@cursor/july 0.1.24 → 0.1.26

package/src/channels/slack/bot-mentions.test.ts

@@ -0,0 +1,267 @@
+import { describe, expect, it } from "vitest";
+import {
+  botMentionsFromEnv,
+  buildDelegationMetadata,
+  normalizeBotMentionAllowlist,
+  parseDelegationMetadata,
+  SLACK_DELEGATION_METADATA_EVENT_TYPE,
+  SlackBotMentionGate,
+} from "./bot-mentions.js";
+import { parseAppMentionEvent } from "./inbound.js";
+import type { SlackMessage } from "./types.js";
+
+function botMention(patch: Partial<SlackMessage> = {}): SlackMessage {
+  return {
+    text: "<@ULASSO> please deploy #123",
+    body: "<@ULASSO> please deploy #123",
+    markdown: "@ULASSO please deploy #123",
+    ts: "2.0",
+    threadTs: "1.0",
+    channelId: "C9",
+    author: { userId: "ULASSO", isBot: true, botId: "BLASSO" },
+    ...patch,
+  };
+}
+
+function gate(
+  options: Partial<ConstructorParameters<typeof SlackBotMentionGate>[0]> = {},
+  identity: { botId?: string; botUserId?: string } = {
+    botId: "BSELF",
+    botUserId: "USELF",
+  }
+): SlackBotMentionGate {
+  return new SlackBotMentionGate(
+    { allowFrom: ["BLASSO"], ...options },
+    identity,
+    { log: { info() {}, warn() {}, error() {}, debug() {}, write() {} } }
+  );
+}
+
+describe("delegation metadata", () => {
+  it("round-trips build → parse", () => {
+    const metadata = buildDelegationMetadata({
+      depth: 2,
+      fromAgent: "lasso",
+      originSessionId: "sess-1",
+    });
+    expect(metadata.event_type).toBe(SLACK_DELEGATION_METADATA_EVENT_TYPE);
+    const parsed = parseDelegationMetadata({ metadata });
+    expect(parsed).toEqual({
+      depth: 2,
+      fromAgent: "lasso",
+      originSessionId: "sess-1",
+    });
+  });
+
+  it("ignores foreign and malformed metadata", () => {
+    expect(parseDelegationMetadata({})).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: { event_type: "other", event_payload: { depth: 1 } },
+      })
+    ).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: {
+          event_type: SLACK_DELEGATION_METADATA_EVENT_TYPE,
+          event_payload: { depth: 0 },
+        },
+      })
+    ).toBeUndefined();
+    expect(
+      parseDelegationMetadata({
+        metadata: {
+          event_type: SLACK_DELEGATION_METADATA_EVENT_TYPE,
+          event_payload: { depth: "two" },
+        },
+      })
+    ).toBeUndefined();
+  });
+});
+
+describe("botMentionsFromEnv", () => {
+  it("returns undefined when unset and options when set", () => {
+    const envVar = "BOT_MENTIONS_TEST_VAR";
+    delete process.env[envVar];
+    expect(botMentionsFromEnv(envVar)).toBeUndefined();
+    process.env[envVar] = " B1 ,,U2 ";
+    expect(botMentionsFromEnv(envVar)).toEqual({ allowFrom: ["B1", "U2"] });
+    delete process.env[envVar];
+  });
+});
+
+describe("parseAppMentionEvent bot-authored", () => {
+  const body = {
+    type: "event_callback",
+    team_id: "T1",
+    event: {
+      type: "app_mention",
+      user: "ULASSO",
+      bot_id: "BLASSO",
+      text: "<@UTARGET> look into this",
+      ts: "2.0",
+      thread_ts: "1.0",
+      channel: "C9",
+      metadata: buildDelegationMetadata({ depth: 1, fromAgent: "lasso" }),
+    },
+  };
+
+  it("drops bot mentions by default", () => {
+    expect(parseAppMentionEvent(body)).toBeNull();
+  });
+
+  it("keeps bot mentions with delegation info when opted in", () => {
+    const message = parseAppMentionEvent(body, { includeBotAuthored: true });
+    expect(message).not.toBeNull();
+    expect(message?.author?.isBot).toBe(true);
+    expect(message?.author?.botId).toBe("BLASSO");
+    expect(message?.delegation).toEqual({ depth: 1, fromAgent: "lasso" });
+  });
+
+  it("still parses human mentions when opted in", () => {
+    const message = parseAppMentionEvent(
+      {
+        type: "event_callback",
+        event: {
+          type: "app_mention",
