@agent-native/dispatch 0.30.1 → 0.30.3

package/src/server/lib/dispatch-integrations.ts

@@ -9,7 +9,7 @@ import {
   saveIntegrationScope,
   slackInstallationKey,
 } from "@agent-native/core/integrations";
-import { resolveOrgIdForEmail } from "@agent-native/core/org";
+import { isOrgMember, resolveOrgIdForEmail } from "@agent-native/core/org";
 import { withConfiguredAppBasePath } from "@agent-native/core/server";
 import type {
   IncomingMessage,
@@ -122,15 +122,40 @@ function configuredDispatchIdentitiesUrl(): string | null {
 async function resolveManagedSlackInstallation(incoming: IncomingMessage) {
   if (incoming.platform !== "slack") return null;
   const teamId = contextString(incoming.platformContext.teamId);
+  const enterpriseId = contextString(incoming.platformContext.enterpriseId);
   const apiAppId = contextString(incoming.platformContext.apiAppId);
-  if (!teamId) return null;
-  try {
-    return await getActiveIntegrationInstallationByKey(
-      "slack",
-      slackInstallationKey({ teamId, apiAppId }),
-    );
-  } catch {
+  const isEnterpriseInstall =
+    incoming.platformContext.isEnterpriseInstall === true;
+  if ((!teamId && !enterpriseId) || (isEnterpriseInstall && !enterpriseId))
     return null;
+  return getActiveIntegrationInstallationByKey(
+    "slack",
+    slackInstallationKey({
+      teamId,
+      enterpriseId,
+      apiAppId,
+      isEnterpriseInstall,
+    }),
+  );
+}
+
+class ManagedSlackInstallationLookupError extends Error {
+  constructor(options?: ErrorOptions) {
+    super(
+      "Managed Slack installation identity is temporarily unavailable",
+      options,
+    );
+    this.name = "ManagedSlackInstallationLookupError";
+  }
+}
+
+async function resolveManagedSlackInstallationOrFail(
+  incoming: IncomingMessage,
+) {
+  try {
+    return await resolveManagedSlackInstallation(incoming);
+  } catch (cause) {
+    throw new ManagedSlackInstallationLookupError({ cause });
   }
 }
 
@@ -162,6 +187,14 @@ function formatSlackLinkRequiredMessage(): string {
   return `Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. ${linkStep}`;
 }
 
+function formatSlackIdentityVerificationFailedMessage(): string {
+  return "I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.";
+}
+
+function formatSlackIdentityDeniedMessage(): string {
+  return "This assistant is only available to members of this workspace's organization.";
+}
+
 async function resolveSlackSenderProfile(
   incoming: IncomingMessage,
 ): Promise<SlackSenderProfile> {
@@ -202,6 +235,7 @@ async function resolveSlackSenderProfile(
         };
         is_restricted?: boolean;
         is_ultra_restricted?: boolean;
+        is_stranger?: boolean;
       };
     };
     const profile = data.ok
@@ -214,6 +248,7 @@ async function resolveSlackSenderProfile(
             data.user?.name?.trim() ||
             null,
           trust:
+            data.user?.is_stranger === true ||
             data.user?.is_ultra_restricted === true
               ? ("external_shared" as const)
               : data.user?.is_restricted === true
@@ -250,6 +285,90 @@ async function resolveSlackOwnerFromVerifiedEmail(
   return orgId ? profile.email : null;
 }
 
