlackInstallation(incoming) {
         : null;
 }
 async function isMemberOfOrg(email, orgId) {
-    try {
-        const { rows } = await getDbExec().execute({
-            sql: `SELECT 1 FROM org_members
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT 1 FROM org_members
         WHERE org_id = ? AND LOWER(email) = ?
         LIMIT 1`,
-            args: [orgId, email],
-        });
-        return rows.length > 0;
-    }
-    catch {
-        return false;
-    }
+        args: [orgId, email],
+    });
+    return rows.length > 0;
 }
 /**
  * Resolve the default integration principal.
  *
  * Slack DMs become a user principal only after the adapter has verified the
  * sender email and the email is already a member of the managed installation's
- * Agent Native organization. Shared channels deliberately stay service-scoped
- * so a channel message cannot borrow one participant's private permissions.
+ * Agent Native organization. Hydrated full workspace members whose email is
+ * missing, unverified, or not an organization member run as an anonymous
+ * org-scoped service principal instead — the same visibility shared channels
+ * get. Hydration failures, guests/external members, and workspaces without a
+ * connected organization are declined with a user-facing message. Shared
+ * channels deliberately stay service-scoped so a channel message cannot borrow
+ * one participant's private permissions.
  */
 export async function resolveDefaultIntegrationExecutionContext(incoming) {
     const installation = incoming.platform === "slack"
@@ -66,35 +82,61 @@ export async function resolveDefaultIntegrationExecutionContext(incoming) {
             ...(installation?.id ? { installationId: installation.id } : {}),
         };
     }
-    const email = normalizedEmail(incoming.senderEmail);
-    if (!email ||
-        incoming.senderVerified !== true ||
-        !incoming.senderId ||
-        !incoming.tenantId) {
-        throw new Error("Slack DM sender identity could not be verified; refusing to run with a service principal.");
+    // Hydration check first: a transient users.info failure must land on the
+    // retry decline here, never on the anonymous org-scoped tier below.
+    if (incoming.actorTrust?.verified !== true) {
+        throw new IntegrationIdentityDeclinedError("unverified", "Slack DM sender identity could not be hydrated; declining instead of guessing a principal.", "I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.");
     }
-    if (incoming.actorTrust?.memberType === "guest" ||
-        incoming.actorTrust?.memberType === "external") {
-        throw new Error("External or guest Slack members cannot use personal Agent Native permissions.");
+    if (incoming.actorTrust.memberType === "guest" ||
+        incoming.actorTrust.memberType === "external") {
+        throw new IntegrationIdentityDeclinedError("guest", "External or guest Slack members cannot use this integration.", "This assistant is only available to members of this workspace's organization.");
     }
     if (!installation?.orgId) {
-        throw new Error("Slack workspace is not connected to an Agent Native organization.");
+        throw new IntegrationIdentityDeclinedError("unlinked-workspace", "Slack workspace is not connected to an Agent Native organization.", "This Slack workspace isn't connected to an organization yet.");
     }
-    if (!(await isMemberOfOrg(email, installation.orgId))) {
-        throw new Error("Slack DM sender is not a member of the connected Agent Native organization.");
+    const email = normalizedEmail(incoming.senderEmail);
+    let isOrgMember = false;
+    if (email &&
+        incoming.senderVerified === true &&
+        incoming.senderId &&
+        incoming.tenantId) {
+        try {
+            isOrgMember = await isMemberOfOrg(email, installation.orgId);
+        }
+        catch {
+            // A membership-store outage is not evidence that the sender is merely
+            // unlinked. Fail closed instead of widening them to org-wide access.
+            throw new IntegrationIdentityDeclinedError("membership-check-failed", "Slack DM organization membership could not be verified.", "I couldn't verify your organization membership just now, so I can't run this request. Please try again in a moment.");
+        }
     }
-    const link = await upsertVerifiedIntegrationIdentity({
-        platform: incoming.platform,
-        tenantId: incoming.tenantId,
-        externalUserId: incoming.senderId,
-        userEmail: email,
-        orgId: installation.orgId,
-    });
+    if (isOrgMember && email && incoming.senderId && incoming.tenantId) {
+        const link = await upsertVerifiedIntegrationIdentity({
+            platform: incoming.platform,
+            tenantId: incoming.tenantId,
+            externalUserId: incoming.senderId,
+            userEmail: email,
+            orgId: installation.orgId,
+        });
+        return {
+            ownerEmail: link.userEmail,
+            orgId: link.orgId,
+            principalType: "user",
+            installationId: installation.id,
+        };
+    }
+    // Hydrated full workspace member (member/admin/owner) whose email is
+    // unverified, missing (legacy install without users:read.email), or not an
+    // organization member: run with the anonymous org-scoped service principal —
+    // the same visibility shared channels get. Nothing user-private is
+    // accessible. One structured line keeps 100%-anonymous workspaces (legacy
+    // scope missing) visible in logs.
