@cursor/july 0.1.20 → 0.1.21

package/src/channels/slack/dispatch.ts

@@ -5,6 +5,7 @@
 import type { HostContext, JsonValue, SendMessageFn } from "../../types.js";
 import { buildSlackBinding, slackContinuationKey } from "./api.js";
 import { firstLineTitle, maybeSetThreadTitle } from "./assistant.js";
+import type { SlackBotMentionGate } from "./bot-mentions.js";
 import type { ChannelPostWatcher } from "./channel-watch.js";
 import {
   handleSlackEvalDirective,
@@ -71,6 +72,11 @@ export interface SlackInboundDispatchDeps extends SlackContinuationProbes {
   directMessagesEnabled?: boolean;
   /** Opt-in channel watch; absent = channel posts are ignored. */
   channelWatch?: ChannelPostWatcher;
+  /**
+   * Opt-in bot-to-bot mention gate; absent = bot-authored mentions are
+   * dropped at parse time (loop safety).
+   */
+  botMentionGate?: SlackBotMentionGate;
   /**
    * When false, skip the built-in `eval` directive. Defaults to true when
    * `host.evals` is present.
@@ -410,12 +416,32 @@ export function dispatchInboundFromEventBody(
     }
   }
 
-  const mention = parseAppMentionEvent(body);
+  const mention = parseAppMentionEvent(body, {
+    includeBotAuthored: deps.botMentionGate !== undefined,
+  });
   if (mention !== null) {
     if (deps.mentionsEnabled === false) {
       log.debug("inbound ignored (mentions disabled)", { event_id: eventId });
       return false;
     }
+    if (mention.author?.isBot === true) {
+      // Parse only admits bot-authored mentions when a gate exists, so the
+      // fallback is defensive.
+      const verdict = deps.botMentionGate?.evaluate(mention) ?? {
+        allow: false as const,
+        reason: "bot mentions not enabled",
+      };
+      if (!verdict.allow) {
+        log.info("bot mention dropped", {
+          event_id: eventId,
+          channel: mention.channelId,
+          thread_ts: mention.threadTs,
+          from_bot: mention.author.botId ?? mention.author.userId,
+          reason: verdict.reason,
+        });
+        return false;
+      }
+    }
     deps.waitUntil(
       dispatchInboundMessage({
         kind: "app_mention",

