@cursor/july 0.1.20 → 0.1.21

package/src/channels/slack/block-actions.test.ts

@@ -0,0 +1,452 @@
+import { describe, expect, it } from "vitest";
+import type { ChannelSession, SendMessageFn } from "../../types.js";
+import { blockActionAuth } from "./auth.js";
+import {
+  mrkdwnSections,
+  SLACK_SECTION_MRKDWN_MAX,
+  SLACK_TABLE_MAX_COLUMNS,
+  SLACK_TABLE_MAX_ROWS,
+  slackLinkCell,
+  slackRawTextCell,
+  slackTableBlock,
+} from "./blocks.js";
+import { createSlackLogger } from "./index.js";
+import {
+  dispatchBlockAction,
+  parseSlackBlockAction,
+  resolveBlockActionCard,
+} from "./interactive.js";
+import type { SlackBlockAction } from "./types.js";
+
+const testAuth = {
+  authenticator: "slack",
+  principalId: "slack:T1:C9:5.0",
+  principalType: "user" as const,
+  attributes: { channel_id: "C9", thread_ts: "5.0", user_id: "U7" },
+};
+
+function mockSession(id = "ses_click"): ChannelSession {
+  return {
+    id,
+    continuationToken: null,
+    isNew: true,
+    info: {
+      id,
+      channelId: "slack",
+      mode: "chat",
+      auth: testAuth,
+    },
+    getEventStream: async () => new ReadableStream(),
+    waitForCompletion: async () => ({ status: "finished" }),
+    setContinuationToken: async () => undefined,
+  };
+}
+
+function createSendRecorder(): {
+  send: SendMessageFn;
+  calls: Array<{ message: string; options: Parameters<SendMessageFn>[1] }>;
+} {
+  const calls: Array<{
+    message: string;
+    options: Parameters<SendMessageFn>[1];
+  }> = [];
+  const send: SendMessageFn = async (message, sendOptions) => {
+    calls.push({ message, options: sendOptions });
+    return mockSession();
+  };
+  return { send, calls };
+}
+
+function testHost() {
+  return {
+    mcp: {
+      names: () => [] as string[],
+      listTools: async () => [],
+      callTool: async () => ({ content: [] }),
+    },
+    github: {
+      getOctokit: async () => {
+        throw new Error("github client not configured in test");
+      },
+    },
+    slack: {
+      getClient: async () => {
+        throw new Error("slack client not configured in test");
+      },
+    },
+    kv: {
+      get: async () => undefined,
+      put: async () => {},
+      delete: async () => {},
+    },
+  };
+}
+
+function blockActionsPayload(
+  overrides: { actionId?: string; value?: string; threadTs?: string } = {}
+): Record<string, unknown> {
+  return {
+    type: "block_actions",
+    team: { id: "T1", domain: "acme" },
+    user: { id: "U7", username: "netto", team_id: "T1" },
+    channel: { id: "C9", name: "deploys" },
+    container: { type: "message", message_ts: "5.0", channel_id: "C9" },
+    message: {
+      ts: "5.0",
+      text: "the ask",
+      ...(overrides.threadTs === undefined
+        ? {}
+        : { thread_ts: overrides.threadTs }),
+      blocks: [{ type: "section" }, { type: "actions", block_id: "b1" }],
+    },
+    actions: [
+      {
+        type: "button",
+        action_id: overrides.actionId ?? "my_button",
+        block_id: "b1",
+        value: overrides.value ?? '{"pr":"https://example.test/pr/1"}',
+        text: { type: "plain_text", text: "Deploy" },
+        action_ts: "6.123456",
+      },
+    ],
+  };
+}
+
+describe("parseSlackBlockAction", () => {
+  it("parses a button click with label, clicker, and message blocks", () => {
+    const action = parseSlackBlockAction(blockActionsPayload());
+    expect(action).toMatchObject({
+      actionId: "my_button",
+      blockId: "b1",
+      value: '{"pr":"https://example.test/pr/1"}',
+      label: "Deploy",
+      channelId: "C9",
+      // Top-level message: the click stays in that message's thread.