+    console.warn(`[integrations] anonymous org-scoped principal used: platform=${incoming.platform} teamId=${incoming.tenantId ?? "unknown"} emailPresent=${Boolean(email)} memberType=${incoming.actorTrust.memberType}`);
     return {
-        ownerEmail: link.userEmail,
-        orgId: link.orgId,
-        principalType: "user",
+        ownerEmail: serviceOwner(incoming.platform),
+        orgId: installation.orgId,
+        principalType: "service",
         installationId: installation.id,
+        anonymousMember: true,
     };
 }
 //# sourceMappingURL=identity.js.map

package/dist/integrations/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/integrations/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,yCAAyC,GAC1C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAGxD,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,eAAe,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAyB;IAC/D,MAAM,MAAM,GACV,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ;QACjD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM;QACjC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,QAAQ,CAAC,eAAe,CAAC,YAAY,KAAK,QAAQ;QACvD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,eAAe,CAAC,QAAQ,KAAK,QAAQ;QACnD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,qCAAqC,CACvD,OAAO,EACP,oBAAoB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CACzD,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,IAAI,YAAY;QAC3B,CAAC,CAAC,yCAAyC,CACvC,OAAO,EACP,MAAM,IAAI,YAAa,CACxB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,KAAa;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;;gBAEK;YACV,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,QAAyB;IAEzB,MAAM,YAAY,GAChB,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO;YACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,IAAI;YAClC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IACE,CAAC,KAAK;QACN,QAAQ,CAAC,cAAc,KAAK,IAAI;QAChC,CAAC,QAAQ,CAAC,QAAQ;QAClB,CAAC,QAAQ,CAAC,QAAQ,EAClB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO;QAC3C,QAAQ,CAAC,UAAU,EAAE,UAAU,KAAK,UAAU,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,cAAc,EAAE,QAAQ,CAAC,QAAQ;QACjC,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,YAAY,CAAC,KAAK;KAC1B,CAAC,CAAC;IACH,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,YAAY,CAAC,EAAE;KAChC,CAAC;AACJ,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { upsertVerifiedIntegrationIdentity } from \"./identity-links-store.js\";\nimport {\n  getActiveIntegrationInstallationByKey,\n  getActiveIntegrationInstallationForTenant,\n} from \"./installations-store.js\";\nimport { slackInstallationKey } from \"./slack-oauth.js\";\nimport type { IncomingMessage, IntegrationExecutionContext } from \"./types.js\";\n\nfunction serviceOwner(platform: string): string {\n  return `integration@${platform}`;\n}\n\nfunction normalizedEmail(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const email = value.trim().toLowerCase();\n  if (!email || email.length > 320 || !email.includes(\"@\")) return null;\n  return email;\n}\n\nasync function resolveSlackInstallation(incoming: IncomingMessage) {\n  const teamId =\n    typeof incoming.platformContext.teamId === \"string\"\n      ? incoming.platformContext.teamId\n      : incoming.tenantId;\n  const enterpriseId =\n    typeof incoming.platformContext.enterpriseId === \"string\"\n      ? incoming.platformContext.enterpriseId\n      : undefined;\n  const apiAppId =\n    typeof incoming.platformContext.apiAppId === \"string\"\n      ? incoming.platformContext.apiAppId\n      : undefined;\n  if (apiAppId && (teamId || enterpriseId)) {\n    const byKey = await getActiveIntegrationInstallationByKey(\n      \"slack\",\n      slackInstallationKey({ teamId, enterpriseId, apiAppId }),\n    );\n    if (byKey) return byKey;\n  }\n  return teamId || enterpriseId\n    ? getActiveIntegrationInstallationForTenant(\n        \"slack\",\n        teamId ?? enterpriseId!,\n      )\n    : null;\n}\n\nasync function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT 1 FROM org_members\n        WHERE org_id = ? AND LOWER(email) = ?\n        LIMIT 1`,\n      args: [orgId, email],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Resolve the default integration principal.\n *\n * Slack DMs become a user principal only after the adapter has verified the\n * sender email and the email is already a member of the managed installation's\n * Agent Native organization. Shared channels deliberately stay service-scoped\n * so a channel message cannot borrow one participant's private permissions.