@cursor/july 0.1.20 → 0.1.21

package/src/channels/github/replay.test.ts

@@ -0,0 +1,179 @@
+import { describe, expect, it } from "vitest";
+import {
+  parseGitHubPullRequestEvent,
+  verifyGitHubWebhookSignature,
+} from "./index.js";
+import {
+  parseGitHubPrRef,
+  type ReplayPull,
+  type ReplayRepo,
+  selectReplayEvents,
+  signGitHubWebhookBody,
+  synthesizeGitHubEvent,
+} from "./replay.js";
+
+const repo: ReplayRepo = {
+  id: 1,
+  full_name: "acme/widgets",
+  html_url: "https://github.com/acme/widgets",
+  default_branch: "main",
+  owner: { login: "acme" },
+};
+
+const pull: ReplayPull = {
+  number: 42,
+  html_url: "https://github.com/acme/widgets/pull/42",
+  title: "Add widgets",
+  body: "body",
+  draft: false,
+  user: { login: "octocat", id: 5, type: "User" },
+  head: { ref: "feature", sha: "abc123", repo: { id: 1, name: "widgets" } },
+  base: { ref: "main", sha: "def456" },
+};
+
+function synth(input: Parameters<typeof synthesizeGitHubEvent>[0]): {
+  eventName: string;
+  action?: string;
+  payload: Record<string, unknown>;
+} {
+  const result = synthesizeGitHubEvent(input);
+  if ("error" in result) {
+    throw new Error(result.error);
+  }
+  return result;
+}
+
+describe("parseGitHubPrRef", () => {
+  it("parses PR URLs and owner/repo#N", () => {
+    expect(parseGitHubPrRef("https://github.com/acme/widgets/pull/42")).toEqual(
+      {
+        owner: "acme",
+        repo: "widgets",
+        number: 42,
+        url: "https://github.com/acme/widgets/pull/42",
+        label: "acme/widgets#42",
+      }
+    );
+    expect(parseGitHubPrRef("acme/widgets#7")?.number).toBe(7);
+  });
+
+  it("returns undefined for non-PR input", () => {
+    expect(parseGitHubPrRef("not a pr")).toBeUndefined();
+    expect(
+      parseGitHubPrRef("https://github.com/acme/widgets/issues/1")
+    ).toBeUndefined();
+  });
+});
+
+describe("selectReplayEvents", () => {
+  it("defaults to pull_request", () => {
+    expect(
+      selectReplayEvents(undefined, ["pull_request", "check_run"])
+    ).toEqual({ events: ["pull_request"], unsupported: [] });
+  });
+
+  it("expands * against the channel's declared events (synthesizable only)", () => {
+    expect(
+      selectReplayEvents(["*"], ["pull_request", "check_run", "push"])
+    ).toEqual({ events: ["pull_request", "check_run"], unsupported: [] });
+  });
+
+  it("separates unsupported explicit events", () => {
+    expect(selectReplayEvents(["pull_request", "push"], [])).toEqual({
+      events: ["pull_request"],
+      unsupported: ["push"],
+    });
+  });
+});
+
+describe("synthesizeGitHubEvent", () => {
+  it("produces a pull_request payload the channel parser accepts", () => {
+    const { payload, action } = synth({ event: "pull_request", repo, pull });
+    expect(action).toBe("synchronize");
+    const parsed = parseGitHubPullRequestEvent({ payload });
+    expect(parsed?.pullRequest.action).toBe("synchronize");
+    expect(parsed?.pullRequest.headSha).toBe("abc123");
+    expect(parsed?.pullRequest.baseRef).toBe("main");
+    expect(parsed?.ctx.repository.fullName).toBe("acme/widgets");
+  });
+
+  it("honors --action", () => {
+    const { payload } = synth({
+      event: "pull_request",
+      repo,
+      pull,
+      action: "opened",
+    });
+    expect(parseGitHubPullRequestEvent({ payload })?.pullRequest.action).toBe(
+      "opened"
+    );
+  });
+
+  it("anchors CI events to the PR with a default failure conclusion", () => {
+    const { payload } = synth({ event: "check_run", repo, pull });
+    const checkRun = (payload as { check_run: Record<string, unknown> })
+      .check_run;
+    expect(checkRun.conclusion).toBe("failure");
+    expect(checkRun.head_sha).toBe("abc123");
+    expect(
+      (checkRun.pull_requests as Array<{ number: number }>)[0]?.number
+    ).toBe(42);
+  });
+
+  it("uses a real check's app slug + conclusion when provided", () => {
+    const { payload } = synth({
+      event: "check_suite",
+      repo,
+      pull,
+      check: { app: { slug: "buildkite" }, conclusion: "failure" },
+    });