package/src/channels/slack/eval-directive.test.ts

@@ -0,0 +1,273 @@
+import { describe, expect, it } from "vitest";
+import type { EvalRunSnapshot, HostEvalsApi } from "../../evals.js";
+import {
+  EvalRunConflictError,
+  EvalRunEmptyError,
+} from "../../internal/eval-run-store.js";
+import {
+  formatSlackEvalHelp,
+  formatSlackEvalList,
+  formatSlackEvalRunSummary,
+  handleSlackEvalDirective,
+  normalizeSlackEvalDirectiveBody,
+  parseSlackEvalDirective,
+} from "./eval-directive.js";
+import type { SlackBinding } from "./types.js";
+
+describe("normalizeSlackEvalDirectiveBody", () => {
+  it("strips mentions and cursorAccount agent-name prefix", () => {
+    expect(normalizeSlackEvalDirectiveBody("<@Ubot> eval list")).toBe(
+      "eval list"
+    );
+    expect(normalizeSlackEvalDirectiveBody("@Ubot eval status")).toBe(
+      "eval status"
+    );
+    expect(
+      normalizeSlackEvalDirectiveBody(
+        "OncallBuddy eval triage/open-incidents",
+        {
+          agentName: "OncallBuddy",
+        }
+      )
+    ).toBe("eval triage/open-incidents");
+    expect(
+      normalizeSlackEvalDirectiveBody("benny eval --tag smoke", {
+        agentName: "Benny",
+      })
+    ).toBe("eval --tag smoke");
+    // Do not strip arbitrary leading words ("please eval …" is not a directive).
+    expect(normalizeSlackEvalDirectiveBody("please eval this")).toBe(
+      "please eval this"
+    );
+  });
+});
+
+describe("parseSlackEvalDirective", () => {
+  it("parses run / list / status / help and filters", () => {
+    expect(parseSlackEvalDirective("<@U> eval")).toEqual({ kind: "run" });
+    expect(parseSlackEvalDirective("eval list")).toEqual({ kind: "list" });
+    expect(parseSlackEvalDirective("EVAL status")).toEqual({ kind: "status" });
+    expect(parseSlackEvalDirective("eval cancel evalrun_abc")).toEqual({
+      kind: "cancel",
+      runId: "evalrun_abc",
+    });
+    expect(parseSlackEvalDirective("eval cancel")).toEqual({ kind: "help" });
+    expect(parseSlackEvalDirective("eval help")).toEqual({ kind: "help" });
+    expect(parseSlackEvalDirective("eval smoke triage/open-incidents")).toEqual(
+      {
+        kind: "run",
+        filterIds: ["smoke", "triage/open-incidents"],
+      }
+    );
+    expect(parseSlackEvalDirective("eval --tag oncall -t smoke")).toEqual({
+      kind: "run",
+      tags: ["oncall", "smoke"],
+    });
+    expect(parseSlackEvalDirective("eval --tag=booking smoke")).toEqual({
+      kind: "run",
+      filterIds: ["smoke"],
+      tags: ["booking"],
+    });
+  });
+
+  it("returns null for non-directives and help for unknown flags", () => {
+    expect(parseSlackEvalDirective("please eval this")).toBeNull();
+    expect(parseSlackEvalDirective("stop")).toBeNull();
+    expect(parseSlackEvalDirective("")).toBeNull();
+    expect(parseSlackEvalDirective("eval --unknown")).toEqual({ kind: "help" });
+    expect(parseSlackEvalDirective("eval --tag")).toEqual({ kind: "help" });
+  });
+});
+
+describe("formatSlackEval*", () => {
+  it("formats help, list, and run summaries", () => {
+    expect(formatSlackEvalHelp()).toContain("eval list");
+    expect(formatSlackEvalList([])).toContain("No evals found");
+    expect(
+      formatSlackEvalList([
+        {
+          id: "smoke",
+          description: "Smoke check",
+          tags: ["ci"],
+        },
+      ])
+    ).toContain("`smoke`");
+    const run: EvalRunSnapshot = {
+      runId: "evalrun_abc",
+      status: "completed",
+      startedAt: "2026-07-22T00:00:00.000Z",
+      finishedAt: "2026-07-22T00:00:05.000Z",
+      summary: { passed: 1, failed: 0, total: 1, done: 1 },
+      cases: [
+        {
+          id: "smoke",
+          fileId: "smoke",
+          status: "done",
+          ok: true,
+          durationMs: 5000,
+        },
+      ],
+      config: { maxPlaygroundRuns: 20, durableRuns: false },
+    };
+    const text = formatSlackEvalRunSummary(run);
+    expect(text).toContain("evalrun_abc");
+    expect(text).toContain("`PASS`");
+    expect(text).toContain("1 passed");
+  });
+});
+
+function fakeBinding(): {
+  binding: SlackBinding;
+  posts: string[];
+  typing: string[];
+} {
+  const posts: string[] = [];
+  const typing: string[] = [];