+async function resolveManagedSlackDmExecutionContext(
+  incoming: IncomingMessage,
+  installation: NonNullable<
+    Awaited<ReturnType<typeof resolveManagedSlackInstallation>>
+  >,
+): Promise<IntegrationExecutionContext> {
+  const profile = await resolveSlackSenderProfile(incoming);
+  incoming.actorTrust = {
+    memberType:
+      profile.trust === "guest"
+        ? "guest"
+        : profile.trust === "external_shared"
+          ? "external"
+          : profile.trust === "trusted"
+            ? "member"
+            : "unknown",
+    verified: profile.trust !== "unknown",
+  };
+  incoming.senderVerified = profile.email !== null;
+  if (profile.email) {
+    incoming.senderEmail = profile.email;
+    incoming.platformContext.senderEmail = profile.email;
+  }
+  if (profile.name) {
+    incoming.senderName = profile.name;
+    incoming.platformContext.senderName = profile.name;
+  }
+
+  const deniedContext = (): IntegrationExecutionContext => ({
+    ownerEmail: fallbackOwnerForIncoming(incoming),
+    orgId: null,
+    principalType: "user",
+    installationId: installation.id,
+  });
+
+  if (profile.trust === "unknown") {
+    incoming.platformContext.identityVerificationFailed = true;
+    return deniedContext();
+  }
+  if (profile.trust === "guest" || profile.trust === "external_shared") {
+    incoming.platformContext.identityAccessDenied = true;
+    return deniedContext();
+  }
+  if (!installation.orgId) {
+    incoming.platformContext.identityLinkRequired = true;
+    return deniedContext();
+  }
+  incoming.platformContext.managedInstallationOrgId = installation.orgId;
+
+  let linkedOwner: string | null;
+  try {
+    linkedOwner = await resolveLinkedOwner(
+      "slack",
+      identityKeyForIncoming(incoming),
+      { orgId: installation.orgId },
+    );
+  } catch {
+    incoming.platformContext.identityVerificationFailed = true;
+    return deniedContext();
+  }
+  const candidates = [profile.email, linkedOwner].filter(
+    (email, index, values): email is string =>
+      !!email && values.indexOf(email) === index,
+  );
+  for (const ownerEmail of candidates) {
+    try {
+      if (await isOrgMember(installation.orgId, ownerEmail)) {
+        return {
+          ownerEmail,
+          orgId: installation.orgId,
+          principalType: "user",
+          installationId: installation.id,
+        };
+      }
+    } catch {
+      incoming.platformContext.identityVerificationFailed = true;
+      return deniedContext();
+    }
+  }
+
+  incoming.platformContext.identityLinkRequired = true;
+  return deniedContext();
+}
+
 async function resolveSlackConversationTrust(
   incoming: IncomingMessage,
   actorTrust: SlackSenderProfile["trust"],
@@ -369,6 +488,30 @@ export async function resolveDispatchOwner(
 export async function resolveDispatchExecutionContext(
   incoming: IncomingMessage,
 ): Promise<IntegrationExecutionContext> {
+  if (incoming.platform === "slack" && incoming.triggerKind === "dm") {
+    let installation;
+    try {
+      installation = await resolveManagedSlackInstallationOrFail(incoming);
+    } catch (error) {
+      if (!(error instanceof ManagedSlackInstallationLookupError)) throw error;
+      incoming.platformContext.identityVerificationFailed = true;
+      return {
+        ownerEmail: fallbackOwnerForIncoming(incoming),
+        orgId: null,
+        principalType: "user",
+      };
+    }
+    if (installation) {
+      return resolveManagedSlackDmExecutionContext(incoming, installation);
+    }
+    incoming.platformContext.identityVerificationFailed = true;
+    return {
+      ownerEmail: fallbackOwnerForIncoming(incoming),
+      orgId: null,
+      principalType: "user",
+    };
+  }
+
   if (incoming.platform !== "slack" || incoming.triggerKind === "dm") {
     const ownerEmail = await resolveDispatchOwner(incoming);
     if (
@@ -387,7 +530,7 @@ export async function resolveDispatchExecutionContext(
     };
   }
 
-  const installation = await resolveManagedSlackInstallation(incoming);
+  const installation = await resolveManagedSlackInstallationOrFail(incoming);
   if (!installation) {
     // Preserve the legacy manually configured app path while managed installs
     // roll out. Its behavior remains explicit and visible in Settings.
@@ -474,6 +617,36 @@ export async function beforeDispatchProcess(
   const commandText =
     contextString(incoming.platformContext.rawText) || trimmed;
   const match = commandText.match(/^\/link(?:@\w+)?\s+([a-zA-Z0-9_-]+)$/);
+  if (
+    match &&
+    incoming.platform === "slack" &&
+    incoming.triggerKind === "dm" &&
+    !contextString(incoming.platformContext.managedInstallationOrgId) &&
+    incoming.platformContext.identityVerificationFailed !== true &&
+    incoming.platformContext.identityAccessDenied !== true
+  ) {
+    await resolveDispatchExecutionContext(incoming);
+  }
+  if (
+    incoming.platform === "slack" &&
+    incoming.triggerKind === "dm" &&
+    incoming.platformContext.identityVerificationFailed === true
+  ) {
+    return {
+      handled: true,
+      responseText: formatSlackIdentityVerificationFailedMessage(),
+    };
+  }
+  if (
+    incoming.platform === "slack" &&
+    incoming.triggerKind === "dm" &&
+    incoming.platformContext.identityAccessDenied === true
+  ) {
+    return {
+      handled: true,
+      responseText: formatSlackIdentityDeniedMessage(),
+    };
+  }
   if (!match) {
     const routedIncoming = incoming as IncomingMessage & {
       routingHint?: DispatchIntegrationRoutingHint;
@@ -508,11 +681,15 @@ export async function beforeDispatchProcess(
   }
 
