@agent-native/core 0.98.6 → 0.98.8

package/corpus/core/src/client/session-replay.ts

@@ -65,6 +65,8 @@ interface RrwebRecordModule {
 interface SessionReplayState {
   active: boolean;
   startPromise: Promise<SessionReplayStartResult> | null;
+  /** Invalidates deferred recorder startup when stop is requested mid-start. */
+  startGeneration: number;
   replayId: string | null;
   startedAtMs: number | null;
   sequence: number;
@@ -72,6 +74,8 @@ interface SessionReplayState {
   queue: QueuedReplayEvent[];
   queuedBytes: number;
   retryBatches: QueuedReplayEvent[][];
+  /** Consecutive retryable 4xx responses for the current recording episode. */
+  transientClientErrorFailures: number;
   flushTimer: number | null;
   maxDurationTimer: number | null;
   flushing: boolean;
@@ -432,12 +436,14 @@ function getState(): SessionReplayState {
     g[SESSION_REPLAY_STATE_KEY] = {
       active: false,
       startPromise: null,
+      startGeneration: 0,
       replayId: null,
       startedAtMs: null,
       sequence: 0,
       queue: [],
       queuedBytes: 0,
       retryBatches: [],
+      transientClientErrorFailures: 0,
       flushTimer: null,
       maxDurationTimer: null,
       flushing: false,
@@ -460,10 +466,12 @@ function getState(): SessionReplayState {
   const state = g[SESSION_REPLAY_STATE_KEY]!;
   // Keep Vite HMR safe when an older recorder state survives a module reload.
   state.resourceNodes ??= new Map();
+  state.transientClientErrorFailures ??= 0;
   state.restoreIframeBridge ??= null;
   state.pendingFlushReason ??= null;
   state.pendingFlushWaiters ??= [];
   state.awaitingFullSnapshot ??= false;
+  state.startGeneration ??= 0;
   return state;
 }
 
@@ -1452,12 +1460,19 @@ class ReplayUploadHttpError extends Error {
   }
 }
 
-/** 4xx statuses where retrying the exact same batch can never succeed --
- * e.g. a 409 chunk-sequence/checksum conflict, or a 400 the server will
- * reject again. 408 (timeout) and 429 (rate limit) are excluded because a
- * later retry can plausibly succeed. */
+/** 4xx statuses where retrying the exact same batch can never succeed.
+ * Keep this deliberately narrow: 401/403/404 can be temporary during auth or
+ * deploy transitions, so they get a small retry budget before the rejected
+ * episode is stopped. The budget prevents a persistent configuration failure
+ * from pinning retryBatches while rrweb events grow without bound. */
 function isDefinitiveReplayUploadClientError(status: number): boolean {
-  return status >= 400 && status < 500 && status !== 408 && status !== 429;
+  return status === 400 || status === 409 || status === 413 || status === 422;
+}
+
+const MAX_TRANSIENT_REPLAY_CLIENT_FAILURES = 3;
+
+function isTransientReplayUploadClientError(status: number): boolean {
+  return status === 401 || status === 403 || status === 404;
 }
 