+          user: "U1",
+          text: "<@UTARGET> hi",
+          ts: "3.0",
+          channel: "C9",
+        },
+      },
+      { includeBotAuthored: true }
+    );
+    expect(message?.author?.isBot).toBe(false);
+    expect(message?.delegation).toBeUndefined();
+  });
+});
+
+describe("normalizeBotMentionAllowlist", () => {
+  it("trims entries and rejects empty lists", () => {
+    expect(normalizeBotMentionAllowlist([" B1 ", "U2"])).toEqual(["B1", "U2"]);
+    expect(() => normalizeBotMentionAllowlist([" "])).toThrow(/allowFrom/);
+  });
+});
+
+describe("SlackBotMentionGate", () => {
+  it("requires its own bot identity", () => {
+    expect(() => gate({}, {})).toThrow(/identity/);
+  });
+
+  it("admits an allowlisted bot mention", () => {
+    const verdict = gate().evaluate(botMention());
+    expect(verdict).toEqual({ allow: true, depth: 1 });
+  });
+
+  it("matches on bot user id as well as bot_id", () => {
+    const verdict = gate({ allowFrom: ["ULASSO"] }).evaluate(botMention());
+    expect(verdict.allow).toBe(true);
+  });
+
+  it("matches compound botId:username entries case-insensitively", () => {
+    const g = gate({ allowFrom: ["BCURSOR:Lasso"] });
+    const fromCursorAsLasso = botMention({
+      author: {
+        userId: "UCURSOR",
+        isBot: true,
+        botId: "BCURSOR",
+        userName: "lasso",
+      },
+    });
+    expect(g.evaluate(fromCursorAsLasso).allow).toBe(true);
+  });
+
+  it("compound entries deny other usernames and missing usernames", () => {
+    const g = gate({ allowFrom: ["BCURSOR:Lasso"] });
+    expect(
+      g.evaluate(
+        botMention({
+          author: {
+            userId: "UCURSOR",
+            isBot: true,
+            botId: "BCURSOR",
+            userName: "SomeOtherAgent",
+          },
+        })
+      )
+    ).toMatchObject({ allow: false });
+    // No username on the event → fail closed.
+    expect(
+      g.evaluate(
+        botMention({
+          author: { userId: "UCURSOR", isBot: true, botId: "BCURSOR" },
+        })
+      )
+    ).toMatchObject({ allow: false });
+    // Bare bot_id was not allowlisted, only the compound form.
+    expect(
+      g.evaluate(
+        botMention({
+          author: {
+            userId: "UCURSOR",
+            isBot: true,
+            botId: "BCURSOR",
+            userName: undefined,
+          },
+        })
+      )
+    ).toMatchObject({ allow: false });
+  });
+
+  it("denies bots not in the allowlist", () => {
+    const verdict = gate().evaluate(
+      botMention({ author: { userId: "UOTHER", isBot: true, botId: "BOTHER" } })
+    );
+    expect(verdict).toMatchObject({ allow: false });
+  });
+
+  it("denies its own posts even when allowlisted", () => {
+    const verdict = gate({ allowFrom: ["BSELF"] }).evaluate(
+      botMention({ author: { userId: "USELF", isBot: true, botId: "BSELF" } })
+    );
+    expect(verdict).toMatchObject({ allow: false, reason: /own post/ });
+  });
+
+  it("enforces the depth budget", () => {
+    const g = gate();
+    expect(g.evaluate(botMention({ delegation: { depth: 2 } })).allow).toBe(
+      true
+    );
+    expect(
+      g.evaluate(botMention({ ts: "3.0", delegation: { depth: 3 } }))
+    ).toMatchObject({ allow: false, reason: /depth/ });
+  });
+
+  it("enforces the rate budget with a sliding window", () => {
+    const g = gate({ maxPerThreadPerHour: 2 });
+    expect(g.evaluate(botMention(), 1000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 2000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 3000)).toMatchObject({
+      allow: false,
+      reason: /rate budget/,
+    });
+    // Window slides: an hour later the thread has rate budget again.
+    const later = 3000 + 60 * 60 * 1000;
+    expect(g.evaluate(botMention(), later).allow).toBe(true);
+    // Other threads are unaffected.