   try {
+    const expectedOrgId = contextString(
+      incoming.platformContext.managedInstallationOrgId,
+    );
     const owner = await consumeLinkToken({
       platform: incoming.platform,
       token: match[1],
       externalUserId: identityKeyForIncoming(incoming),
       externalUserName: incoming.senderName || null,
+      ...(expectedOrgId ? { expectedOrgId } : {}),
     });
     return {
       handled: true,

package/src/server/lib/dispatch-store.ts

@@ -868,6 +868,7 @@ export async function consumeLinkToken(input: {
   token: string;
   externalUserId?: string | null;
   externalUserName?: string | null;
+  expectedOrgId?: string;
 }) {
   if (!input.externalUserId) {
     throw new Error("Linking requires a platform user id");
@@ -911,6 +912,12 @@ export async function consumeLinkToken(input: {
     recordLinkFailure(input.platform, input.externalUserId);
     throw new Error("Link token has expired");
   }
+  if (input.expectedOrgId && tokenRow.orgId !== input.expectedOrgId) {
+    recordLinkFailure(input.platform, input.externalUserId);
+    throw new Error(
+      "This link token belongs to a different organization. Create a token from this workspace and try again.",
+    );
+  }
 
   const timestamp = now();
   const [existing] = await db

package/src/server/lib/mcp-gateway.spec.ts

@@ -1,5 +1,12 @@
+import { createHmac } from "node:crypto";
+
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import {
+  extractA2APersistedMutationReceipts,
+  stripA2APersistedArtifactMarkers,
+} from "../../../../core/src/a2a/artifact-response.js";
+
 const mocks = vi.hoisted(() => ({
   discoverAgents: vi.fn(),
   getBuiltinAgents: vi.fn(() => []),
@@ -59,23 +66,30 @@ vi.mock("@agent-native/core/server", async (importOriginal) => {
   };
 });
 
-vi.mock("@agent-native/core/a2a", () => ({
-  A2AClient: class MockA2AClient {
-    constructor(...args: unknown[]) {
-      mocks.a2aConstructor(...args);
-    }
-
-    send(...args: unknown[]) {
-      return mocks.a2aSend(...args);
-    }
-
-    getTask(...args: unknown[]) {
-      return mocks.a2aGetTask(...args);
-    }
-  },
-  signA2AToken: mocks.signA2AToken,
-  canonicalA2AAudience: mocks.canonicalA2AAudience,
-}));
+vi.mock("@agent-native/core/a2a", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("@agent-native/core/a2a")>();
+  return {
+    ...actual,
+    extractA2APersistedMutationReceipts,
+    stripA2APersistedArtifactMarkers,
+    A2AClient: class MockA2AClient {
+      constructor(...args: unknown[]) {
+        mocks.a2aConstructor(...args);
+      }
+
+      send(...args: unknown[]) {
+        return mocks.a2aSend(...args);
+      }
+
+      getTask(...args: unknown[]) {
+        return mocks.a2aGetTask(...args);
+      }
+    },
+    signA2AToken: mocks.signA2AToken,
+    canonicalA2AAudience: mocks.canonicalA2AAudience,
+  };
+});
 
 vi.mock("@agent-native/core/org", () => ({
   getOrgA2ASecret: mocks.getOrgA2ASecret,
@@ -125,6 +139,24 @@ const analyticsAgent = {
   color: "#6366F1",
 };
 