 async function sendReplayUpload(
@@ -1733,6 +1748,7 @@ export async function flushSessionReplay(reason = "manual"): Promise<void> {
     });
     if (!reservedSequence) advanceReplaySequence(state, payload);
     state.automaticConflictRestartAttempted = false;
+    state.transientClientErrorFailures = 0;
     uploaded = true;
   } catch (error) {
     if (reservedSequence) rollbackReplaySequenceReservation(state, payload);
@@ -1745,9 +1761,22 @@ export async function flushSessionReplay(reason = "manual"): Promise<void> {
     const splitBatch = rejectedStatus === 413 ? splitReplayBatch(events) : null;
     const isUnsplittableOversizedBatch =
       rejectedStatus === 413 && splitBatch === null;
+    const isTransientClientError =
+      rejectedStatus !== null &&
+      isTransientReplayUploadClientError(rejectedStatus);
+    if (isTransientClientError) {
+      state.transientClientErrorFailures += 1;
+    } else {
+      state.transientClientErrorFailures = 0;
+    }
+    const exhaustedTransientClientRetries =
+      isTransientClientError &&
+      state.transientClientErrorFailures >=
+        MAX_TRANSIENT_REPLAY_CLIENT_FAILURES;
     const isDefinitiveClientError =
       error instanceof ReplayUploadHttpError &&
-      isDefinitiveReplayUploadClientError(error.status) &&
+      (isDefinitiveReplayUploadClientError(error.status) ||
+        exhaustedTransientClientRetries) &&
       !splitBatch &&
       !isUnsplittableOversizedBatch;
     if (splitBatch) {
@@ -1903,6 +1932,31 @@ async function restartSessionReplayAfterConflict(
   state: SessionReplayState,
   options: NormalizedSessionReplayOptions,
   sessionId: string,
+): Promise<SessionReplayStartResult> {
+  // Share the public-start mutex. A consumer may call start in the await gap
+  // after the rejected recorder stops; both paths must converge on one rrweb
+  // instance rather than racing two fresh identities.
+  if (state.startPromise) return state.startPromise;
+
+  const startGeneration = ++state.startGeneration;
+  let startPromise: Promise<SessionReplayStartResult>;
+  startPromise = restartSessionReplayAfterConflictInternal(
+    state,
+    options,
+    sessionId,
+    startGeneration,
+  ).finally(() => {
+    if (state.startPromise === startPromise) state.startPromise = null;
+  });
+  state.startPromise = startPromise;
+  return startPromise;
+}
+
+async function restartSessionReplayAfterConflictInternal(
+  state: SessionReplayState,
+  options: NormalizedSessionReplayOptions,
+  sessionId: string,
+  startGeneration: number,
 ): Promise<SessionReplayStartResult> {
   if (options.shouldStart && !options.shouldStart()) {
     return { started: false, reason: "disabled", sessionId, sampled: true };
@@ -1932,6 +1986,7 @@ async function restartSessionReplayAfterConflict(
     sessionId,
     true,
     initialProperties,
+    startGeneration,
   );
 }
 
@@ -2879,6 +2934,12 @@ export async function startSessionReplay(
   }
   if (state.startPromise) return state.startPromise;
 
+  // This is a new caller-initiated recording episode. A prior episode's
+  // conflict-loop guard must not prevent this one from recovering once.
+  state.automaticConflictRestartAttempted = false;
+  state.transientClientErrorFailures = 0;
+  const startGeneration = ++state.startGeneration;
+
   let startPromise: Promise<SessionReplayStartResult>;
   startPromise = startSessionReplayRecorder(
     state,
@@ -2886,6 +2947,7 @@ export async function startSessionReplay(
     sessionId,
     sampled,
     initialProperties,
+    startGeneration,
   ).finally(() => {
     if (state.startPromise === startPromise) {
       state.startPromise = null;
@@ -2901,6 +2963,7 @@ async function startSessionReplayRecorder(
   sessionId: string,
   sampled: boolean,
   initialProperties: Record<string, unknown> | undefined,
+  startGeneration: number,
 ): Promise<SessionReplayStartResult> {
   if (state.active && state.replayId) {
     return {
@@ -2918,6 +2981,9 @@ async function startSessionReplayRecorder(
   } catch {
     return { started: false, reason: "import-failed", sessionId, sampled };
   }
+  if (state.startGeneration !== startGeneration) {
+    return { started: false, reason: "disabled", sessionId, sampled };
+  }
   if (normalized.shouldStart && !normalized.shouldStart()) {
     return { started: false, reason: "disabled", sessionId, sampled };
   }
@@ -2950,6 +3016,20 @@ async function startSessionReplayRecorder(
       };
     }
   }
+  // stopSessionReplay may be called while the duplicate-tab probe is waiting.
+  // Recheck both cancellation and the caller's live eligibility before rrweb
+  // is activated so a deferred start cannot escape a route/auth teardown.
+  if (
+    state.startGeneration !== startGeneration ||
+    (normalized.shouldStart && !normalized.shouldStart())
+  ) {
+    try {
+      replayChannel?.close();
+    } catch {
+      // best-effort cleanup
+    }
+    return { started: false, reason: "disabled", sessionId, sampled };
+  }
   state.options = normalized;
   state.replayId = replaySession.replayId;
   state.startedAtMs = replaySession.startedAtMs;
@@ -3049,6 +3129,10 @@ async function startSessionReplayRecorder(
 
