@cursor/july 0.1.26 → 0.1.28

package/docs/guides/webhooks.md

@@ -177,6 +177,189 @@ swaps the default for `bearerAuth` on every channel that doesn't author
 its own chain, and `--allow-anonymous` swaps it for `allowAll()`
 (trusted networks only). Authored `auth` arrays always win over both.
 
+## Example: Linear as the control plane
+
+Everything above composes into a working ticket-driven agent. This
+example wires Linear to the agent: new issues and comments start or
+resume sessions, and replies land back on the issue as comments. The
+same shape works for any tracker with signed webhooks.
+
+Create the webhook in Linear under Settings → API → "New webhook",
+pointed at `https://<your-host>/<slug>/v1/channels/linear`, and copy
+the signing secret. Linear requires a public HTTPS URL, so use a
+tunnel during local development or test with signed fixtures (below).
+Set three environment variables:
+
+```bash
+LINEAR_WEBHOOK_SECRET=lin_wh_...   # the webhook's signing secret
+LINEAR_API_KEY=lin_api_...         # posts replies as comments
+LINEAR_AGENT_USER_ID=...           # the API key's user: query { viewer { id } }
+```
+
+`LINEAR_AGENT_USER_ID` matters: replies posted with the API key
+trigger the Comment webhook again, so the channel must recognize and
+skip its own comments. Without the guard, every reply starts another
+turn.
+
+Author `agent/channels/linear.ts`:
+
+```ts
+import { Buffer } from "node:buffer";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { allowAll, defineChannel, POST } from "@cursor/july/channels";
+import { z } from "zod";
+
+const secret = process.env.LINEAR_WEBHOOK_SECRET ?? "";
+const apiKey = process.env.LINEAR_API_KEY ?? "";
+const agentUserId = process.env.LINEAR_AGENT_USER_ID ?? "";
+
+interface LinearWebhook {
+  action: string;
+  type: string;
+  url?: string;
+  webhookTimestamp: number;
+  data: {
+    id: string;
+    title?: string;
+    description?: string;
+    body?: string;
+    issueId?: string;
+    userId?: string;
+  };
+}
+
+// Linear signs the raw body: hex HMAC-SHA256 in `Linear-Signature`.
+function verified(rawBody: string, header: string | null): boolean {
+  if (secret === "" || header === null) {
+    return false;
+  }
+  const expected = createHmac("sha256", secret).update(rawBody).digest();
+  const received = Buffer.from(header, "hex");
+  return (
+    received.length === expected.length && timingSafeEqual(received, expected)
+  );
+}
+
+async function postComment(issueId: string, body: string): Promise<void> {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: apiKey },
+    body: JSON.stringify({
+      query:
+        "mutation($input: CommentCreateInput!) { commentCreate(input: $input) { success } }",
+      variables: { input: { issueId, body } },
+    }),
+  });
+  if (!response.ok) {
+    throw new Error(`commentCreate failed: ${response.status}`);
+  }
+}
+
+function issueIdFromToken(token: string | null): string | null {
+  if (token === null || !token.startsWith("linear:")) {
+    return null;
+  }
+  return token.slice("linear:".length);
+}
+
+export default defineChannel({
+  // The HMAC check is the request auth, so admit everything at the route.
+  auth: [allowAll()],
+  routes: [
+    POST("/", {
+      description: "Linear webhook ingress",
+      // The payload shape varies by `Linear-Event`; parse after verifying.
+      bodySchema: z.unknown(),
+      handler: async (request, { send, waitUntil }) => {
+        const rawBody = await request.text();