\n */\nexport async function resolveDefaultIntegrationExecutionContext(\n  incoming: IncomingMessage,\n): Promise<IntegrationExecutionContext> {\n  const installation =\n    incoming.platform === \"slack\"\n      ? await resolveSlackInstallation(incoming)\n      : null;\n\n  if (incoming.platform !== \"slack\" || incoming.conversationType !== \"dm\") {\n    return {\n      ownerEmail: serviceOwner(incoming.platform),\n      orgId: installation?.orgId ?? null,\n      principalType: \"service\",\n      ...(installation?.id ? { installationId: installation.id } : {}),\n    };\n  }\n\n  const email = normalizedEmail(incoming.senderEmail);\n  if (\n    !email ||\n    incoming.senderVerified !== true ||\n    !incoming.senderId ||\n    !incoming.tenantId\n  ) {\n    throw new Error(\n      \"Slack DM sender identity could not be verified; refusing to run with a service principal.\",\n    );\n  }\n  if (\n    incoming.actorTrust?.memberType === \"guest\" ||\n    incoming.actorTrust?.memberType === \"external\"\n  ) {\n    throw new Error(\n      \"External or guest Slack members cannot use personal Agent Native permissions.\",\n    );\n  }\n  if (!installation?.orgId) {\n    throw new Error(\n      \"Slack workspace is not connected to an Agent Native organization.\",\n    );\n  }\n\n  if (!(await isMemberOfOrg(email, installation.orgId))) {\n    throw new Error(\n      \"Slack DM sender is not a member of the connected Agent Native organization.\",\n    );\n  }\n\n  const link = await upsertVerifiedIntegrationIdentity({\n    platform: incoming.platform,\n    tenantId: incoming.tenantId,\n    externalUserId: incoming.senderId,\n    userEmail: email,\n    orgId: installation.orgId,\n  });\n  return {\n    ownerEmail: link.userEmail,\n    orgId: link.orgId,\n    principalType: \"user\",\n    installationId: installation.id,\n  };\n}\n"]}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/integrations/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,yCAAyC,GAC1C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AASxD;;;;;GAKG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,MAAM,CAAmC;IACzC,iBAAiB,CAAS;IAEnC,YACE,MAAwC,EACxC,OAAe,EACf,iBAAyB;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,eAAe,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAyB;IAC/D,MAAM,MAAM,GACV,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ;QACjD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM;QACjC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,QAAQ,CAAC,eAAe,CAAC,YAAY,KAAK,QAAQ;QACvD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,eAAe,CAAC,QAAQ,KAAK,QAAQ;QACnD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,qCAAqC,CACvD,OAAO,EACP,oBAAoB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CACzD,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,IAAI,YAAY;QAC3B,CAAC,CAAC,yCAAyC,CACvC,OAAO,EACP,MAAM,IAAI,YAAa,CACxB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,KAAa;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;gBAEO;QACZ,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,QAAyB;IAEzB,MAAM,YAAY,GAChB,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO;YACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,IAAI;YAClC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,UAAU,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,gCAAgC,CACxC,YAAY,EACZ,4FAA4F,EAC5F,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,CAAC,UAAU,KAAK,OAAO;QAC1C,QAAQ,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU,EAC7C,CAAC;QACD,MAAM,IAAI,gCAAgC,CACxC,OAAO,EACP,8DAA8D,EAC9D,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CACxC,oBAAoB,EACpB,mEAAmE,EACnE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IACE,KAAK;QACL,QAAQ,CAAC,cAAc,KAAK,IAAI;QAChC,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ,EACjB,CAAC;QACD,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,gCAAgC,CACxC,yBAAyB,EACzB,yDAAyD,EACzD,qHAAqH,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,KAAK,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,cAAc,EAAE,QAAQ,CAAC,QAAQ;YACjC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,YAAY,CAAC,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,kCAAkC;IAClC,OAAO,CAAC,IAAI,CACV,gEAAgE,QAAQ,CAAC,QAAQ,WAAW,QAAQ,CAAC,QAAQ,IAAI,SAAS,iBAAiB,OAAO,CAAC,KAAK,CAAC,eAAe,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,CACzM,CAAC;IACF,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,aAAa,EAAE,SAAS;QACxB,cAAc,EAAE,YAAY,CAAC,EAAE;QAC/B,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { upsertVerifiedIntegrationIdentity } from \"./identity-links-store.js\";\nimport {\n  getActiveIntegrationInstallationByKey,\n  getActiveIntegrationInstallationForTenant,\n} from \"./installations-store.js\";\nimport { slackInstallationKey } from \"./slack-oauth.js\";\nimport type { IncomingMessage, IntegrationExecutionContext } from \"./types.js\";\n\nexport type IntegrationIdentityDeclineReason =\n  | \"unverified\"\n  | \"guest\"\n  | \"unlinked-workspace\"\n  | \"membership-check-failed\";\n\n/**\n * Thrown when the default Slack DM identity ladder declines to run a message.