 export async function stopSessionReplay(reason = "manual"): Promise<void> {
   const state = getState();
+  // Invalidate an import/probe that has not set `active` yet. Without this,
+  // stop during the duplicated-tab claim window was a no-op and rrweb started
+  // after the caller believed recording had been disabled.
+  state.startGeneration += 1;
   if (!state.active) return;
   // Restore console/fetch/XHR before tearing down the recorder: the restore
   // flushes any pending collapsed console duplicate, which must still be able

package/corpus/core/src/integrations/adapters/slack.ts

@@ -56,6 +56,31 @@ const slackIdentityCache = new Map<
   { identity: SlackUserIdentity | null; expiresAt: number }
 >();
 
+// Deduped system notices send at most once per key per TTL so senders are
+// informed without being spammed per message. Callers pick the window: the
+// anonymous-tier heads-up uses the default day-long TTL; decline replies pass
+// a short TTL so a persistent condition still reminds the sender occasionally.
+const SLACK_SYSTEM_NOTICE_DEDUPE_TTL_MS = 24 * 60 * 60 * 1_000;
+const SLACK_SYSTEM_NOTICE_CACHE_MAX_ENTRIES = 1_000;
+const slackSystemNoticeCache = new Map<string, number>();
+
+/** Returns true when a deduped notice should send now, claiming the slot. */
+function claimSlackSystemNoticeSlot(
+  key: string,
+  ttlMs = SLACK_SYSTEM_NOTICE_DEDUPE_TTL_MS,
+): boolean {
+  const now = Date.now();
+  const expiresAt = slackSystemNoticeCache.get(key);
+  if (expiresAt && expiresAt > now) return false;
+  if (expiresAt) slackSystemNoticeCache.delete(key);
+  if (slackSystemNoticeCache.size >= SLACK_SYSTEM_NOTICE_CACHE_MAX_ENTRIES) {
+    const oldestKey = slackSystemNoticeCache.keys().next().value;
+    if (oldestKey) slackSystemNoticeCache.delete(oldestKey);
+  }
+  slackSystemNoticeCache.set(key, now + ttlMs);
+  return true;
+}
+
 export interface SlackAdapterOptions {
   /** Resolve the bot token for the exact Slack installation. */
   resolveBotToken?: (incoming: IncomingMessage) => Promise<string | undefined>;
@@ -264,7 +289,10 @@ export function slackAdapter(
           triggerKind: isDm ? "dm" : isMention ? "mention" : "thread_reply",
           conversationType: isDm ? "dm" : "unknown",
           tenantId: teamId,
-          actorTrust: { memberType: "unknown", verified: true },
+          // The signed Slack envelope authenticates the workspace, not the
+          // sender's membership tier. `users.info` hydration below is the
+          // authority that may promote this to a verified member.
+          actorTrust: { memberType: "unknown", verified: false },
           platformContext: {
             channelId: e.channel,
             channelType: e.channel_type,
@@ -493,6 +521,48 @@ export function slackAdapter(
       }
     },
 