+    expect(g.evaluate(botMention({ threadTs: "9.0" }), 3000).allow).toBe(true);
+  });
+
+  it("terminates ping-pong with the lifetime thread cap", () => {
+    const g = gate({ maxPerThreadPerHour: 100, maxPerThreadTotal: 3 });
+    expect(g.evaluate(botMention(), 1000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 2000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 3000).allow).toBe(true);
+    expect(g.evaluate(botMention(), 4000)).toMatchObject({
+      allow: false,
+      reason: /lifetime/,
+    });
+    // Sliding the window does NOT refill the lifetime cap.
+    const muchLater = 4000 + 5 * 60 * 60 * 1000;
+    expect(g.evaluate(botMention(), muchLater)).toMatchObject({
+      allow: false,
+      reason: /lifetime/,
+    });
+  });
+});

package/src/channels/slack/channel-watch.test.ts

@@ -0,0 +1,363 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  createChannelPostWatcher,
+  SlackChannelAllowlist,
+} from "./channel-watch.js";
+import {
+  parseChannelMessageEvent,
+  type SlackChannelMessageEvent,
+} from "./inbound.js";
+import type { SlackMessage } from "./types.js";
+
+function channelPostBody(args: {
+  channel?: string;
+  ts?: string;
+  threadTs?: string;
+  text?: string;
+  subtype?: string;
+  botId?: string;
+  channelType?: string;
+  user?: string | null;
+}): unknown {
+  return {
+    type: "event_callback",
+    event_id: "Ev1",
+    team_id: "T1",
+    event: {
+      type: "message",
+      channel: args.channel ?? "C123",
+      channel_type: args.channelType ?? "channel",
+      ts: args.ts ?? "100.1",
+      ...(args.threadTs === undefined ? {} : { thread_ts: args.threadTs }),
+      text: args.text ?? "new bug report",
+      ...(args.user === null ? {} : { user: args.user ?? "U1" }),
+      ...(args.subtype === undefined ? {} : { subtype: args.subtype }),
+      ...(args.botId === undefined ? {} : { bot_id: args.botId }),
+    },
+  };
+}
+
+describe("parseChannelMessageEvent", () => {
+  it("parses a top-level channel post", () => {
+    const parsed = parseChannelMessageEvent(channelPostBody({}));
+    expect(parsed).not.toBeNull();
+    expect(parsed?.kind).toBe("post");
+    if (parsed?.kind === "post") {
+      expect(parsed.message.channelId).toBe("C123");
+      expect(parsed.message.ts).toBe("100.1");
+      expect(parsed.message.threadTs).toBe("100.1");
+    }
+  });
+
+  it("parses private-channel (group) posts", () => {
+    const parsed = parseChannelMessageEvent(
+      channelPostBody({ channel: "G9", channelType: "group" })
+    );
+    expect(parsed?.kind).toBe("post");
+  });
+
+  it("drops bot-authored posts", () => {
+    expect(
+      parseChannelMessageEvent(channelPostBody({ botId: "B77" }))
+    ).toBeNull();
+  });
+
+  it("keeps bot-authored posts when includeBotAuthored is set", () => {
+    const parsed = parseChannelMessageEvent(channelPostBody({ botId: "B77" }), {
+      includeBotAuthored: true,
+    });
+    expect(parsed?.kind).toBe("post");
+    if (parsed?.kind === "post") {
+      expect(parsed.message.author?.isBot).toBe(true);
+      expect(parsed.message.author?.botId).toBe("B77");
+    }
+  });
+
+  it("keeps userless bot_message webhook posts when includeBotAuthored is set", () => {
+    const body = channelPostBody({
+      botId: "B77",
+      subtype: "bot_message",
+      user: null,
+      text: "PagerDuty: high error rate on api",
+    });
+    expect(parseChannelMessageEvent(body)).toBeNull();
+    const parsed = parseChannelMessageEvent(body, {
+      includeBotAuthored: true,
+    });
+    expect(parsed?.kind).toBe("post");
+    if (parsed?.kind === "post") {
+      expect(parsed.message.author).toEqual({
+        userId: "",
+        isBot: true,
+        botId: "B77",
+      });
+    }
+  });
+
+  it("recovers alert content from attachments when top-level text is empty", () => {
+    const parsed = parseChannelMessageEvent(
+      {
+        type: "event_callback",
+        team_id: "T1",
+        event: {
+          type: "message",
+          subtype: "bot_message",
+          channel: "C123",
+          channel_type: "channel",
+          ts: "100.1",
+          bot_id: "B77",
+          username: "Datadog",
+          text: "",
+          attachments: [
+            {
+              title:
+                "Triggered: [service-monitor prod:temporal-bugbot] High cache error rate",
+              title_link: "https://us5.datadoghq.com/monitors/19610160",
+              text: "Service temporal-bugbot has a high cache error rate.",
+            },
+          ],
+        },
+      },
+      { includeBotAuthored: true }
+    );
+    expect(parsed?.kind).toBe("post");
+    if (parsed?.kind === "post") {
+      expect(parsed.message.text).toBe("");
+      expect(parsed.message.body).toContain("temporal-bugbot");
+      // Raw body keeps the monitor link; markdown is the model-facing view.