+      threadTs: "5.0",
+      messageTs: "5.0",
+      userId: "U7",
+      userName: "netto",
+      teamId: "T1",
+      actionTs: "6.123456",
+    });
+    expect(action?.messageBlocks).toHaveLength(2);
+  });
+
+  it("prefers the message thread_ts for replies", () => {
+    const action = parseSlackBlockAction(
+      blockActionsPayload({ threadTs: "1.0" })
+    );
+    expect(action?.threadTs).toBe("1.0");
+    expect(action?.messageTs).toBe("5.0");
+  });
+
+  it("defaults a missing button value to the empty string", () => {
+    const payload = blockActionsPayload();
+    delete (
+      (payload.actions as Array<Record<string, unknown>>)[0] as Record<
+        string,
+        unknown
+      >
+    ).value;
+    expect(parseSlackBlockAction(payload)?.value).toBe("");
+  });
+
+  it("returns null for non-block_actions payloads", () => {
+    expect(parseSlackBlockAction({ type: "view_submission" })).toBeNull();
+    expect(parseSlackBlockAction(null)).toBeNull();
+    expect(
+      parseSlackBlockAction({ type: "block_actions", actions: [] })
+    ).toBeNull();
+  });
+});
+
+describe("dispatchBlockAction", () => {
+  it("dispatches the handler decision on the click's thread", async () => {
+    const { send, calls } = createSendRecorder();
+    const seen: SlackBlockAction[] = [];
+    const handled = await dispatchBlockAction(blockActionsPayload(), {
+      handler: (_ctx, action) => {
+        seen.push(action);
+        return { auth: testAuth, message: "U7 clicked Deploy — ship it." };
+      },
+      send,
+      credentials: undefined,
+      host: testHost(),
+      log: createSlackLogger(() => undefined),
+    });
+    expect(handled).toBe(true);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.actionId).toBe("my_button");
+    expect(calls).toHaveLength(1);
+    expect(calls[0]?.options?.continuationToken).toBe("C9:5.0");
+    expect(calls[0]?.message).toContain("<slack_context>");
+    expect(calls[0]?.message).toContain("U7 clicked Deploy — ship it.");
+    const state = calls[0]?.options?.state as {
+      channelId?: string;
+      threadTs?: string;
+      triggeringUserId?: string;
+    };
+    expect(state.channelId).toBe("C9");
+    expect(state.threadTs).toBe("5.0");
+    expect(state.triggeringUserId).toBe("U7");
+  });
+
+  it("skips clicks without an action_ts (would alias dedupe keys)", async () => {
+    const { send, calls } = createSendRecorder();
+    const payload = blockActionsPayload();
+    delete (
+      (payload.actions as Array<Record<string, unknown>>)[0] as Record<
+        string,
+        unknown
+      >
+    ).action_ts;
+    const handled = await dispatchBlockAction(payload, {
+      handler: () => ({ auth: testAuth }),
+      send,
+      credentials: undefined,
+      host: testHost(),
+      log: createSlackLogger(() => undefined),
+    });
+    expect(handled).toBe(true);
+    expect(calls).toHaveLength(0);
+  });
+
+  it("skips dispatch when the handler returns null", async () => {
+    const { send, calls } = createSendRecorder();
+    const handled = await dispatchBlockAction(blockActionsPayload(), {
+      handler: () => null,
+      send,
+      credentials: undefined,
+      host: testHost(),
+      log: createSlackLogger(() => undefined),
+    });
+    expect(handled).toBe(true);
+    expect(calls).toHaveLength(0);
+  });
+
+  it("returns false for payloads that are not block actions", async () => {
+    const { send, calls } = createSendRecorder();
+    const handled = await dispatchBlockAction(
+      { type: "view_submission" },
+      {
+        handler: () => ({ auth: testAuth }),
+        send,
+        credentials: undefined,
+        host: testHost(),
+        log: createSlackLogger(() => undefined),
+      }
+    );
+    expect(handled).toBe(false);
+    expect(calls).toHaveLength(0);
+  });
+});
+
+describe("resolveBlockActionCard", () => {
+  function parsedAction(): SlackBlockAction {
+    const action = parseSlackBlockAction(blockActionsPayload());
+    if (action === null) {
+      throw new Error("fixture must parse");
+    }
+    return action;
+  }
+
+  it("swaps only the clicked actions row for the note", async () => {
+    const calls: Array<{ method: string; args: Record<string, unknown> }> = [];
+    const action = parsedAction();
+    action.messageBlocks = [
+      ...(action.messageBlocks ?? []),