\n * `reason` is a stable machine-readable discriminator (used e.g. to dedupe\n * decline replies); `userFacingMessage` is safe to send back to the sender as\n * a polite reply; `message` stays log-only.\n */\nexport class IntegrationIdentityDeclinedError extends Error {\n  readonly reason: IntegrationIdentityDeclineReason;\n  readonly userFacingMessage: string;\n\n  constructor(\n    reason: IntegrationIdentityDeclineReason,\n    message: string,\n    userFacingMessage: string,\n  ) {\n    super(message);\n    this.name = \"IntegrationIdentityDeclinedError\";\n    this.reason = reason;\n    this.userFacingMessage = userFacingMessage;\n  }\n}\n\nfunction serviceOwner(platform: string): string {\n  return `integration@${platform}`;\n}\n\nfunction normalizedEmail(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const email = value.trim().toLowerCase();\n  if (!email || email.length > 320 || !email.includes(\"@\")) return null;\n  return email;\n}\n\nasync function resolveSlackInstallation(incoming: IncomingMessage) {\n  const teamId =\n    typeof incoming.platformContext.teamId === \"string\"\n      ? incoming.platformContext.teamId\n      : incoming.tenantId;\n  const enterpriseId =\n    typeof incoming.platformContext.enterpriseId === \"string\"\n      ? incoming.platformContext.enterpriseId\n      : undefined;\n  const apiAppId =\n    typeof incoming.platformContext.apiAppId === \"string\"\n      ? incoming.platformContext.apiAppId\n      : undefined;\n  if (apiAppId && (teamId || enterpriseId)) {\n    const byKey = await getActiveIntegrationInstallationByKey(\n      \"slack\",\n      slackInstallationKey({ teamId, enterpriseId, apiAppId }),\n    );\n    if (byKey) return byKey;\n  }\n  return teamId || enterpriseId\n    ? getActiveIntegrationInstallationForTenant(\n        \"slack\",\n        teamId ?? enterpriseId!,\n      )\n    : null;\n}\n\nasync function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT 1 FROM org_members\n        WHERE org_id = ? AND LOWER(email) = ?\n        LIMIT 1`,\n    args: [orgId, email],\n  });\n  return rows.length > 0;\n}\n\n/**\n * Resolve the default integration principal.\n *\n * Slack DMs become a user principal only after the adapter has verified the\n * sender email and the email is already a member of the managed installation's\n * Agent Native organization. Hydrated full workspace members whose email is\n * missing, unverified, or not an organization member run as an anonymous\n * org-scoped service principal instead — the same visibility shared channels\n * get. Hydration failures, guests/external members, and workspaces without a\n * connected organization are declined with a user-facing message. Shared\n * channels deliberately stay service-scoped so a channel message cannot borrow\n * one participant's private permissions.\n */\nexport async function resolveDefaultIntegrationExecutionContext(\n  incoming: IncomingMessage,\n): Promise<IntegrationExecutionContext> {\n  const installation =\n    incoming.platform === \"slack\"\n      ? await resolveSlackInstallation(incoming)\n      : null;\n\n  if (incoming.platform !== \"slack\" || incoming.conversationType !== \"dm\") {\n    return {\n      ownerEmail: serviceOwner(incoming.platform),\n      orgId: installation?.orgId ?? null,\n      principalType: \"service\",\n      ...(installation?.id ? { installationId: installation.id } : {}),\n    };\n  }\n\n  // Hydration check first: a transient users.info failure must land on the\n  // retry decline here, never on the anonymous org-scoped tier below.\n  if (incoming.actorTrust?.verified !== true) {\n    throw new IntegrationIdentityDeclinedError(\n      \"unverified\",\n      \"Slack DM sender identity could not be hydrated; declining instead of guessing a principal.\",\n      \"I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.\",\n    );\n  }\n  if (\n    incoming.actorTrust.memberType === \"guest\" ||\n    incoming.actorTrust.memberType === \"external\"\n  ) {\n    throw new IntegrationIdentityDeclinedError(\n      \"guest\",\n      \"External or guest Slack members cannot use this integration.