+        if (!verified(rawBody, request.headers.get("linear-signature"))) {
+          return Response.json({ ok: false }, { status: 401 });
+        }
+        const event = JSON.parse(rawBody) as LinearWebhook;
+        // Reject stale deliveries to guard against replay.
+        if (Math.abs(Date.now() - event.webhookTimestamp) > 60_000) {
+          return Response.json({ ok: false }, { status: 401 });
+        }
+        // Skip the agent's own comments so replies don't re-trigger it.
+        if (event.type === "Comment" && event.data.userId === agentUserId) {
+          return Response.json({ ok: true });
+        }
+
+        // New issue → new session. New comment → follow-up on the same
+        // session, keyed by issue id through the continuation token.
+        let issueId: string | undefined;
+        let message: string | undefined;
+        if (event.type === "Issue" && event.action === "create") {
+          issueId = event.data.id;
+          message = `New Linear issue: ${event.data.title}\n\n${
+            event.data.description ?? ""
+          }\n${event.url ?? ""}`;
+        } else if (event.type === "Comment" && event.action === "create") {
+          issueId = event.data.issueId;
+          message = event.data.body;
+        }
+        if (issueId === undefined || message === undefined) {
+          return Response.json({ ok: true });
+        }
+
+        // Linear retries on any non-200 and times out after five
+        // seconds: ACK now, run the turn in the background.
+        waitUntil(send(message, { continuationToken: `linear:${issueId}` }));
+        return Response.json({ ok: true });
+      },
+    }),
+  ],
+  events: {
+    async "message.completed"(event, channel) {
+      if (event.data.finishReason === "tool_call" || event.data.text === "") {
+        return;
+      }
+      const issueId = issueIdFromToken(channel.continuationToken);
+      if (issueId !== null) {
+        await postComment(issueId, event.data.text);
+      }
+    },
+    async "turn.failed"(event, channel) {
+      const issueId = issueIdFromToken(channel.continuationToken);
+      if (issueId !== null) {
+        await postComment(issueId, `Turn failed: ${event.data.message}`);
+      }
+    },
+  },
+});
+```
+
+The channel handles ingress and reply delivery deterministically. To
+let the model read and update Linear during the turn (search related
+issues, change state, assign), add the Linear MCP connection alongside
+it:
+
+```ts
+// agent/mcp-connections/linear.ts
+import { defineConnection } from "@cursor/july/connections";
+
+// Uses the signed-in Cursor account's Linear connector.
+export default defineConnection({ cursorAccount: true, servers: ["Linear"] });
+```
+
+See [MCP connections](../reference/connections.md) for the direct
+`https://mcp.linear.app/mcp` form when the host isn't signed in to
+Cursor.
+
+To test without a public URL, save a payload from the webhook's
+delivery log (or the sample in
+[Linear's webhook docs](https://linear.app/developers/webhooks)) under
+`fixtures/`, refresh its `webhookTimestamp`, and sign it yourself:
+
+```bash
+SIG=$(node -e 'const {createHmac}=require("node:crypto");const fs=require("node:fs");
+process.stdout.write(createHmac("sha256",process.env.LINEAR_WEBHOOK_SECRET)
+  .update(fs.readFileSync("fixtures/issue-create.json")).digest("hex"))')
+curl -X POST http://127.0.0.1:3000/<slug>/v1/channels/linear/ \
+  -H 'content-type: application/json' -H "linear-signature: $SIG" \
+  --data-binary @fixtures/issue-create.json
+```
+
 ## Test a channel
 