+  const binding = {
+    thread: {
+      post: async (text: string) => {
+        posts.push(text);
+        return { ts: "1.0" };
+      },
+      startTyping: async (status: string) => {
+        typing.push(status);
+      },
+      setTitle: async () => {},
+      setSuggestedPrompts: async () => {},
+    },
+  } as unknown as SlackBinding;
+  return { binding, posts, typing };
+}
+
+function fakeEvals(overrides: Partial<HostEvalsApi> = {}): HostEvalsApi {
+  return {
+    list: async () => ({
+      evals: [{ id: "smoke", fileId: "smoke", tags: ["ci"] }],
+      config: { maxPlaygroundRuns: 20, durableRuns: false },
+    }),
+    get: async () => undefined,
+    listRunsWithActive: async () => ({ runs: [] }),
+    start: async () => {
+      throw new Error("start not stubbed");
+    },
+    cancel: async () => {
+      throw new Error("cancel not stubbed");
+    },
+    ...overrides,
+  };
+}
+
+describe("handleSlackEvalDirective", () => {
+  it("lists evals and reports empty status", async () => {
+    const { binding, posts } = fakeBinding();
+    await handleSlackEvalDirective({
+      directive: { kind: "list" },
+      evals: fakeEvals(),
+      binding,
+    });
+    expect(posts[0]).toContain("`smoke`");
+
+    await handleSlackEvalDirective({
+      directive: { kind: "status" },
+      evals: fakeEvals(),
+      binding,
+    });
+    expect(posts[1]).toContain("No eval runs yet");
+  });
+
+  it("starts a run, polls, and posts the summary", async () => {
+    const running: EvalRunSnapshot = {
+      runId: "evalrun_1",
+      status: "running",
+      startedAt: "2026-07-22T00:00:00.000Z",
+      summary: { passed: 0, failed: 0, total: 1, done: 0 },
+      cases: [{ id: "smoke", fileId: "smoke", status: "running" }],
+      config: { maxPlaygroundRuns: 20, durableRuns: false },
+    };
+    const done: EvalRunSnapshot = {
+      ...running,
+      status: "completed",
+      finishedAt: "2026-07-22T00:00:02.000Z",
+      summary: { passed: 1, failed: 0, total: 1, done: 1 },
+      cases: [
+        {
+          id: "smoke",
+          fileId: "smoke",
+          status: "done",
+          ok: true,
+          durationMs: 1200,
+        },
+      ],
+    };
+    let gets = 0;
+    const { binding, posts } = fakeBinding();
+    await handleSlackEvalDirective({
+      directive: { kind: "run", filterIds: ["smoke"] },
+      evals: fakeEvals({
+        start: async (input) => {
+          expect(input?.filterIds).toEqual(["smoke"]);
+          return running;
+        },
+        get: async () => {
+          gets += 1;
+          return gets === 1 ? running : done;
+        },
+      }),
+      binding,
+      pollMs: 1,
+    });
+    expect(posts.some((p) => p.includes("Started Eval ID"))).toBe(true);
+    expect(posts.some((p) => p.includes("`PASS`") && p.includes("smoke"))).toBe(
+      true
+    );
+  });
+
+  it("surfaces conflict and empty-match errors", async () => {
+    const { binding, posts } = fakeBinding();
+    await handleSlackEvalDirective({
+      directive: { kind: "run" },
+      evals: fakeEvals({
+        start: async () => {
+          throw new EvalRunConflictError("evalrun_busy");
+        },
+        get: async () => undefined,
+      }),
+      binding,
+    });
+    expect(posts[0]).toContain("already in progress");
+
+    await handleSlackEvalDirective({
+      directive: { kind: "run", tags: ["missing"] },
+      evals: fakeEvals({
+        start: async () => {
+          throw new EvalRunEmptyError();
+        },
+      }),
+      binding,
+    });
+    expect(posts[1]).toContain("No matching evals");
+  });
+
+  it("posts help text", async () => {
+    const { binding, posts } = fakeBinding();
+    await handleSlackEvalDirective({
+      directive: { kind: "help" },
+      evals: fakeEvals(),
+      binding,
+    });
+    expect(posts[0]).toContain("eval --tag");
+  });
+});
+
+describe("parseSlackEvalDirective cursorAccount shapes", () => {
+  it("accepts agent-name-prefixed eval commands", () => {
+    expect(
+      parseSlackEvalDirective("OncallBuddy eval triage/open-incidents", {
+        agentName: "OncallBuddy",
+      })
+    ).toEqual({
+      kind: "run",
+      filterIds: ["triage/open-incidents"],
+    });
+  });
+});