+      expect(parsed.message.body).toContain(
+        "https://us5.datadoghq.com/monitors/19610160"
+      );
+      expect(parsed.message.markdown).toContain("High cache error rate");
+    }
+  });
+
+  it("drops DMs and unknown subtypes", () => {
+    expect(
+      parseChannelMessageEvent(
+        channelPostBody({ channel: "D5", channelType: "im" })
+      )
+    ).toBeNull();
+    expect(
+      parseChannelMessageEvent(channelPostBody({ subtype: "channel_join" }))
+    ).toBeNull();
+  });
+
+  it("parses message_changed into an edit with the new text", () => {
+    const parsed = parseChannelMessageEvent({
+      type: "event_callback",
+      event: {
+        type: "message",
+        subtype: "message_changed",
+        channel: "C123",
+        channel_type: "channel",
+        ts: "101.0",
+        message: { type: "message", ts: "100.1", text: "edited!", user: "U1" },
+      },
+    });
+    expect(parsed?.kind).toBe("edited");
+    if (parsed?.kind === "edited") {
+      expect(parsed.message.ts).toBe("100.1");
+      expect(parsed.message.text).toBe("edited!");
+    }
+  });
+
+  it("parses message_deleted into a deletion", () => {
+    const parsed = parseChannelMessageEvent({
+      type: "event_callback",
+      event: {
+        type: "message",
+        subtype: "message_deleted",
+        channel: "C123",
+        channel_type: "channel",
+        ts: "101.0",
+        deleted_ts: "100.1",
+      },
+    });
+    expect(parsed).toEqual({ kind: "deleted", channelId: "C123", ts: "100.1" });
+  });
+});
+
+describe("SlackChannelAllowlist", () => {
+  it("matches ids directly and names after resolution", () => {
+    const allowlist = new SlackChannelAllowlist(["C123", "#issues-glass"]);
+    expect(allowlist.matches("C123")).toBe(true);
+    expect(allowlist.matches("C999")).toBe(false);
+    expect(allowlist.unresolvedNames()).toEqual(["issues-glass"]);
+    allowlist.applyResolvedNames(new Map([["issues-glass", "C999"]]));
+    expect(allowlist.matches("C999")).toBe(true);
+  });
+
+  it("treats bare names as names, not ids", () => {
+    const allowlist = new SlackChannelAllowlist(["issues-glass"]);
+    expect(allowlist.unresolvedNames()).toEqual(["issues-glass"]);
+  });
+});
+
+describe("createChannelPostWatcher", () => {
+  const dispatched: Array<{ message: SlackMessage; eventId?: string }> = [];
+
+  function watcher(args?: {
+    posts?: "top-level" | "all";
+    debounceMs?: number;
+    includeBotPosts?: boolean;
+    botUserId?: string;
+    botId?: string;
+    allow?: string[];
+  }) {
+    return createChannelPostWatcher({
+      options: {
+        allow: args?.allow ?? ["C123"],
+        ...(args?.posts === undefined ? {} : { posts: args.posts }),
+        ...(args?.debounceMs === undefined
+          ? {}
+          : { debounceMs: args.debounceMs }),
+        ...(args?.includeBotPosts === undefined
+          ? {}
+          : { includeBotPosts: args.includeBotPosts }),
+      },
+      allowlist: new SlackChannelAllowlist(args?.allow ?? ["C123"]),
+      getBotUserId: () => args?.botUserId,
+      getBotId: () => args?.botId,
+      dispatch: (message, eventId) =>
+        dispatched.push(
+          eventId === undefined ? { message } : { message, eventId }
+        ),
+    });
+  }
+
+  function post(args: {
+    channel?: string;
+    ts?: string;
+    threadTs?: string;
+    text?: string;
+    subtype?: string;
+    botId?: string;
+    user?: string | null;
+  }): SlackChannelMessageEvent {
+    const parsed = parseChannelMessageEvent(channelPostBody(args), {
+      includeBotAuthored: true,
+    });
+    if (parsed === null) {
+      throw new Error("fixture did not parse");
+    }
+    return parsed;
+  }
+
+  beforeEach(() => {
+    dispatched.length = 0;