\",\n      \"This assistant is only available to members of this workspace's organization.\",\n    );\n  }\n  if (!installation?.orgId) {\n    throw new IntegrationIdentityDeclinedError(\n      \"unlinked-workspace\",\n      \"Slack workspace is not connected to an Agent Native organization.\",\n      \"This Slack workspace isn't connected to an organization yet.\",\n    );\n  }\n\n  const email = normalizedEmail(incoming.senderEmail);\n  let isOrgMember = false;\n  if (\n    email &&\n    incoming.senderVerified === true &&\n    incoming.senderId &&\n    incoming.tenantId\n  ) {\n    try {\n      isOrgMember = await isMemberOfOrg(email, installation.orgId);\n    } catch {\n      // A membership-store outage is not evidence that the sender is merely\n      // unlinked. Fail closed instead of widening them to org-wide access.\n      throw new IntegrationIdentityDeclinedError(\n        \"membership-check-failed\",\n        \"Slack DM organization membership could not be verified.\",\n        \"I couldn't verify your organization membership just now, so I can't run this request. Please try again in a moment.\",\n      );\n    }\n  }\n  if (isOrgMember && email && incoming.senderId && incoming.tenantId) {\n    const link = await upsertVerifiedIntegrationIdentity({\n      platform: incoming.platform,\n      tenantId: incoming.tenantId,\n      externalUserId: incoming.senderId,\n      userEmail: email,\n      orgId: installation.orgId,\n    });\n    return {\n      ownerEmail: link.userEmail,\n      orgId: link.orgId,\n      principalType: \"user\",\n      installationId: installation.id,\n    };\n  }\n\n  // Hydrated full workspace member (member/admin/owner) whose email is\n  // unverified, missing (legacy install without users:read.email), or not an\n  // organization member: run with the anonymous org-scoped service principal —\n  // the same visibility shared channels get. Nothing user-private is\n  // accessible. One structured line keeps 100%-anonymous workspaces (legacy\n  // scope missing) visible in logs.\n  console.warn(\n    `[integrations] anonymous org-scoped principal used: platform=${incoming.platform} teamId=${incoming.tenantId ?? \"unknown\"} emailPresent=${Boolean(email)} memberType=${incoming.actorTrust.memberType}`,\n  );\n  return {\n    ownerEmail: serviceOwner(incoming.platform),\n    orgId: installation.orgId,\n    principalType: \"service\",\n    installationId: installation.id,\n    anonymousMember: true,\n  };\n}\n"]}

package/dist/integrations/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AAsIA,OAAO,KAAK,EAEV,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAOpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA4F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CA69DhB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AAyIA,OAAO,KAAK,EAEV,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAOpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA4F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAeF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CA6hEhB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}

package/dist/integrations/plugin.js

@@ -26,7 +26,7 @@ import { ComputerSupervisionError } from "./computer-supervision.js";
 import { getIntegrationConfig, saveIntegrationConfig } from "./config-store.js";
 import { claimIntegrationControl } from "./controls-store.js";
 import { startGoogleDocsPoller, handlePushNotification, } from "./google-docs-poller.js";
-import { resolveDefaultIntegrationExecutionContext } from "./identity.js";
+import { IntegrationIdentityDeclinedError, resolveDefaultIntegrationExecutionContext, } from "./identity.js";
 import { disconnectIntegrationInstallation, listIntegrationInstallations, resolveIntegrationTokenBundle, updateIntegrationInstallation, upsertIntegrationInstallation, } from "./installations-store.js";
 import { forgetIntegrationMemory, integrationMemoryActions, listIntegrationMemory, rememberForIntegrationScope, } from "./integration-memory.js";
 import { extractBearerToken, signInternalToken, verifyInternalToken, } from "./internal-token.js";
@@ -124,6 +124,10 @@ Keep responses concise — messaging platforms have character limits and users e
 
 If a task requires many steps, summarize what you did rather than streaming every detail.`;
 const REMOTE_DEVICE_ONLINE_MS = 90_000;
+// One decline reply per sender + decline reason per window: during a Slack
+// API outage every message would otherwise get another identical "try again"
+// reply. Short enough that a persistent condition still reminds the sender.