package/src/channels/slack/inbound.ts

@@ -2,6 +2,7 @@
  * Parse Slack Events API payloads into structured inbound messages.
  */
 
+import { parseDelegationMetadata } from "./bot-mentions.js";
 import { slackApiMessageBody } from "./message-body.js";
 import type { SlackAuthor, SlackMessage } from "./types.js";
 
@@ -80,7 +81,20 @@ function buildSlackMessage(
   };
 }
 
-export function parseAppMentionEvent(body: unknown): SlackMessage | null {
+export interface ParseAppMentionOptions {
+  /**
+   * Keep bot-authored mentions instead of dropping them at parse time.
+   * The dispatch layer enforces the per-channel policy
+   * ({@link SlackBotMentionsOptions}: allowlist, depth, thread budget)
+   * and always drops the agent's own posts.
+   */
+  includeBotAuthored?: boolean;
+}
+
+export function parseAppMentionEvent(
+  body: unknown,
+  options?: ParseAppMentionOptions
+): SlackMessage | null {
   const root = asRecord(body);
   if (root === null || root.type !== "event_callback") {
     return null;
@@ -89,12 +103,19 @@ export function parseAppMentionEvent(body: unknown): SlackMessage | null {
   if (event === null || event.type !== "app_mention") {
     return null;
   }
-  // Drop bot-authored mentions (mirrors DM filtering) to avoid loops.
+  // Drop bot-authored mentions (mirrors DM filtering) to avoid loops,
+  // unless the caller opted into the gated bot-mention path.
   const botId = asString(event.bot_id);
-  if (botId !== undefined && botId.length > 0) {
+  const isBotAuthored = botId !== undefined && botId.length > 0;
+  if (isBotAuthored && options?.includeBotAuthored !== true) {
     return null;
   }
-  return buildSlackMessage(event, asString(root.team_id));
+  const message = buildSlackMessage(event, asString(root.team_id));
+  if (message === null || !isBotAuthored) {
+    return message;
+  }
+  const delegation = parseDelegationMetadata(event);
+  return delegation === undefined ? message : { ...message, delegation };
 }
 
 /**

package/src/channels/slack/index.ts

@@ -23,6 +23,7 @@ export * from "./approvals.js";
 export * from "./assistant.js";
 export * from "./auth.js";
 export * from "./blocks.js";
+export * from "./bot-mentions.js";
 export * from "./channel-watch.js";
 export * from "./constants.js";
 export * from "./credentials.js";

package/src/channels/slack/message-body.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { slackApiMessageBody } from "./message-body.js";
+
+describe("slackApiMessageBody", () => {
+  it("prefers text and dedupes attachment fallback", () => {
+    const body = slackApiMessageBody({
+      text: "Alert: rate limit",
+      attachments: [
+        {
+          title: "Bugbot rate limit",
+          text: "Alert: rate limit",
+          fallback: "Alert: rate limit",
+          title_link: "https://app.datadoghq.com/monitors/1",
+        },
+      ],
+    });
+    expect(body).toContain("Alert: rate limit");
+    expect(body).toContain("Bugbot rate limit");
+    expect(body).toContain("https://app.datadoghq.com/monitors/1");
+    expect(body.split("Alert: rate limit").length - 1).toBe(1);
+  });
+
+  it("reads Block Kit section text", () => {
+    const body = slackApiMessageBody({
+      blocks: [
+        {
+          type: "section",
+          text: { type: "mrkdwn", text: "*Monitor* fired" },
+        },
+      ],
+    });
+    expect(body).toBe("*Monitor* fired");
+  });
+
+  it("recovers a Datadog notification posted with empty top-level text", () => {
+    const body = slackApiMessageBody({
+      text: "",
+      attachments: [
+        {
+          title:
+            "Triggered: [service-monitor prod:temporal-bugbot] High cache error rate (client=main, region=us-east-1)",
+          title_link: "https://us5.datadoghq.com/monitors/19610160",
+          text: "Service temporal-bugbot has a high cache error rate.",
+        },
+      ],
+    });
+    expect(body).toContain("temporal-bugbot");
+    expect(body).toContain("https://us5.datadoghq.com/monitors/19610160");
+  });
+
+  it("returns an empty string when nothing readable is present", () => {
+    expect(slackApiMessageBody({ text: "   ", attachments: [{}] })).toBe("");
+  });
+});

