@cursor/july 0.1.20 → 0.1.21

package/src/channels/slack/slack-channel.ts

@@ -17,6 +17,11 @@ import type {
   SendMessageFn,
 } from "../../types.js";
 import { slackContinuationKey } from "./api.js";
+import {
+  normalizeBotMentionAllowlist,
+  SLACK_BOT_MENTION_DEFAULTS,
+  SlackBotMentionGate,
+} from "./bot-mentions.js";
 import {
   type ChannelPostWatcher,
   createChannelPostWatcher,
@@ -94,6 +99,14 @@ export function slackChannel<const Name extends string = string>(
         "slackChannel({ cursorAccount: true }) does not support engagement.channelPosts — agents must be explicitly addressed (@mention, DM, or claimed-thread reply). Channel watching is Socket Mode only."
       );
     }
+    // Bot-mention wake needs the app's own bot identity (auth.test) and
+    // Socket Mode event delivery; the Cursor relay drops bot-authored
+    // mentions before they reach the agent.
+    if (options.engagement?.botMentions !== undefined) {
+      throw new Error(
+        "slackChannel({ cursorAccount: true }) does not support engagement.botMentions — bot-to-bot mention wake is Socket Mode only (author a dedicated Slack app channel)."
+      );
+    }
     // Mentions/DMs are always routed by the backend. Disabling them
     // client-side would black-hole events the webhook already stole from
     // native Cursor handling — reject at construction instead.
@@ -156,6 +169,10 @@ export function slackChannel<const Name extends string = string>(
       );
     }
   }
+  const botMentions = engagement.botMentions;
+  if (botMentions !== undefined) {
+    normalizeBotMentionAllowlist(botMentions.allowFrom);
+  }
   const eventIds = createEventIdDedupe();
   const toolApprovals = options.toolApprovals === true;
   const interactivity = options.interactivity === true;
@@ -192,6 +209,7 @@ export function slackChannel<const Name extends string = string>(
 
   let socketHandle: SlackSocketModeHandle | null = null;
   let channelWatch: ChannelPostWatcher | undefined;
+  let botMentionGate: SlackBotMentionGate | undefined;
 
   function inboundDeps(args: {
     send: SendMessageFn;
@@ -232,6 +250,7 @@ export function slackChannel<const Name extends string = string>(
         ? {}
         : { interruptContinuation: args.interruptContinuation }),
       ...(channelWatch === undefined ? {} : { channelWatch }),
+      ...(botMentionGate === undefined ? {} : { botMentionGate }),
     };
   }
 
@@ -305,22 +324,60 @@ export function slackChannel<const Name extends string = string>(
         return;
       }
 
-      if (channelPosts !== undefined) {
-        const allowlist = new SlackChannelAllowlist(channelPosts.allow);
-        let botUserId: string | undefined;
-        let botId: string | undefined;
+      let botUserId: string | undefined;
+      let botId: string | undefined;
+      let webClient: InstanceType<
+        typeof import("@slack/web-api").WebClient
+      > | null = null;
+      if (channelPosts !== undefined || botMentions !== undefined) {
         try {
           const { WebClient } = await import("@slack/web-api");
-          const client = new WebClient(botToken);
-          const identity = await client.auth.test();
+          webClient = new WebClient(botToken);
+          const identity = await webClient.auth.test();
           botUserId =
             typeof identity.user_id === "string" ? identity.user_id : undefined;
           botId =
             typeof identity.bot_id === "string" ? identity.bot_id : undefined;
+        } catch (error) {
+          getLog().error("bot identity lookup degraded", {
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }
+
+      if (botMentions !== undefined) {
+        if (botUserId === undefined && botId === undefined) {
+          getLog().error("bot mentions disabled", {
+            reason:
+              "engagement.botMentions requires bot identity from auth.test (loop safety)",
+          });
+        } else {
+          botMentionGate = new SlackBotMentionGate(
+            botMentions,
+            { botUserId, botId },
+            { log: getLog() }
+          );
+          getLog().info("bot mentions enabled", {
+            allow_from: botMentions.allowFrom.join(","),
+            max_depth:
+              botMentions.maxDepth ?? SLACK_BOT_MENTION_DEFAULTS.maxDepth,
+            max_per_thread_per_hour:
+              botMentions.maxPerThreadPerHour ??
+              SLACK_BOT_MENTION_DEFAULTS.maxPerThreadPerHour,
+            max_per_thread_total:
+              botMentions.maxPerThreadTotal ??
+              SLACK_BOT_MENTION_DEFAULTS.maxPerThreadTotal,
+          });
+        }
+      }
+
+      if (channelPosts !== undefined) {
+        const allowlist = new SlackChannelAllowlist(channelPosts.allow);
+        try {
           const names = allowlist.unresolvedNames();
-          if (names.length > 0) {
+          if (names.length > 0 && webClient !== null) {
             allowlist.applyResolvedNames(
-              await resolveChannelNames(client, names, getLog())
+              await resolveChannelNames(webClient, names, getLog())
             );
           }
         } catch (error) {
@@ -472,6 +529,7 @@ export function slackChannel<const Name extends string = string>(
       getLog().info("channel stop");
       channelWatch?.stop();
       channelWatch = undefined;
+      botMentionGate = undefined;
       await socketHandle?.stop();
       socketHandle = null;
       await options.onStop?.();