+      { type: "actions", block_id: "someone_elses_row" },
+    ];
+    const ok = await resolveBlockActionCard({
+      botToken: {
+        kind: "api-transport",
+        label: "test",
+        async call(method: string, args: Record<string, unknown>) {
+          calls.push({ method, args });
+          return { ok: true };
+        },
+      },
+      action,
+      note: "resolved by <@U7>",
+    });
+    expect(ok).toBe(true);
+    expect(calls).toHaveLength(1);
+    expect(calls[0]?.method).toBe("chat.update");
+    expect(calls[0]?.args.ts).toBe("5.0");
+    const updated = JSON.stringify(calls[0]?.args.blocks);
+    expect(updated).not.toContain('"block_id":"b1"');
+    expect(updated).toContain("someone_elses_row");
+    expect(updated).toContain("resolved by <@U7>");
+  });
+
+  it("returns false when the payload carried no message blocks", async () => {
+    const action = parsedAction();
+    action.messageBlocks = undefined;
+    const ok = await resolveBlockActionCard({
+      botToken: {
+        kind: "api-transport",
+        label: "test",
+        async call() {
+          throw new Error("must not call Slack");
+        },
+      },
+      action,
+      note: "resolved",
+    });
+    expect(ok).toBe(false);
+  });
+});
+
+describe("blockActionAuth", () => {
+  it("builds the click's thread-scoped principal with the clicker", () => {
+    const action = parseSlackBlockAction(blockActionsPayload());
+    const auth = blockActionAuth(action as SlackBlockAction);
+    expect(auth.principalId).toBe("slack:T1:C9:5.0");
+    expect(auth.attributes?.user_id).toBe("U7");
+    expect(auth.attributes?.user_name).toBe("netto");
+  });
+});
+
+describe("mrkdwnSections", () => {
+  it("packs lines into capped sections preserving order", () => {
+    const lines = Array.from(
+      { length: 200 },
+      (_, i) => `• item-${i}-${"x".repeat(20)}`
+    );
+    const sections = mrkdwnSections(["Header:", ...lines]) as Array<{
+      type: string;
+      text: { type: string; text: string };
+    }>;
+    expect(sections.length).toBeGreaterThan(1);
+    for (const section of sections) {
+      expect(section.type).toBe("section");
+      expect(section.text.text.length).toBeLessThanOrEqual(
+        SLACK_SECTION_MRKDWN_MAX
+      );
+    }
+    const joined = sections.map((section) => section.text.text).join("\n");
+    expect(joined.startsWith("Header:")).toBe(true);
+    for (const line of lines) {
+      expect(joined).toContain(line);
+    }
+  });
+
+  it("keeps a short list in one section", () => {
+    expect(mrkdwnSections(["Header:", "• a", "• b"])).toHaveLength(1);
+  });
+
+  it("hard-splits a single oversized line at the cap", () => {
+    const sections = mrkdwnSections([
+      "x".repeat(SLACK_SECTION_MRKDWN_MAX + 500),
+    ]) as Array<{ text: { text: string } }>;
+    expect(sections).toHaveLength(2);
+    expect(sections[0]?.text.text.length).toBe(SLACK_SECTION_MRKDWN_MAX);
+    expect(sections[1]?.text.text.length).toBe(500);
+  });
+});
+
+describe("slackTableBlock", () => {
+  it("builds a native table with header + rich_text link cells", () => {
+    const block = slackTableBlock({
+      headers: ["Service", "SHA", "Anyship", "Logs"],
+      columnSettings: [
+        { is_wrapped: true },
+        { align: "left" },
+        { align: "left" },
+        { align: "left" },
+      ],
+      rows: [
+        [
+          slackRawTextCell("portal-website"),
+          slackLinkCell({
+            url: "https://github.com/anysphere/everysphere/commit/abc",
+            text: "abcdef0",
+          }),
+          slackLinkCell({
+            url: "https://anytool.corp.anysphere.co/anyship/deployments?deployment=d1",
+            text: "open",
+          }),
+          slackRawTextCell("—"),
+        ],
+      ],
+    });
+    expect(block).toEqual({
+      type: "table",
+      column_settings: [
+        { is_wrapped: true },
+        { align: "left" },
+        { align: "left" },
+        { align: "left" },
+      ],
+      rows: [
+        [
+          { type: "raw_text", text: "Service" },
+          { type: "raw_text", text: "SHA" },
+          { type: "raw_text", text: "Anyship" },
+          { type: "raw_text", text: "Logs" },
+        ],
+        [
+          { type: "raw_text", text: "portal-website" },
+          {