+function withSignedMutationReceipts(
+  text: string,
+  receipts: unknown[],
+  secret: string,
+  delegatedTaskId: string,
+): string {
+  const payload = Buffer.from(
+    JSON.stringify({
+      version: 1,
+      identities: [],
+      mutationReceipts: receipts,
+      delegatedTaskId,
+    }),
+  ).toString("base64url");
+  const signature = createHmac("sha256", secret).update(payload).digest("hex");
+  return `${text}\n\n<!-- agent-native:persisted-artifacts=${payload}.${signature} -->`;
+}
+
 beforeEach(() => {
   mocks.a2aConstructor.mockReset();
   mocks.a2aSend.mockReset();
@@ -357,6 +389,285 @@ describe("askGrantedDispatchMcpApp", () => {
     });
   });
 
+  it("preserves authenticated structured mutation receipts from the target app", async () => {
+    const orgSecret = "org-receipt-secret";
+    mocks.getOrgA2ASecret.mockResolvedValueOnce(orgSecret);
+    mocks.discoverAgents.mockResolvedValueOnce([
+      { ...analyticsAgent, id: "content", name: "Content" },
+    ]);
+    const receipt = {
+      receiptId: "receipt-row-1",
+      sourceAction: "upsert-database-item-by-key",
+      operation: "upsert",
+      outcome: "updated",
+      target: {
+        authorityScopeKind: "personal",
+        authorityScopeId: "owner@example.test",
+        spaceId: "space-owner",
+        databaseId: "feedback-db",
+        databaseDocumentId: "feedback-db-document",
+      },
+      row: {
+        itemId: "feedback-item-1",
+        documentId: "feedback-document-1",
+        urlPath: "/page/feedback-document-1",
+      },
+      idempotency: {
+        key: "request-1",
+        result: "replayed",
+        payloadDigest: "digest-1",
+      },
+      revisions: { before: "before", after: "after" },
+      readbackVerified: true,
+    };
+    mocks.a2aSend.mockResolvedValueOnce({
+      id: "task-with-receipt",
+      status: {
+        state: "completed",
+        message: {
+          role: "agent",
+          parts: [
+            {
+              type: "text",
+              text: withSignedMutationReceipts(
+                "Updated the exact feedback row.",
+                [receipt],
+                orgSecret,
+                "task-with-receipt",
+              ),
+            },
+            {
+              type: "data",
+              data: {
+                kind: "agent-native/mutation-receipts",
+                version: 1,
+                receipts: [receipt],
+              },
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        orgId: "org-owner",
+        requestOrigin: "http://localhost:8092",
+      },
+      () => askGrantedDispatchMcpApp("content", "Update feedback."),
+    );
+
+    expect(result).toMatchObject({
+      status: "completed",
+      response: "Updated the exact feedback row.",
+      receipts: [
+        {
+          receiptId: "receipt-row-1",
+          row: {
+            documentId: "feedback-document-1",
+            urlPath: "/page/feedback-document-1",
+          },
+          idempotency: { result: "replayed" },
+        },
+      ],
+    });
+
+    mocks.getOrgA2ASecret.mockResolvedValueOnce(orgSecret);
+    mocks.discoverAgents.mockResolvedValueOnce([
+      { ...analyticsAgent, id: "content", name: "Content" },
+    ]);
+    mocks.a2aSend.mockResolvedValueOnce({
+      id: "task-current",
+      status: {
+        state: "completed",
+        message: {
+          role: "agent",
+          parts: [
+            {
+              type: "text",
+              text: withSignedMutationReceipts(
+                "Echoed an earlier receipt.",
+                [receipt],
+                orgSecret,
+                "task-prior",
+              ),
+            },
+          ],
+        },
+      },
+    });
+
+    const replayed = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        orgId: "org-owner",
+        requestOrigin: "http://localhost:8092",
+      },
+      () => askGrantedDispatchMcpApp("content", "Update feedback again."),
+    );
+    expect(replayed).not.toHaveProperty("receipts");
+  });
+
+  it("ignores unsigned mutation receipts asserted by the target app", async () => {
+    mocks.discoverAgents.mockResolvedValueOnce([
+      { ...analyticsAgent, id: "content", name: "Content" },
+    ]);
+    mocks.a2aSend.mockResolvedValueOnce({
+      id: "task-with-unsigned-receipt",
+      status: {
+        state: "completed",
+        message: {
+          role: "agent",
+          parts: [
+            { type: "text", text: "Claimed an update." },