package/src/channels/slack/slack.test.ts

@@ -0,0 +1,391 @@
+import { describe, expect, it } from "vitest";
+import { SLACK_LOADING_MESSAGE_MAX_LEN } from "./constants.js";
+import {
+  buildSlackManifest,
+  computeStreamAppend,
+  createSlackLogger,
+  credentialsFromEnv,
+  envPrefixFromName,
+  extractGithubPrRef,
+  parseAppMentionEvent,
+  parseDirectMessageEvent,
+  SLACK_EXTERNAL_APP_MANAGEMENT_URL,
+  slackChannel,
+  slackContinuationKey,
+  slackEnvKeys,
+  slackTextToMarkdown,
+  slackThreadPermalink,
+  truncateTypingStatus,
+  tryResolveAppToken,
+  tryResolveBotToken,
+} from "./index.js";
+
+describe("slackContinuationKey", () => {
+  it("joins channel and thread", () => {
+    expect(slackContinuationKey("C123", "1719.000")).toBe("C123:1719.000");
+  });
+});
+
+describe("slackThreadPermalink", () => {
+  it("prefers the client thread deep link when team is known", () => {
+    expect(
+      slackThreadPermalink({
+        teamId: "T1",
+        channelId: "C9",
+        threadTs: "1783451265.725729",
+      })
+    ).toBe("https://app.slack.com/client/T1/C9/thread/C9-1783451265.725729");
+  });
+
+  it("falls back to archives permalink without team", () => {
+    expect(
+      slackThreadPermalink({
+        channelId: "C9",
+        threadTs: "1783451265.725729",
+      })
+    ).toBe(
+      "https://app.slack.com/archives/C9/p1783451265725729?thread_ts=1783451265.725729"
+    );
+  });
+});
+
+describe("createSlackLogger", () => {
+  it("formats levels and fields", () => {
+    const lines: string[] = [];
+    const log = createSlackLogger((line) => lines.push(line));
+    log.info("inbound", { kind: "app_mention", channel: "C9" });
+    log.warn("chat.startStream unavailable", { error: "missing_scope" });
+    expect(lines[0]).toBe(
+      "[agentkit/slack] inbound kind=app_mention channel=C9"
+    );
+    expect(lines[1]).toBe(
+      "[agentkit/slack] warn chat.startStream unavailable error=missing_scope"
+    );
+  });
+});
+
+describe("inbound parsers", () => {
+  it("parses app_mention", () => {
+    const message = parseAppMentionEvent({
+      type: "event_callback",
+      team_id: "T1",
+      event: {
+        type: "app_mention",
+        user: "U1",
+        text: "<@Ubot> hi there",
+        ts: "1.0",
+        channel: "C9",
+      },
+    });
+    expect(message).not.toBeNull();
+    expect(message?.channelId).toBe("C9");
+    expect(message?.threadTs).toBe("1.0");
+    expect(message?.markdown).toContain("hi there");
+    expect(message?.teamId).toBe("T1");
+  });
+
+  it("parses DMs and drops bot messages", () => {
+    const dm = parseDirectMessageEvent({
+      type: "event_callback",
+      team_id: "T1",
+      event: {
+        type: "message",
+        channel_type: "im",
+        user: "U1",
+        text: "hello",
+        ts: "2.0",
+        channel: "D1",
+      },
+    });
+    expect(dm?.markdown).toBe("hello");
+
+    const bot = parseDirectMessageEvent({
+      type: "event_callback",
+      event: {
+        type: "message",
+        channel_type: "im",
+        bot_id: "B1",
+        text: "noop",
+        ts: "2.0",
+        channel: "D1",
+      },
+    });
+    expect(bot).toBeNull();
+  });
+
+  it("drops bot-authored app_mention events", () => {
+    expect(
+      parseAppMentionEvent({