+const DECLINE_NOTICE_DEDUPE_TTL_MS = 5 * 60 * 1_000;
 export async function enqueueRemoteCommand(envelope) {
     const ownerEmail = readString(envelope.ownerEmail);
     if (!ownerEmail)
@@ -1912,11 +1916,33 @@ export function createIntegrationsPlugin(options) {
                         defaultExecutionContext = await withCredentialContext(credentialContext, () => resolveDefaultIntegrationExecutionContext(incoming));
                     }
                     catch (err) {
-                        // An app-specific resolver may intentionally support a legacy
-                        // Slack setup. When no override exists, the branch below fails
-                        // closed instead of falling back to a service principal.
-                        if (!options?.resolveExecutionContext && !options?.resolveOwner) {
-                            console.error(`[integrations] default Slack DM identity denied message:`, err);
+                        // Only an explicit execution-context resolver may override the
+                        // default Slack identity ladder. The legacy owner-only resolver
+                        // predates org-bound identities and must not turn a rejected DM
+                        // into an authenticated owner run.
+                        if (!options?.resolveExecutionContext) {
+                            const declined = err instanceof IntegrationIdentityDeclinedError ? err : null;
+                            if (declined) {
+                                console.warn(`[integrations] default Slack DM identity declined message:`, declined.message);
+                                // Best-effort polite reply back to the DM, deduped per
+                                // sender + reason so an outage doesn't produce an identical
+                                // reply for every message. Do not await Slack's API: webhook
+                                // acknowledgement has a stricter deadline than notice
+                                // delivery and must not be delayed by a slow postMessage.
+                                void withCredentialContext(credentialContext, () => adapter.sendSystemNotice
+                                    ? adapter.sendSystemNotice(incoming, declined.userFacingMessage, {
+                                        dedupeKey: `decline:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}:${declined.reason}`,
+                                        dedupeTtlMs: DECLINE_NOTICE_DEDUPE_TTL_MS,
+                                    })
+                                    : Promise.resolve()).catch((noticeErr) => {
+                                    console.warn(`[integrations] decline notice failed:`, noticeErr instanceof Error
+                                        ? noticeErr.message
+                                        : noticeErr);
+                                });
+                            }
+                            else {
+                                console.error(`[integrations] default Slack DM identity denied message:`, err);
+                            }
                             setResponseStatus(event, 200);
                             return "ok";
                         }
@@ -1939,6 +1965,30 @@ export function createIntegrationsPlugin(options) {
                 }
                 else if (defaultExecutionContext) {
                     executionContext = defaultExecutionContext;
+                    if (defaultExecutionContext.anonymousMember) {
+                        // The anonymous tier must never be silent. (1) The agent run
+                        // can tell: the note rides the serialized `incoming` into the
+                        // queued task and surfaces via <integration-context>.
+                        incoming.identityNote =
+                            "Caller is an unlinked Slack workspace member running with organization-wide visibility only; personal or privately-shared data is not accessible. They can get personal access by having an admin add their Slack email to the organization (or by reconnecting Slack with the users:read.email scope).";
+                        // (2) The sender gets a one-time heads-up (adapter-throttled per
+                        // sender). Fire-and-forget so it never delays or replaces the
+                        // normal agent run.
+                        if (adapter.sendSystemNotice) {
+                            const senderEmail = typeof incoming.senderEmail === "string" &&
+                                incoming.senderEmail.trim()
+                                ? incoming.senderEmail.trim()
+                                : null;
+                            const noticeText = senderEmail
+                                ? `Heads up: I couldn't match your Slack account to an organization member, so I can only use org-wide data. Ask an admin to add ${senderEmail} to the organization for personal access.`
+                                : "Heads up: I couldn't verify your Slack account's email, so I can only use org-wide data. Ask an admin to update the Slack connection with the users:read.email scope for personal access.";
+                            void withCredentialContext(credentialContext, () => adapter.sendSystemNotice(incoming, noticeText, {
+                                dedupeKey: `anonymous-tier:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}`,
+                            })).catch((noticeErr) => {
+                                console.warn(`[integrations] anonymous-tier notice failed:`, noticeErr instanceof Error ? noticeErr.message : noticeErr);
+                            });
+                        }
+                    }
                 }
                 else if (options?.resolveOwner) {
                     try {