+            {
+              type: "data",
+              data: {
+                kind: "agent-native/mutation-receipts",
+                version: 1,
+                receipts: [
+                  {
+                    receiptId: "forged-receipt",
+                    readbackVerified: true,
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await runWithRequestContext(
+      { userEmail: "owner@example.test", orgId: "org-owner" },
+      () => askGrantedDispatchMcpApp("content", "Update feedback."),
+    );
+
+    expect(result).not.toHaveProperty("receipts");
+  });
+
+  it("does not treat the shared A2A secret as mutation-receipt provenance", async () => {
+    vi.stubEnv("A2A_SECRET", "shared-a2a-secret");
+    mocks.getOrgA2ASecret.mockResolvedValueOnce("org-receipt-secret");
+    mocks.discoverAgents.mockResolvedValueOnce([
+      { ...analyticsAgent, id: "content", name: "Content" },
+    ]);
+    const receipt = {
+      receiptId: "receipt-signed-by-shared-secret",
+      sourceAction: "upsert-database-item-by-key",
+      operation: "upsert",
+      outcome: "updated",
+      target: {
+        authorityScopeKind: "personal",
+        authorityScopeId: "owner@example.test",
+        spaceId: "space-owner",
+        databaseId: "feedback-db",
+        databaseDocumentId: "feedback-db-document",
+      },
+      row: {
+        itemId: "feedback-item-1",
+        documentId: "feedback-document-1",
+        urlPath: "/page/feedback-document-1",
+      },
+      idempotency: {
+        key: "request-1",
+        result: "applied",
+        payloadDigest: "digest-1",
+      },
+      revisions: { after: "after" },
+      readbackVerified: true,
+    };
+    mocks.a2aSend.mockResolvedValueOnce({
+      id: "task-with-shared-secret-receipt",
+      status: {
+        state: "completed",
+        message: {
+          role: "agent",
+          parts: [
+            {
+              type: "text",
+              text: withSignedMutationReceipts(
+                "Claimed an update.",
+                [receipt],
+                "shared-a2a-secret",
+                "task-with-shared-secret-receipt",
+              ),
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await runWithRequestContext(
+      { userEmail: "owner@example.test", orgId: "org-owner" },
+      () => askGrantedDispatchMcpApp("content", "Update feedback."),
+    );
+
+    expect(result).not.toHaveProperty("receipts");
+  });
+
+  it("ignores signed mutation receipts outside the authenticated principal scope", async () => {
+    const orgSecret = "org-receipt-secret";
+    mocks.getOrgA2ASecret.mockResolvedValueOnce(orgSecret);
+    mocks.discoverAgents.mockResolvedValueOnce([
+      { ...analyticsAgent, id: "content", name: "Content" },
+    ]);
+    const receipt = {
+      receiptId: "receipt-other-owner",
+      sourceAction: "upsert-database-item-by-key",
+      operation: "upsert",
+      outcome: "updated",
+      target: {
+        authorityScopeKind: "personal",
+        authorityScopeId: "other@example.test",
+        spaceId: "space-other",
+        databaseId: "feedback-db",
+        databaseDocumentId: "feedback-db-document",
+      },
+      row: {
+        itemId: "feedback-item-1",
+        documentId: "feedback-document-1",
+        urlPath: "/page/feedback-document-1",
+      },
+      idempotency: {
+        key: "request-1",
+        result: "applied",
+        payloadDigest: "digest-1",
+      },
+      revisions: { after: "after" },
+      readbackVerified: true,
+    };
+    mocks.a2aSend.mockResolvedValueOnce({
+      id: "task-with-wrong-scope-receipt",
+      status: {
+        state: "completed",
+        message: {
+          role: "agent",
+          parts: [
+            {
+              type: "text",
+              text: withSignedMutationReceipts(
+                "Claimed an update.",
+                [receipt],
+                orgSecret,
+                "task-with-wrong-scope-receipt",
+              ),
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await runWithRequestContext(
+      { userEmail: "owner@example.test", orgId: "org-owner" },
+      () => askGrantedDispatchMcpApp("content", "Update feedback."),
+    );
+
+    expect(result.response).toBe("Claimed an update.");
+    expect(result).not.toHaveProperty("receipts");
+  });
+
   it("returns a durable polling handle when the downstream task is still working", async () => {
     mocks.a2aSend.mockResolvedValueOnce({
       id: "task-working",