+    const suite = (payload as { check_suite: Record<string, unknown> })
+      .check_suite;
+    expect((suite.app as { slug: string }).slug).toBe("buildkite");
+  });
+
+  it("requires a comment for issue_comment", () => {
+    expect(
+      synthesizeGitHubEvent({ event: "issue_comment", repo, pull })
+    ).toEqual({ error: "issue_comment needs --comment" });
+    const { payload } = synth({
+      event: "issue_comment",
+      repo,
+      pull,
+      comment: "@bot please review",
+    });
+    const comment = (payload as { comment: { body: string } }).comment;
+    expect(comment.body).toBe("@bot please review");
+    expect(
+      (payload as { issue: { pull_request: unknown } }).issue.pull_request
+    ).toBeDefined();
+  });
+});
+
+describe("signGitHubWebhookBody", () => {
+  it("produces a signature the channel verifier accepts", async () => {
+    const body = Buffer.from(
+      JSON.stringify(synth({ event: "pull_request", repo, pull }).payload)
+    );
+    const header = `sha256=${signGitHubWebhookBody({ secret: "s3cr3t", body })}`;
+    await expect(
+      verifyGitHubWebhookSignature({
+        body: body.toString("utf8"),
+        signatureHeader: header,
+        secret: "s3cr3t",
+      })
+    ).resolves.toBe("verified");
+  });
+
+  it("does not verify under the wrong secret", async () => {
+    const body = "{}";
+    const header = `sha256=${signGitHubWebhookBody({ secret: "right", body })}`;
+    await expect(
+      verifyGitHubWebhookSignature({
+        body,
+        signatureHeader: header,
+        secret: "wrong",
+      })
+    ).resolves.toBe("mismatch");
+  });
+});

package/src/channels/slack/api.post-message.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, it, vi } from "vitest";
+import { postMessage, updateMessage } from "./api.js";
+import type { SlackApiTransport } from "./types.js";
+
+function transport(impl: SlackApiTransport["call"]): SlackApiTransport {
+  return { kind: "api-transport", label: "test", call: impl };
+}
+
+describe("postMessage plainText", () => {
+  it("posts with text only when plainText is set", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+      message: { thread_ts: "1.0" },
+    }));
+    await postMessage({
+      botToken: transport(call),
+      channel: "C1",
+      text: "finding body",
+      threadTs: "1.0",
+      plainText: true,
+    });
+    expect(call).toHaveBeenCalledTimes(1);
+    expect(call).toHaveBeenCalledWith("chat.postMessage", {
+      channel: "C1",
+      text: "finding body",
+      thread_ts: "1.0",
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+  });
+
+  it("still prefers markdown_text by default", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+    }));
+    await postMessage({
+      botToken: transport(call),
+      channel: "C1",
+      text: "hi",
+    });
+    expect(call).toHaveBeenCalledWith("chat.postMessage", {
+      channel: "C1",
+      markdown_text: "hi",
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+  });
+
+  it("uses mrkdwn text when the body has a user-group mention", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+    }));
+    const text = "ping <!subteam^S0B1V748HV2|@review-agents-primary-oncall>";
+    await postMessage({
+      botToken: transport(call),
+      channel: "C1",
+      text,
+    });
+    expect(call).toHaveBeenCalledWith("chat.postMessage", {
+      channel: "C1",
+      text,
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+  });
+
+  it("uses mrkdwn text when the body has a Slack link", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+    }));
+    const text = "filed <https://linear.app/issue/RA-143|RA-143>";
+    await postMessage({
+      botToken: transport(call),
+      channel: "C1",
+      text,
+    });
+    expect(call).toHaveBeenCalledWith("chat.postMessage", {
+      channel: "C1",
+      text,
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+  });
+
+  it("does not fail when threaded response omits message.thread_ts", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+      // Cursor Slack proxy / customize-username responses sometimes omit this.