+    async sendSystemNotice(
+      incoming: IncomingMessage,
+      text: string,
+      opts?: { dedupeKey?: string; dedupeTtlMs?: number },
+    ): Promise<void> {
+      if (!text.trim()) return;
+      const dedupeKey = opts?.dedupeKey;
+      if (
+        dedupeKey &&
+        !claimSlackSystemNoticeSlot(dedupeKey, opts?.dedupeTtlMs)
+      ) {
+        return;
+      }
+      try {
+        const token = await resolveBotToken(incoming);
+        if (!token) {
+          if (dedupeKey) slackSystemNoticeCache.delete(dedupeKey);
+          throw new Error("Slack bot token not configured for system notice");
+        }
+        const channelId = incoming.platformContext.channelId;
+        if (typeof channelId !== "string" || !channelId) {
+          if (dedupeKey) slackSystemNoticeCache.delete(dedupeKey);
+          throw new Error("Slack channel id missing for system notice");
+        }
+        const threadTs =
+          typeof incoming.platformContext.threadTs === "string"
+            ? incoming.platformContext.threadTs
+            : undefined;
+        await postFresh(token, channelId, threadTs, {
+          text,
+          unfurl_links: false,
+          unfurl_media: false,
+          mrkdwn: true,
+        });
+      } catch (error) {
+        // A failed delivery did not inform the sender, so release the slot and
+        // allow the next message to retry instead of suppressing notices for a day.
+        if (dedupeKey) slackSystemNoticeCache.delete(dedupeKey);
+        throw error;
+      }
+    },
+
     async sendMessageToTarget(
       message: OutgoingMessage,
       target: OutboundTarget,
@@ -1137,15 +1207,18 @@ async function resolveSlackUserIdentity(
                 : typeof user.user.name === "string" && user.user.name.trim()
                   ? user.user.name.trim()
                   : null,
-        memberType: user.user.is_ultra_restricted
-          ? "external"
-          : user.user.is_restricted
-            ? "guest"
-            : user.user.is_owner
-              ? "owner"
-              : user.user.is_admin
-                ? "admin"
-                : "member",
+        // is_stranger marks Slack Connect DM participants from another
+        // workspace; they must map to "external", never "member".
+        memberType:
+          user.user.is_stranger || user.user.is_ultra_restricted
+            ? "external"
+            : user.user.is_restricted
+              ? "guest"
+              : user.user.is_owner
+                ? "owner"
+                : user.user.is_admin
+                  ? "admin"
+                  : "member",
       }
     : null;
   if (slackIdentityCache.size >= SLACK_IDENTITY_CACHE_MAX_ENTRIES) {
@@ -1168,7 +1241,24 @@ async function hydrateSlackIdentity(
   incoming: IncomingMessage,
 ): Promise<IncomingMessage> {
   const identity = await resolveSlackUserIdentity(token, incoming);
-  if (!identity) return incoming;
+  if (!identity) {
+    // Context hydration can call users.info again after the webhook identity
+    // pass. A transient failure on that second lookup is not evidence that a
+    // previously verified sender became unverified; preserve the stronger
+    // identity instead of replacing it with a negative-cache result.
+    if (
+      incoming.senderVerified === true &&
+      incoming.senderEmail?.trim() &&
+      incoming.actorTrust?.verified === true
+    ) {
+      return incoming;
+    }
+    return {
+      ...incoming,
+      senderVerified: false,
+      actorTrust: { memberType: "unknown", verified: false },
+    };
+  }
   return {
     ...incoming,
     ...(identity.name ? { senderName: identity.name } : {}),
@@ -1299,8 +1389,6 @@ async function hydrateSlackContext(
     : [];
 
   const profile = identity;
-  const isGuest = identity?.memberType === "guest";
-  const isExternal = identity?.memberType === "external";
   const isPrivate = conversation?.channel?.is_private === true;
   const isExternalShared = conversation?.channel?.is_ext_shared === true;
   const isMpim = conversation?.channel?.is_mpim === true;
@@ -1348,12 +1436,15 @@ async function hydrateSlackContext(
       ? { senderEmail: profile.email, senderVerified: true }
       : { senderVerified: false }),
     conversationType,
-    actorTrust: {
-      memberType:
-        identity?.memberType ??
-        (isExternal ? "external" : isGuest ? "guest" : "member"),
-      verified: true,
-    },
+    // Conversation hydration must not promote a caller when users.info was
+    // unavailable. Preserve the result of the earlier identity-only hydration
+    // unless this request independently resolved the Slack user.
+    actorTrust: identity
+      ? { memberType: identity.memberType, verified: true }
+      : (incoming.actorTrust ?? {
+          memberType: "unknown",
+          verified: false,
+        }),
     contextMessages: hydratedMessages,
     ...(hydratedFiles.length ? { files: hydratedFiles.slice(0, 20) } : {}),
     platformContext: {

package/corpus/core/src/integrations/identity.ts

@@ -7,6 +7,34 @@ import {
 import { slackInstallationKey } from "./slack-oauth.js";
 import type { IncomingMessage, IntegrationExecutionContext } from "./types.js";
 