package/src/channels/slack/nudge-store.test.ts

@@ -0,0 +1,143 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  formatSlackFollowupNudgeBlock,
+  SlackAskDedupeStore,
+  SlackNudgeStore,
+} from "./nudge-store.js";
+
+const cleanups: Array<() => Promise<void>> = [];
+
+afterEach(async () => {
+  while (cleanups.length > 0) {
+    await cleanups.pop()?.();
+  }
+});
+
+async function tempRoot(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "slack-nudge-"));
+  cleanups.push(() => rm(root, { recursive: true, force: true }));
+  return root;
+}
+
+describe("SlackNudgeStore", () => {
+  it("appends, drains exactly once, and skips delivered source ts", async () => {
+    const store = new SlackNudgeStore(await tempRoot());
+    const key = "C1:1.0";
+    expect(
+      await store.append({
+        continuationKey: key,
+        sourceTs: "2.0",
+        text: "any leads?",
+        author: "<@U1>",
+      })
+    ).toBe(true);
+    expect(
+      await store.append({
+        continuationKey: key,
+        sourceTs: "2.0",
+        text: "any leads?",
+        author: "<@U1>",
+      })
+    ).toBe(false);
+
+    const first = await store.drainForInject(key);
+    expect(first).toHaveLength(1);
+    expect(first[0]?.sourceTs).toBe("2.0");
+    expect(await store.isDelivered(key, "2.0")).toBe(true);
+    expect(await store.hasUndelivered(key)).toBe(false);
+
+    const second = await store.drainForInject(key);
+    expect(second).toHaveLength(0);
+  });
+
+  it("content-dedupes pending nudges", async () => {
+    const store = new SlackNudgeStore(await tempRoot());
+    const key = "C1:1.0";
+    expect(
+      await store.append({
+        continuationKey: key,
+        sourceTs: "2.0",
+        text: "same body",
+      })
+    ).toBe(true);
+    expect(
+      await store.append({
+        continuationKey: key,
+        sourceTs: "3.0",
+        text: "same body",
+      })
+    ).toBe(false);
+  });
+
+  it("clear removes pending and delivered", async () => {
+    const store = new SlackNudgeStore(await tempRoot());
+    const key = "C1:1.0";
+    await store.append({
+      continuationKey: key,
+      sourceTs: "2.0",
+      text: "stop me",
+    });
+    await store.drainForInject(key);
+    await store.clear(key);
+    expect(await store.isDelivered(key, "2.0")).toBe(false);
+    expect(await store.hasUndelivered(key)).toBe(false);
+  });
+
+  it("maps path-traversal keys to _empty so clear cannot escape root", async () => {
+    const root = await tempRoot();
+    const store = new SlackNudgeStore(root);
+    expect(
+      await store.append({
+        continuationKey: "..",
+        sourceTs: "2.0",
+        text: "escape attempt",
+      })
+    ).toBe(true);
+    const { readdir } = await import("node:fs/promises");
+    expect(await readdir(root)).toContain("_empty");
+    await store.clear("..");
+    expect(await readdir(root)).not.toContain("..");
+    // Parent of the store root must still be readable after clear("..").
+    await expect(readdir(join(root, ".."))).resolves.toBeDefined();
+  });
+});
+
+describe("formatSlackFollowupNudgeBlock", () => {
+  it("formats structured follow-up block", () => {
+    const block = formatSlackFollowupNudgeBlock([
+      {
+        id: "n1",
+        continuationKey: "C:1",
+        sourceTs: "2.0",
+        text: "any leads?",
+        author: "<@U1>",
+        createdAt: "2026-01-01T00:00:00.000Z",
+        contentHash: "abc",
+      },
+    ]);
+    expect(block).toContain("<slack_followup>");
+    expect(block).toContain("<@U1> @ 2.0:");
+    expect(block).toContain("any leads?");
+  });
+});
+
+describe("SlackAskDedupeStore", () => {
+  it("claims each channel:ts once", async () => {
+    const store = new SlackAskDedupeStore(await tempRoot());
+    expect(await store.tryClaim("C1", "10.0")).toBe(true);
+    expect(await store.tryClaim("C1", "10.0")).toBe(false);
+    expect(await store.wasClaimed("C1", "10.0")).toBe(true);
+    expect(await store.tryClaim("C1", "11.0")).toBe(true);
+  });
+
+  it("release allows a later claim of the same channel:ts", async () => {
+    const store = new SlackAskDedupeStore(await tempRoot());
+    expect(await store.tryClaim("C1", "10.0")).toBe(true);
+    await store.release("C1", "10.0");
+    expect(await store.wasClaimed("C1", "10.0")).toBe(false);
+    expect(await store.tryClaim("C1", "10.0")).toBe(true);
+  });
+});