+      message: { text: "finding body" },
+    }));
+    await expect(
+      postMessage({
+        botToken: transport(call),
+        channel: "C1",
+        text: "finding body",
+        threadTs: "1.0",
+        plainText: true,
+      })
+    ).resolves.toEqual({ ts: "2.0", channel: "C1" });
+  });
+
+  it("still fails when message.thread_ts is present but wrong", async () => {
+    const call = vi.fn(async () => ({
+      ok: true,
+      ts: "2.0",
+      channel: "C1",
+      message: { thread_ts: "9.9" },
+    }));
+    await expect(
+      postMessage({
+        botToken: transport(call),
+        channel: "C1",
+        text: "finding body",
+        threadTs: "1.0",
+        plainText: true,
+      })
+    ).rejects.toThrow(/ignored thread_ts/);
+  });
+});
+
+describe("updateMessage plainText", () => {
+  it("updates with text only when plainText is set", async () => {
+    const call = vi.fn(async () => ({ ok: true }));
+    const result = await updateMessage({
+      botToken: transport(call),
+      channel: "C1",
+      ts: "1.0",
+      text: "inlined",
+      plainText: true,
+    });
+    expect(result.ok).toBe(true);
+    expect(call).toHaveBeenCalledWith("chat.update", {
+      channel: "C1",
+      ts: "1.0",
+      text: "inlined",
+    });
+  });
+});

package/src/channels/slack/api.ts

@@ -337,6 +337,8 @@ export async function postMessage(args: {
    * `markdown_text` hard-caps at 12k while `text` allows ~40k.
    */
   plainText?: boolean;
+  /** Slack message metadata (`{ event_type, event_payload }`). */
+  metadata?: Record<string, unknown>;
 }): Promise<{ ts: string; channel: string }> {
   // Slack treats markdown_text as mutually exclusive with text and blocks
   // (error: markdown_text_conflict). Prefer markdown when we have no
@@ -349,6 +351,9 @@ export async function postMessage(args: {
   if (args.threadTs !== undefined && args.threadTs !== "") {
     base.thread_ts = args.threadTs;
   }
+  if (args.metadata !== undefined) {
+    base.metadata = args.metadata;
+  }
   const hasBlocks = args.blocks !== undefined && args.blocks.length > 0;
   // User-group mentions (`<!subteam^…>`) and Slack mrkdwn links
   // (`<https://…|label>`) only render correctly via mrkdwn `text`,

package/src/channels/slack/approvals.test.ts

@@ -0,0 +1,328 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildApprovalBlocks,
+  buildResolvedApprovalBlocks,
+  decisionFromActionId,
+  encodeApprovalActionValue,
+  formatArgsForSlackDisplay,
+  parseApprovalActionValue,
+  redactSensitiveValues,
+  SLACK_APPROVE_ACTION_ID,
+  SLACK_DENY_ACTION_ID,
+} from "./approvals.js";
+import { buildDefaultEvents } from "./defaults.js";
+import { dispatchInteractiveFromPayload } from "./interactive.js";
+import { buildToolApprovalEvents } from "./tool-approval-events.js";
+
+describe("slack approval blocks", () => {
+  it("encodes and parses action values", () => {
+    const raw = encodeApprovalActionValue({
+      sessionId: "ses_abc",
+      callId: "call_1",
+    });
+    expect(parseApprovalActionValue(raw)).toEqual({
+      sessionId: "ses_abc",
+      callId: "call_1",
+    });
+    expect(parseApprovalActionValue("not-json")).toBeNull();
+  });
+
+  it("maps action ids to decisions", () => {
+    expect(decisionFromActionId(SLACK_APPROVE_ACTION_ID)).toBe("approve");
+    expect(decisionFromActionId(SLACK_DENY_ACTION_ID)).toBe("deny");
+    expect(decisionFromActionId("other")).toBeNull();
+  });
+
+  it("builds approve/deny buttons with session + call ids", () => {
+    const blocks = buildApprovalBlocks({
+      sessionId: "ses_1",
+      callId: "call_9",
+      toolName: "post_weather_alert",
+      args: { city: "NYC" },
+    });
+    const actions = blocks.find(
+      (block) =>
+        typeof block === "object" &&
+        block !== null &&
+        (block as { type?: string }).type === "actions"
+    ) as { elements: Array<{ action_id: string; value: string }> };
+    expect(actions.elements).toHaveLength(2);
+    expect(actions.elements[0]?.action_id).toBe(SLACK_APPROVE_ACTION_ID);
+    expect(parseApprovalActionValue(actions.elements[0]!.value)).toEqual({
+      sessionId: "ses_1",
+      callId: "call_9",
+    });
+  });
+
+  it("builds a resolved card without action buttons", () => {