+export type IntegrationIdentityDeclineReason =
+  | "unverified"
+  | "guest"
+  | "unlinked-workspace"
+  | "membership-check-failed";
+
+/**
+ * Thrown when the default Slack DM identity ladder declines to run a message.
+ * `reason` is a stable machine-readable discriminator (used e.g. to dedupe
+ * decline replies); `userFacingMessage` is safe to send back to the sender as
+ * a polite reply; `message` stays log-only.
+ */
+export class IntegrationIdentityDeclinedError extends Error {
+  readonly reason: IntegrationIdentityDeclineReason;
+  readonly userFacingMessage: string;
+
+  constructor(
+    reason: IntegrationIdentityDeclineReason,
+    message: string,
+    userFacingMessage: string,
+  ) {
+    super(message);
+    this.name = "IntegrationIdentityDeclinedError";
+    this.reason = reason;
+    this.userFacingMessage = userFacingMessage;
+  }
+}
+
 function serviceOwner(platform: string): string {
   return `integration@${platform}`;
 }
@@ -47,17 +75,13 @@ async function resolveSlackInstallation(incoming: IncomingMessage) {
 }
 
 async function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {
-  try {
-    const { rows } = await getDbExec().execute({
-      sql: `SELECT 1 FROM org_members
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT 1 FROM org_members
         WHERE org_id = ? AND LOWER(email) = ?
         LIMIT 1`,
-      args: [orgId, email],
-    });
-    return rows.length > 0;
-  } catch {
-    return false;
-  }
+    args: [orgId, email],
+  });
+  return rows.length > 0;
 }
 
 /**
@@ -65,8 +89,13 @@ async function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {
  *
  * Slack DMs become a user principal only after the adapter has verified the
  * sender email and the email is already a member of the managed installation's
- * Agent Native organization. Shared channels deliberately stay service-scoped
- * so a channel message cannot borrow one participant's private permissions.
+ * Agent Native organization. Hydrated full workspace members whose email is
+ * missing, unverified, or not an organization member run as an anonymous
+ * org-scoped service principal instead — the same visibility shared channels
+ * get. Hydration failures, guests/external members, and workspaces without a
+ * connected organization are declined with a user-facing message. Shared
+ * channels deliberately stay service-scoped so a channel message cannot borrow
+ * one participant's private permissions.
  */
 export async function resolveDefaultIntegrationExecutionContext(
   incoming: IncomingMessage,
@@ -85,48 +114,83 @@ export async function resolveDefaultIntegrationExecutionContext(
     };
   }
 
-  const email = normalizedEmail(incoming.senderEmail);
-  if (
-    !email ||
-    incoming.senderVerified !== true ||
-    !incoming.senderId ||
-    !incoming.tenantId
-  ) {
-    throw new Error(
-      "Slack DM sender identity could not be verified; refusing to run with a service principal.",
+  // Hydration check first: a transient users.info failure must land on the
+  // retry decline here, never on the anonymous org-scoped tier below.
+  if (incoming.actorTrust?.verified !== true) {
+    throw new IntegrationIdentityDeclinedError(
+      "unverified",
+      "Slack DM sender identity could not be hydrated; declining instead of guessing a principal.",
+      "I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.",
     );
   }
   if (
-    incoming.actorTrust?.memberType === "guest" ||
-    incoming.actorTrust?.memberType === "external"
+    incoming.actorTrust.memberType === "guest" ||
+    incoming.actorTrust.memberType === "external"
   ) {
-    throw new Error(
-      "External or guest Slack members cannot use personal Agent Native permissions.",
+    throw new IntegrationIdentityDeclinedError(
+      "guest",
+      "External or guest Slack members cannot use this integration.",
+      "This assistant is only available to members of this workspace's organization.",
     );
   }
   if (!installation?.orgId) {
-    throw new Error(
+    throw new IntegrationIdentityDeclinedError(
+      "unlinked-workspace",
       "Slack workspace is not connected to an Agent Native organization.",
+      "This Slack workspace isn't connected to an organization yet.",
     );
   }
 