 Start with curl and saved payloads under `fixtures/`. The playground's

package/docs/reference/channels.md

@@ -174,7 +174,8 @@ declares `[localDevStrict()]` stays loopback-only even on an
 ## First class channels
 
 **Slack** (`@cursor/july/channels/slack`): Socket Mode
-transport, streaming replies, engagement rules, approval cards. Author
+transport, streaming replies, engagement rules, approval cards, and a
+default block on Slack Connect / guest / other-workspace senders. Author
 `agent/channels/slack.ts` with `slackChannel()`. Guide:
 [Slack](../guides/slack.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cursor/july",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {
@@ -190,6 +190,24 @@
       "default": "./package.json"
     }
   },
+  "scripts": {
+    "build": "tsgo -p tsconfig.build.json && pnpm run build:playground && pnpm run docs:build",
+    "build:playground": "vite build --config playground/vite.config.ts",
+    "build:playground:central": "vite build --mode central --config playground/vite.config.ts",
+    "dev:playground": "vite --config playground/vite.config.ts",
+    "check": "biome check src && tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",
+    "docs:dev": "vitepress dev docs",
+    "docs:build": "vitepress build docs",
+    "docs:preview": "vitepress preview docs",
+    "fix": "biome check --write --unsafe src",
+    "test": "vitest run --passWithNoTests",
+    "type-check": "tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",
+    "build-dev": "echo noop",
+    "build-types": "tsgo -p tsconfig.build.json --emitDeclarationOnly",
+    "verify-publish": "node scripts/verify-publish-artifacts.mjs",
+    "smoke-publish": "node scripts/smoke-publish-artifact.mjs",
+    "publish-check": "pnpm run build && pnpm run verify-publish && pnpm run smoke-publish"
+  },
   "engines": {
     "node": ">=22.13"
   },
@@ -209,13 +227,14 @@
     "zod-to-json-schema": "^3.24.5"
   },
   "devDependencies": {
-    "@base-ui/react": "1.4.0",
+    "@anysphere/ui": "workspace:*",
+    "@base-ui/react": "1.6.0",
     "@stylexjs/stylex": "0.18.3",
-    "@stylexswc/rs-compiler": "^0.16.4",
+    "@stylexswc/rs-compiler": "^0.18.0",
     "@tanstack/react-virtual": "3.13.23",
     "@types/js-yaml": "4.0.9",
     "@types/ms": "^2.1.0",
-    "@types/node": "22.14.1",
+    "@types/node": "catalog:",
     "@types/pg": "^8.16.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
@@ -228,29 +247,10 @@
     "react-markdown": "^10.1.0",
     "rehype-highlight": "^7.0.2",
     "remark-gfm": "^4.0.1",
-    "typescript": "^5.8.0",
+    "typescript": "catalog:",
     "vite": "^7.3.0",
     "vitepress": "1.6.4",
     "vitest": "^4.0.18",
-    "zustand": "^5.0.9",
-    "@anysphere/ui": "1.0.0"
-  },
-  "scripts": {
-    "build": "tsgo -p tsconfig.build.json && pnpm run build:playground && pnpm run docs:build",
-    "build:playground": "vite build --config playground/vite.config.ts",
-    "build:playground:central": "vite build --mode central --config playground/vite.config.ts",
-    "dev:playground": "vite --config playground/vite.config.ts",
-    "check": "biome check src && tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",
-    "docs:dev": "vitepress dev docs",
-    "docs:build": "vitepress build docs",
-    "docs:preview": "vitepress preview docs",
-    "fix": "biome check --write --unsafe src",
-    "test": "vitest run --passWithNoTests",
-    "type-check": "tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",
-    "build-dev": "echo noop",
-    "build-types": "tsgo -p tsconfig.build.json --emitDeclarationOnly",
-    "verify-publish": "node scripts/verify-publish-artifacts.mjs",
-    "smoke-publish": "node scripts/smoke-publish-artifact.mjs",
-    "publish-check": "pnpm run build && pnpm run verify-publish && pnpm run smoke-publish"
+    "zustand": "^5.0.9"
   }
-}
+}

package/skills/setup-slack/SKILL.md

@@ -97,6 +97,9 @@ export default slackChannel({
 single token — string literals with spaces fail typecheck; runtime
 values throw at construction/serve. Names must be unique on the host;
 an unmatched `@Cursor <name>` stays with Cursor's normal Slack agent.
+External senders (Slack Connect / guests / other workspaces) are
+blocked by default; see `policy.blockExternals` in
+[docs/guides/slack.md](../../docs/guides/slack.md).
 