+    const blocks = buildResolvedApprovalBlocks({
+      toolName: "post_weather_alert",
+      decision: "deny",
+      byUserId: "U123",
+    });
+    expect(JSON.stringify(blocks)).toContain("Denied");
+    expect(JSON.stringify(blocks)).toContain("<@U123>");
+    expect(JSON.stringify(blocks)).not.toContain(SLACK_APPROVE_ACTION_ID);
+  });
+
+  it("redacts sensitive arg keys for Slack display", () => {
+    const redacted = redactSensitiveValues({
+      city: "NYC",
+      api_key: "sk-secret",
+      nested: { password: "hunter2" },
+    });
+    expect(redacted).toEqual({
+      city: "NYC",
+      api_key: "[REDACTED]",
+      nested: { password: "[REDACTED]" },
+    });
+  });
+
+  it("notes when Slack arg display exceeds the block limit", () => {
+    const display = formatArgsForSlackDisplay({ blob: "x".repeat(2500) });
+    expect(display).toContain("execution uses full args");
+    expect(display.length).toBeLessThanOrEqual(1975);
+  });
+
+  it("keeps approval card arg fields within Slack mrkdwn limits", () => {
+    const blocks = buildApprovalBlocks({
+      sessionId: "ses_1",
+      callId: "call_1",
+      toolName: "big_tool",
+      args: { blob: "x".repeat(2500) },
+    });
+    const section = blocks.find(
+      (block) =>
+        typeof block === "object" &&
+        block !== null &&
+        (block as { type?: string }).type === "section" &&
+        Array.isArray((block as { fields?: unknown }).fields)
+    ) as { fields: Array<{ text: string }> };
+    const argsField = section.fields.find((field) =>
+      field.text.includes("Args (redacted)")
+    );
+    expect(argsField?.text.length).toBeLessThanOrEqual(2000);
+  });
+});
+
+describe("dispatchInteractiveFromPayload", () => {
+  it("resolves approve for a matching session/thread with clicker auth", async () => {
+    const calls: Array<{
+      sessionId: string;
+      callId: string;
+      decision: string;
+      authPrincipalId: string | undefined;
+    }> = [];
+    const handled = await dispatchInteractiveFromPayload(
+      {
+        type: "block_actions",
+        user: { id: "U1" },
+        channel: { id: "C9" },
+        message: { ts: "2.0", thread_ts: "1.0" },
+        actions: [
+          {
+            action_id: SLACK_APPROVE_ACTION_ID,
+            value: encodeApprovalActionValue({
+              sessionId: "ses_1",
+              callId: "call_1",
+            }),
+          },
+        ],
+      },
+      {
+        credentials: undefined,
+        getSession: async () => ({
+          id: "ses_1",
+          continuationToken: "C9:1.0",
+          isNew: false,
+          info: {
+            id: "ses_1",
+            channelId: "slack",
+            mode: "chat",
+            auth: {
+              authenticator: "slack",
+              principalId: "slack:T:C9:1.0",
+              principalType: "user",
+              attributes: {
+                channel_id: "C9",
+                thread_ts: "1.0",
+                team_id: "T",
+              },
+            },
+          },
+          getEventStream: async () => new ReadableStream(),
+          waitForCompletion: async () => ({ status: "finished" }),
+          setContinuationToken: async () => {},
+        }),
+        resolveApproval: async (sessionId, callId, decision, auth) => {
+          calls.push({
+            sessionId,
+            callId,
+            decision,
+            authPrincipalId: auth?.principalId,
+          });
+          return {
+            callId,
+            turnId: "turn_1",
+            toolName: "risky",
+            args: {},
+            requestedAt: "2026-01-01T00:00:00.000Z",
+          };
+        },
+        waitUntil: () => {},
+      }
+    );
+    expect(handled).toBe(true);
+    expect(calls).toEqual([
+      {
+        sessionId: "ses_1",
+        callId: "call_1",
+        decision: "approve",
+        authPrincipalId: "slack:T:C9:1.0",
+      },
+    ]);
+  });
+
+  it("does not resolve when clicker auth does not match a narrower session principal", async () => {
+    let resolved = false;
+    const handled = await dispatchInteractiveFromPayload(
+      {
+        type: "block_actions",
+        user: { id: "U2" },
+        channel: { id: "C9" },