-  if (!(await isMemberOfOrg(email, installation.orgId))) {
-    throw new Error(
-      "Slack DM sender is not a member of the connected Agent Native organization.",
-    );
+  const email = normalizedEmail(incoming.senderEmail);
+  let isOrgMember = false;
+  if (
+    email &&
+    incoming.senderVerified === true &&
+    incoming.senderId &&
+    incoming.tenantId
+  ) {
+    try {
+      isOrgMember = await isMemberOfOrg(email, installation.orgId);
+    } catch {
+      // A membership-store outage is not evidence that the sender is merely
+      // unlinked. Fail closed instead of widening them to org-wide access.
+      throw new IntegrationIdentityDeclinedError(
+        "membership-check-failed",
+        "Slack DM organization membership could not be verified.",
+        "I couldn't verify your organization membership just now, so I can't run this request. Please try again in a moment.",
+      );
+    }
+  }
+  if (isOrgMember && email && incoming.senderId && incoming.tenantId) {
+    const link = await upsertVerifiedIntegrationIdentity({
+      platform: incoming.platform,
+      tenantId: incoming.tenantId,
+      externalUserId: incoming.senderId,
+      userEmail: email,
+      orgId: installation.orgId,
+    });
+    return {
+      ownerEmail: link.userEmail,
+      orgId: link.orgId,
+      principalType: "user",
+      installationId: installation.id,
+    };
   }
 
-  const link = await upsertVerifiedIntegrationIdentity({
-    platform: incoming.platform,
-    tenantId: incoming.tenantId,
-    externalUserId: incoming.senderId,
-    userEmail: email,
-    orgId: installation.orgId,
-  });
+  // Hydrated full workspace member (member/admin/owner) whose email is
+  // unverified, missing (legacy install without users:read.email), or not an
+  // organization member: run with the anonymous org-scoped service principal —
+  // the same visibility shared channels get. Nothing user-private is
+  // accessible. One structured line keeps 100%-anonymous workspaces (legacy
+  // scope missing) visible in logs.
+  console.warn(
+    `[integrations] anonymous org-scoped principal used: platform=${incoming.platform} teamId=${incoming.tenantId ?? "unknown"} emailPresent=${Boolean(email)} memberType=${incoming.actorTrust.memberType}`,
+  );
   return {
-    ownerEmail: link.userEmail,
-    orgId: link.orgId,
-    principalType: "user",
+    ownerEmail: serviceOwner(incoming.platform),
+    orgId: installation.orgId,
+    principalType: "service",
     installationId: installation.id,
+    anonymousMember: true,
   };
 }

package/corpus/core/src/integrations/pending-tasks-retry-job.ts

@@ -115,7 +115,8 @@ export async function retryStuckPendingTasks(
                SET status = 'failed',
                    updated_at = ?,
                    error_message = COALESCE(error_message, ?),
-                   payload = '{}'
+                   payload = '{}',
+                   external_event_key = NULL
              WHERE id = ?
                AND status = ?
           `,

package/corpus/core/src/integrations/pending-tasks-store.ts

@@ -364,7 +364,7 @@ export async function markTaskFailed(
   const now = Date.now();
   await client.execute({
     sql: `UPDATE integration_pending_tasks
-          SET status = ?, updated_at = ?, error_message = ?, payload = ?
+          SET status = ?, updated_at = ?, error_message = ?, payload = ?, external_event_key = NULL
           WHERE id = ?`,
     args: ["failed", now, errorMessage.slice(0, 2000), "{}", id],
   });