+            type: "rich_text",
+            elements: [
+              {
+                type: "rich_text_section",
+                elements: [
+                  {
+                    type: "link",
+                    url: "https://github.com/anysphere/everysphere/commit/abc",
+                    text: "abcdef0",
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            type: "rich_text",
+            elements: [
+              {
+                type: "rich_text_section",
+                elements: [
+                  {
+                    type: "link",
+                    url: "https://anytool.corp.anysphere.co/anyship/deployments?deployment=d1",
+                    text: "open",
+                  },
+                ],
+              },
+            ],
+          },
+          { type: "raw_text", text: "—" },
+        ],
+      ],
+    });
+  });
+
+  it("returns undefined for empty headers", () => {
+    expect(slackTableBlock({ headers: [], rows: [] })).toBeUndefined();
+  });
+
+  it("rejects oversized or jagged tables", () => {
+    expect(() =>
+      slackTableBlock({
+        headers: Array.from({ length: SLACK_TABLE_MAX_COLUMNS + 1 }, () => "c"),
+        rows: [],
+      })
+    ).toThrow(/columns exceeds/);
+    expect(() =>
+      slackTableBlock({
+        headers: ["A"],
+        rows: Array.from({ length: SLACK_TABLE_MAX_ROWS }, () => [
+          slackRawTextCell("x"),
+        ]),
+      })
+    ).toThrow(/rows exceeds/);
+    expect(() =>
+      slackTableBlock({
+        headers: ["A", "B"],
+        rows: [[slackRawTextCell("only-one")]],
+      })
+    ).toThrow(/expected 2/);
+  });
+});

package/src/channels/slack/bot-mentions.test.ts

@@ -0,0 +1,217 @@
+import { describe, expect, it } from "vitest";
+import {
+  botMentionsFromEnv,
+  buildDelegationMetadata,
+  normalizeBotMentionAllowlist,
+  parseDelegationMetadata,
+  SLACK_DELEGATION_METADATA_EVENT_TYPE,
+  SlackBotMentionGate,
+} from "./bot-mentions.js";
+import { parseAppMentionEvent } from "./inbound.js";
+import type { SlackMessage } from "./types.js";
+
+function botMention(patch: Partial<SlackMessage> = {}): SlackMessage {
+  return {
+    text: "<@ULASSO> please deploy #123",
+    body: "<@ULASSO> please deploy #123",
+    markdown: "@ULASSO please deploy #123",
+    ts: "2.0",
+    threadTs: "1.0",
+    channelId: "C9",
+    author: { userId: "ULASSO", isBot: true, botId: "BLASSO" },
+    ...patch,
+  };
+}
+
+function gate(
+  options: Partial<ConstructorParameters<typeof SlackBotMentionGate>[0]> = {},
+  identity: { botId?: string; botUserId?: string } = {
+    botId: "BSELF",
+    botUserId: "USELF",
+  }
+): SlackBotMentionGate {
+  return new SlackBotMentionGate(
+    { allowFrom: ["BLASSO"], ...options },
+    identity,
+    { log: { info() {}, warn() {}, error() {}, debug() {}, write() {} } }
+  );
+}
+
+describe("delegation metadata", () => {
+  it("round-trips build → parse", () => {
+    const metadata = buildDelegationMetadata({
+      depth: 2,
+      fromAgent: "lasso",
+      originSessionId: "sess-1",
+    });
+    expect(metadata.event_type).toBe(SLACK_DELEGATION_METADATA_EVENT_TYPE);
+    const parsed = parseDelegationMetadata({ metadata });
+    expect(parsed).toEqual({
+      depth: 2,
+      fromAgent: "lasso",
+      originSessionId: "sess-1",
+    });
+  });
+
+  it("ignores foreign and malformed metadata", () => {
+    expect(parseDelegationMetadata({})).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: { event_type: "other", event_payload: { depth: 1 } },
+      })
+    ).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: {
+          event_type: SLACK_DELEGATION_METADATA_EVENT_TYPE,
+          event_payload: { depth: 0 },
+        },
+      })
+    ).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: {
+          event_type: SLACK_DELEGATION_METADATA_EVENT_TYPE,
+          event_payload: { depth: "two" },
+        },
+      })
+    ).toBeUndefined();
+  });
+});
+
+describe("botMentionsFromEnv", () => {
+  it("returns undefined when unset and options when set", () => {
+    const envVar = "BOT_MENTIONS_TEST_VAR";
+    delete process.env[envVar];
+    expect(botMentionsFromEnv(envVar)).toBeUndefined();
+    process.env[envVar] = " B1 ,,U2 ";
+    expect(botMentionsFromEnv(envVar)).toEqual({ allowFrom: ["B1", "U2"] });
+    delete process.env[envVar];