+        type: "event_callback",
+        event: {
+          type: "app_mention",
+          bot_id: "B1",
+          text: "<@Ubot> loop",
+          ts: "1.0",
+          channel: "C9",
+        },
+      })
+    ).toBeNull();
+  });
+});
+
+describe("slackTextToMarkdown", () => {
+  it("strips user mentions", () => {
+    expect(slackTextToMarkdown("<@U123> please help")).toBe(
+      "@U123 please help"
+    );
+  });
+});
+
+describe("buildSlackManifest", () => {
+  it("enables Socket Mode without request_url", () => {
+    const manifest = buildSlackManifest({
+      name: "Weather Bot",
+      env: "dev",
+    });
+    expect(manifest.display_information.name).toBe("Weather Bot (dev)");
+    expect(manifest.features.bot_user.display_name).toContain("dev");
+    expect(manifest.settings.socket_mode_enabled).toBe(true);
+    expect(
+      (manifest.settings.event_subscriptions as { request_url?: string })
+        .request_url
+    ).toBeUndefined();
+    expect(manifest.oauth_config.scopes.bot).toContain("chat:write");
+    expect(manifest.settings.event_subscriptions.bot_events).toContain(
+      "app_mention"
+    );
+    expect(manifest.settings.interactivity.is_enabled).toBe(false);
+  });
+
+  it("hides tokens and Slack-side installs, pointing management at Cursor", () => {
+    for (const env of ["dev", "prod"] as const) {
+      expect(
+        buildSlackManifest({ name: "Weather Bot", env }).settings
+          .managed_app_settings
+      ).toEqual({
+        is_install_from_slack_disabled: true,
+        external_app_management_url: SLACK_EXTERNAL_APP_MANAGEMENT_URL,
+      });
+    }
+    expect(SLACK_EXTERNAL_APP_MANAGEMENT_URL).toBe(
+      "https://cursor.com/dashboard/deployed-agents"
+    );
+  });
+
+  it("omits managed_app_settings for hand-imported manifests", () => {
+    const manifest = buildSlackManifest({
+      name: "Weather Bot",
+      env: "prod",
+      managedByCursor: false,
+    });
+    expect("managed_app_settings" in manifest.settings).toBe(false);
+  });
+
+  it("pins Benny's Slack app to benny-dev with org deploy", () => {
+    for (const env of ["dev", "prod"] as const) {
+      const manifest = buildSlackManifest({
+        name: "Benny",
+        env,
+        channelPosts: true,
+      });
+      expect(manifest.display_information.name).toBe("benny-dev");
+      expect(manifest.features.bot_user.display_name).toBe("benny-dev");
+      expect(manifest.settings.org_deploy_enabled).toBe(true);
+      expect(manifest.settings.socket_mode_enabled).toBe(true);
+      expect(manifest.settings.token_rotation_enabled).toBe(false);
+      expect(manifest.settings.is_mcp_enabled).toBe(false);
+    }
+    expect(
+      buildSlackManifest({ name: "benny", env: "prod" }).features.bot_user
+        .display_name
+    ).toBe("benny-dev");
+  });
+
+  it("enables interactivity when opted in", () => {
+    const manifest = buildSlackManifest({
+      name: "Weather Bot",
+      env: "prod",
+      interactivity: true,
+    });
+    expect(manifest.settings.interactivity.is_enabled).toBe(true);
+  });
+
+  it("omits channel-post events by default and adds them when opted in", () => {
+    const defaults = buildSlackManifest({ name: "Bot", env: "dev" });
+    expect(defaults.settings.event_subscriptions.bot_events).not.toContain(