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("dispatches allowlisted top-level posts immediately by default", () => {
+    const w = watcher();
+    expect(w.handle(post({}), "Ev1")).toBe(true);
+    expect(dispatched).toHaveLength(1);
+    expect(dispatched[0]?.eventId).toBe("Ev1");
+  });
+
+  it("skips channels outside the allowlist", () => {
+    const w = watcher();
+    w.handle(post({ channel: "C999" }));
+    expect(dispatched).toHaveLength(0);
+  });
+
+  it("skips thread replies unless posts is 'all'", () => {
+    const w = watcher();
+    w.handle(post({ ts: "100.2", threadTs: "100.1" }));
+    expect(dispatched).toHaveLength(0);
+
+    const all = watcher({ posts: "all" });
+    all.handle(post({ ts: "100.2", threadTs: "100.1" }));
+    expect(dispatched).toHaveLength(1);
+  });
+
+  it("skips posts that mention the bot (app_mention path owns them)", () => {
+    const w = watcher({ botUserId: "UBOT" });
+    w.handle(post({ text: "<@UBOT> please triage" }));
+    expect(dispatched).toHaveLength(0);
+  });
+
+  it("skips bot-authored posts unless includeBotPosts is set", () => {
+    const w = watcher();
+    w.handle(post({ botId: "B77", user: null, subtype: "bot_message" }));
+    expect(dispatched).toHaveLength(0);
+
+    const withBots = watcher({
+      includeBotPosts: true,
+      botId: "BSELF",
+      botUserId: "UBOT",
+    });
+    withBots.handle(post({ botId: "B77", user: null, subtype: "bot_message" }));
+    expect(dispatched).toHaveLength(1);
+    expect(dispatched[0]?.message.author?.botId).toBe("B77");
+  });
+
+  it("skips bot-authored posts when includeBotPosts is on but bot identity is unknown", () => {
+    const w = watcher({ includeBotPosts: true });
+    w.handle(post({ botId: "B77", user: null, subtype: "bot_message" }));
+    expect(dispatched).toHaveLength(0);
+  });
+
+  it("always skips the watching bot's own posts (loop safety)", () => {
+    const w = watcher({
+      includeBotPosts: true,
+      botUserId: "UBOT",
+      botId: "BSELF",
+    });
+    w.handle(post({ botId: "BSELF", user: null, subtype: "bot_message" }));
+    expect(dispatched).toHaveLength(0);
+
+    // Same app posting with its bot user id attached.
+    w.handle(post({ botId: "B99", user: "UBOT" }));
+    expect(dispatched).toHaveLength(0);
+
+    // A different bot still dispatches.
+    w.handle(post({ botId: "B77", user: null, subtype: "bot_message" }));
+    expect(dispatched).toHaveLength(1);
+  });
+
+  it("debounces: edits update the pending text, deletes cancel", () => {
+    vi.useFakeTimers();
+    const w = watcher({ debounceMs: 1_000 });
+
+    w.handle(post({ ts: "100.1", text: "first" }));
+    expect(dispatched).toHaveLength(0);
+    const edit = parseChannelMessageEvent({
+      type: "event_callback",
+      event: {
+        type: "message",
+        subtype: "message_changed",
+        channel: "C123",
+        channel_type: "channel",
+        ts: "101.0",
+        message: { type: "message", ts: "100.1", text: "edited", user: "U1" },
+      },
+    });
+    if (edit === null) {
+      throw new Error("edit fixture did not parse");
+    }
+    w.handle(edit);
+    vi.advanceTimersByTime(1_000);
+    expect(dispatched).toHaveLength(1);
+    expect(dispatched[0]?.message.text).toBe("edited");
+
+    w.handle(post({ ts: "200.1", text: "will be deleted" }));
+    w.handle({ kind: "deleted", channelId: "C123", ts: "200.1" });
+    vi.advanceTimersByTime(5_000);
+    expect(dispatched).toHaveLength(1);
+
+    w.stop();
+  });
+
+  it("stop() cancels pending dispatches", () => {
+    vi.useFakeTimers();
+    const w = watcher({ debounceMs: 1_000 });
+    w.handle(post({}));
+    w.stop();
+    vi.advanceTimersByTime(5_000);
+    expect(dispatched).toHaveLength(0);
+  });
+});