+        message: { ts: "2.0", thread_ts: "1.0" },
+        actions: [
+          {
+            action_id: SLACK_APPROVE_ACTION_ID,
+            value: encodeApprovalActionValue({
+              sessionId: "ses_1",
+              callId: "call_1",
+            }),
+          },
+        ],
+      },
+      {
+        credentials: undefined,
+        getSession: async () => ({
+          id: "ses_1",
+          continuationToken: "C9:1.0",
+          isNew: false,
+          info: {
+            id: "ses_1",
+            channelId: "slack",
+            mode: "chat",
+            auth: {
+              authenticator: "slack",
+              principalId: "slack:T:C9:1.0:U1",
+              principalType: "user",
+              attributes: {
+                channel_id: "C9",
+                thread_ts: "1.0",
+                team_id: "T",
+                user_id: "U1",
+              },
+            },
+          },
+          getEventStream: async () => new ReadableStream(),
+          waitForCompletion: async () => ({ status: "finished" }),
+          setContinuationToken: async () => {},
+        }),
+        resolveApproval: async (_sessionId, _callId, _decision, auth) => {
+          if (auth?.principalId !== "slack:T:C9:1.0:U1") {
+            throw new Error("SessionAuthError");
+          }
+          resolved = true;
+          return {
+            callId: "call_1",
+            turnId: "turn_1",
+            toolName: "risky",
+            args: {},
+            requestedAt: "2026-01-01T00:00:00.000Z",
+          };
+        },
+        waitUntil: () => {},
+      }
+    );
+    expect(handled).toBe(true);
+    expect(resolved).toBe(false);
+  });
+
+  it("rejects channel mismatches without resolving", async () => {
+    let resolved = false;
+    const handled = await dispatchInteractiveFromPayload(
+      {
+        type: "block_actions",
+        user: { id: "U1" },
+        channel: { id: "C_OTHER" },
+        message: { ts: "2.0", thread_ts: "1.0" },
+        actions: [
+          {
+            action_id: SLACK_DENY_ACTION_ID,
+            value: encodeApprovalActionValue({
+              sessionId: "ses_1",
+              callId: "call_1",
+            }),
+          },
+        ],
+      },
+      {
+        credentials: undefined,
+        getSession: async () => ({
+          id: "ses_1",
+          continuationToken: null,
+          isNew: false,
+          info: {
+            id: "ses_1",
+            channelId: "slack",
+            mode: "chat",
+            auth: {
+              authenticator: "slack",
+              principalId: "slack:T:C9:1.0",
+              principalType: "user",
+              attributes: { channel_id: "C9", thread_ts: "1.0" },
+            },
+          },
+          getEventStream: async () => new ReadableStream(),
+          waitForCompletion: async () => ({ status: "finished" }),
+          setContinuationToken: async () => {},
+        }),
+        resolveApproval: async () => {
+          resolved = true;
+          return {
+            callId: "call_1",
+            turnId: "turn_1",
+            toolName: "risky",
+            args: {},
+            requestedAt: "2026-01-01T00:00:00.000Z",
+          };
+        },
+        waitUntil: () => {},
+      }
+    );
+    expect(handled).toBe(true);
+    expect(resolved).toBe(false);
+  });
+});
+
+describe("HITL + Slack event composition", () => {
+  it("keeps approval handlers out of buildDefaultEvents", () => {
+    const defaults = buildDefaultEvents({});
+    expect(defaults["action.approval_requested"]).toBeUndefined();
+    expect(defaults["action.approval_resolved"]).toBeUndefined();
+  });
+
+  it("buildToolApprovalEvents is the opt-in Slack surface", () => {
+    const approvals = buildToolApprovalEvents({});
+    expect(typeof approvals["action.approval_requested"]).toBe("function");
+    expect(typeof approvals["action.approval_resolved"]).toBe("function");
+  });
+
+  it("composes with a shallow merge", () => {
+    const composed = {
+      ...buildDefaultEvents({}),
+      ...buildToolApprovalEvents({}),
+    };
+    expect(typeof composed["message.completed"]).toBe("function");
+    expect(typeof composed["action.approval_requested"]).toBe("function");
+  });
+});