+      "message.channels"
+    );
+
+    const watching = buildSlackManifest({
+      name: "Bot",
+      env: "dev",
+      channelPosts: true,
+    });
+    expect(watching.settings.event_subscriptions.bot_events).toContain(
+      "message.channels"
+    );
+    expect(watching.settings.event_subscriptions.bot_events).toContain(
+      "message.groups"
+    );
+  });
+
+  it("defaults the description from the name and honors an explicit one", () => {
+    const bare = buildSlackManifest({ name: "Bot", env: "prod" });
+    expect(bare.display_information.description).toBe(
+      "Bot — an AI agent built with Cursor"
+    );
+    expect(bare.features.assistant_view?.assistant_description).toBe(
+      "Bot — an AI agent built with Cursor"
+    );
+
+    const described = buildSlackManifest({
+      name: "Bot",
+      env: "prod",
+      description: "Does things",
+    });
+    expect(described.display_information.description).toBe("Does things");
+    expect(described.features.assistant_view?.assistant_description).toBe(
+      "Does things"
+    );
+  });
+
+  it("keeps the default description inside Slack's 140-char bound", () => {
+    const manifest = buildSlackManifest({
+      name: "x".repeat(200),
+      env: "prod",
+    });
+    expect(manifest.display_information.description).toHaveLength(140);
+    expect(manifest.display_information.description).toContain(
+      "an AI agent built with Cursor"
+    );
+  });
+});
+
+describe("slackChannel engagement", () => {
+  it("rejects an empty channelPosts allowlist", () => {
+    expect(() =>
+      slackChannel({
+        engagement: { channelPosts: { allow: [" "] } },
+      })
+    ).toThrow(/allow must list at least one channel/);
+  });
+
+  it("surfaces watched channels in channel meta", () => {
+    const channel = slackChannel({
+      engagement: { channelPosts: { allow: ["#issues-glass", "C123"] } },
+    });
+    expect(channel.meta?.kind).toBe("slack");
+    expect(channel.meta?.slackChannelPosts).toEqual(["#issues-glass", "C123"]);
+
+    const plain = slackChannel();
+    expect(plain.meta?.slackChannelPosts).toBeUndefined();
+  });
+});
+
+describe("socket mode event payload", () => {
+  it("parses app_mention from the event body Slack delivers over Socket Mode", () => {
+    const message = parseAppMentionEvent({
+      type: "event_callback",
+      team_id: "T1",
+      event_id: "EvSOCKET1",
+      event: {
+        type: "app_mention",
+        user: "U1",
+        text: "<@Ubot> via socket hello",
+        ts: "9.1",
+        channel: "C9",
+      },
+    });
+    expect(message?.markdown).toContain("via socket hello");
+    expect(message?.channelId).toBe("C9");
+  });
+});
+
+describe("computeStreamAppend", () => {
+  it("returns full text when nothing was posted", () => {
+    expect(computeStreamAppend(null, "Hello")).toBe("Hello");
+    expect(computeStreamAppend("", "Hello")).toBe("Hello");
+  });
+
+  it("returns the unsent suffix", () => {
+    expect(computeStreamAppend("Hello", "Hello world")).toBe(" world");
+  });
+
+  it("returns empty when text does not extend lastPosted", () => {
+    expect(computeStreamAppend("Hello", "Hi there")).toBe("");
+  });
+});
+
+describe("truncateTypingStatus", () => {
+  it("keeps loading_messages under Slack's 51-char limit", () => {