+  });
+});
+
+describe("parseAppMentionEvent bot-authored", () => {
+  const body = {
+    type: "event_callback",
+    team_id: "T1",
+    event: {
+      type: "app_mention",
+      user: "ULASSO",
+      bot_id: "BLASSO",
+      text: "<@UTARGET> look into this",
+      ts: "2.0",
+      thread_ts: "1.0",
+      channel: "C9",
+      metadata: buildDelegationMetadata({ depth: 1, fromAgent: "lasso" }),
+    },
+  };
+
+  it("drops bot mentions by default", () => {
+    expect(parseAppMentionEvent(body)).toBeNull();
+  });
+
+  it("keeps bot mentions with delegation info when opted in", () => {
+    const message = parseAppMentionEvent(body, { includeBotAuthored: true });
+    expect(message).not.toBeNull();
+    expect(message?.author?.isBot).toBe(true);
+    expect(message?.author?.botId).toBe("BLASSO");
+    expect(message?.delegation).toEqual({ depth: 1, fromAgent: "lasso" });
+  });
+
+  it("still parses human mentions when opted in", () => {
+    const message = parseAppMentionEvent(
+      {
+        type: "event_callback",
+        event: {
+          type: "app_mention",
+          user: "U1",
+          text: "<@UTARGET> hi",
+          ts: "3.0",
+          channel: "C9",
+        },
+      },
+      { includeBotAuthored: true }
+    );
+    expect(message?.author?.isBot).toBe(false);
+    expect(message?.delegation).toBeUndefined();
+  });
+});
+
+describe("normalizeBotMentionAllowlist", () => {
+  it("trims entries and rejects empty lists", () => {
+    expect(normalizeBotMentionAllowlist([" B1 ", "U2"])).toEqual(["B1", "U2"]);
+    expect(() => normalizeBotMentionAllowlist([" "])).toThrow(/allowFrom/);
+  });
+});
+
+describe("SlackBotMentionGate", () => {
+  it("requires its own bot identity", () => {
+    expect(() => gate({}, {})).toThrow(/identity/);
+  });
+
+  it("admits an allowlisted bot mention", () => {
+    const verdict = gate().evaluate(botMention());
+    expect(verdict).toEqual({ allow: true, depth: 1 });
+  });
+
+  it("matches on bot user id as well as bot_id", () => {
+    const verdict = gate({ allowFrom: ["ULASSO"] }).evaluate(botMention());
+    expect(verdict.allow).toBe(true);
+  });
+
+  it("denies bots not in the allowlist", () => {
+    const verdict = gate().evaluate(
+      botMention({ author: { userId: "UOTHER", isBot: true, botId: "BOTHER" } })
+    );
+    expect(verdict).toMatchObject({ allow: false });
+  });
+
+  it("denies its own posts even when allowlisted", () => {
+    const verdict = gate({ allowFrom: ["BSELF"] }).evaluate(
+      botMention({ author: { userId: "USELF", isBot: true, botId: "BSELF" } })
+    );
+    expect(verdict).toMatchObject({ allow: false, reason: /own post/ });
+  });
+
+  it("enforces the depth budget", () => {
+    const g = gate();
+    expect(g.evaluate(botMention({ delegation: { depth: 2 } })).allow).toBe(
+      true
+    );
+    expect(
+      g.evaluate(botMention({ ts: "3.0", delegation: { depth: 3 } }))
+    ).toMatchObject({ allow: false, reason: /depth/ });
+  });
+
+  it("enforces the rate budget with a sliding window", () => {
+    const g = gate({ maxPerThreadPerHour: 2 });
+    expect(g.evaluate(botMention(), 1000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 2000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 3000)).toMatchObject({
+      allow: false,
+      reason: /rate budget/,
+    });
+    // Window slides: an hour later the thread has rate budget again.
+    const later = 3000 + 60 * 60 * 1000;
+    expect(g.evaluate(botMention(), later).allow).toBe(true);
+    // Other threads are unaffected.
+    expect(g.evaluate(botMention({ threadTs: "9.0" }), 3000).allow).toBe(true);
+  });
+
+  it("terminates ping-pong with the lifetime thread cap", () => {
+    const g = gate({ maxPerThreadPerHour: 100, maxPerThreadTotal: 3 });
+    expect(g.evaluate(botMention(), 1000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 2000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 3000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 4000)).toMatchObject({
+      allow: false,
+      reason: /lifetime/,
+    });
+    // Sliding the window does NOT refill the lifetime cap.
+    const muchLater = 4000 + 5 * 60 * 60 * 1000;
+    expect(g.evaluate(botMention(), muchLater)).toMatchObject({
+      allow: false,
+      reason: /lifetime/,
+    });
+  });
+});