+    const long = "a".repeat(80);
+    const truncated = truncateTypingStatus(long);
+    expect(truncated.length).toBe(SLACK_LOADING_MESSAGE_MAX_LEN);
+    expect(truncated.endsWith("…")).toBe(true);
+  });
+});
+
+describe("env prefixes", () => {
+  it("normalizes agent names", () => {
+    expect(envPrefixFromName("bugbot-cloud")).toBe("BUGBOT_CLOUD");
+    expect(envPrefixFromName("security-reviewer")).toBe("SECURITY_REVIEWER");
+  });
+
+  it("builds per-agent env keys", () => {
+    expect(slackEnvKeys("BUGBOT")).toEqual({
+      bot: "BUGBOT_SLACK_BOT_TOKEN",
+      app: "BUGBOT_SLACK_APP_TOKEN",
+    });
+    expect(slackEnvKeys()).toEqual({
+      bot: "SLACK_BOT_TOKEN",
+      app: "SLACK_APP_TOKEN",
+    });
+  });
+
+  it("does not fall through to shared tokens for prefixed credentials", async () => {
+    const previousBot = process.env.SLACK_BOT_TOKEN;
+    const previousApp = process.env.SLACK_APP_TOKEN;
+    process.env.SLACK_BOT_TOKEN = "xoxb-shared";
+    process.env.SLACK_APP_TOKEN = "xapp-shared";
+    delete process.env.BUGBOT_SLACK_BOT_TOKEN;
+    delete process.env.BUGBOT_SLACK_APP_TOKEN;
+    try {
+      const credentials = credentialsFromEnv("BUGBOT");
+      expect(await tryResolveBotToken(credentials)).toBeUndefined();
+      expect(await tryResolveAppToken(credentials)).toBeUndefined();
+    } finally {
+      if (previousBot === undefined) {
+        delete process.env.SLACK_BOT_TOKEN;
+      } else {
+        process.env.SLACK_BOT_TOKEN = previousBot;
+      }
+      if (previousApp === undefined) {
+        delete process.env.SLACK_APP_TOKEN;
+      } else {
+        process.env.SLACK_APP_TOKEN = previousApp;
+      }
+    }
+  });
+});
+
+describe("extractGithubPrRef", () => {
+  it("parses URLs and owner/repo#N", () => {
+    expect(
+      extractGithubPrRef("please review https://github.com/acme/widget/pull/42")
+    ).toEqual({
+      owner: "acme",
+      repo: "widget",
+      number: 42,
+      url: "https://github.com/acme/widget/pull/42",
+      label: "acme/widget#42",
+    });
+    expect(extractGithubPrRef("drive acme/widget#7 for me")).toEqual({
+      owner: "acme",
+      repo: "widget",
+      number: 7,
+      url: "https://github.com/acme/widget/pull/7",
+      label: "acme/widget#7",
+    });
+    expect(extractGithubPrRef("no pr here")).toBeUndefined();
+  });
+});

package/src/channels/slack/stop.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { isWholeMessageStop, stripLeadingSlackMentions } from "./stop.js";
+
+describe("isWholeMessageStop", () => {
+  it("matches bare stop and @mention stop", () => {
+    expect(isWholeMessageStop("stop")).toBe(true);
+    expect(isWholeMessageStop("STOP")).toBe(true);
+    expect(isWholeMessageStop("<@Ubot> stop")).toBe(true);
+    expect(isWholeMessageStop("<@Ubot>  stop  ")).toBe(true);
+  });
+
+  it("does not match embedded stop", () => {
+    expect(isWholeMessageStop("please stop investigating")).toBe(false);
+    expect(isWholeMessageStop("<@Ubot> stop the deploy")).toBe(false);
+    expect(isWholeMessageStop("")).toBe(false);
+  });
+});
+
+describe("stripLeadingSlackMentions", () => {
+  it("strips repeated leading mentions", () => {
+    expect(stripLeadingSlackMentions("<@A> <@B> stop")).toBe("stop");
+  });
+});