 ### A2 — Sign in + serve (agent)
 

package/src/ab.ts

@@ -78,6 +78,12 @@ export interface ABMetrics {
   outputTokens: number;
   cacheReadTokens: number;
   cacheWriteTokens: number;
+  /**
+   * Sum of estimated turn costs in USD (the `cost.totalUsd` recorded on
+   * `turn.completed` events). Turns whose model has no known rates
+   * contribute 0.
+   */
+  costUsd: number;
   /** Sum of turn wall times (turn.started → turn.completed/failed). */
   wallTimeMs: number;
   /** Custom counters from {@link ABConfig.derive}. */
@@ -315,6 +321,7 @@ export function emptyABMetrics(): ABMetrics {
     outputTokens: 0,
     cacheReadTokens: 0,
     cacheWriteTokens: 0,
+    costUsd: 0,
     wallTimeMs: 0,
     custom: {},
   };

package/src/bin/agent-serve.ts

@@ -29,6 +29,7 @@ import {
   type AxCliOptions,
   cmdCall,
   cmdChat,
+  cmdCost,
   cmdEval,
   cmdEvalCancel,
   cmdEvalStatus,
@@ -55,6 +56,7 @@ import {
 } from "../internal/cli-deploy.js";
 import {
   CLI_COMMAND_NAME as CLI,
+  PACKAGE_NAME,
   packageVersion,
 } from "../internal/distribution.js";
 import { loadAgentLocalEnv } from "../internal/local-env.js";
@@ -83,7 +85,9 @@ Usage:
   ${CLI} sessions    [--url <baseUrl> | --prod] [--json]
                           [--slug <slug>] [--team <id>] [--dir <path>]
   ${CLI} session     <sessionId> [--url <baseUrl> | --prod]
-                          [--json | --text | --events]
+                          [--json | --text | --events] [--out <file.ndjson>]
+                          [--slug <slug>] [--team <id>] [--dir <path>]
+  ${CLI} cost        [sessionId] [--url <baseUrl> | --prod] [--json]
                           [--slug <slug>] [--team <id>] [--dir <path>]
   ${CLI} playground  [--url <baseUrl> | --prod] [--session <id>] [--print]
                           [--slug <slug>] [--team <id>] [--dir <path>]
@@ -106,11 +110,12 @@ Usage:
                           [--tag <tag>]... [--verbose] [--timeout-ms <n>]
                           [--strict] [--max-concurrency <n>]
                           [--junit <path>] [--artifacts <dir>|--no-artifacts]
+                          [--out <file.json>]
                           [--skip-report] [--no-stream] [--no-wait]
                           [--prod | --url <baseUrl>] [--slug <slug>]
                           [--team <id>]
   ${CLI} eval status [runId] --prod|--url <baseUrl> [--dir <path>] [--json]
-                          [--slug <slug>] [--team <id>]
+                          [--out <file.json>] [--slug <slug>] [--team <id>]
   ${CLI} eval cancel <runId> --prod|--url <baseUrl> [--dir <path>] [--json]
                           [--slug <slug>] [--team <id>]
   ${CLI} info        [--dir <path>] [--json]
@@ -161,6 +166,10 @@ Commands:
   session     Show one session. Default: text trajectory. --json for trajectory
               JSON; --events for the raw event list. To continue interactively,
               use \`${CLI} resume [id]\`.
+  cost        Pull cost metrics. With a session id: per-turn token usage and
+              estimated cost for that session. Without one: one row per
+              session plus a total. Costs are the engine's recorded estimates
+              from turn.completed events; --json for machine-readable reports.
   playground  Open the web playground. --prod starts a loopback proxy that
               injects hosted engine credentials (browsers cannot set them).
               --print skips opening a browser. Ctrl-C stops the proxy.
@@ -384,7 +393,11 @@ Options:
   --comment          github replay: comment body for comment events.
   --context          github replay: commit-status context.
   --dry-run          github replay: print synthesized payloads, don't POST.
-  --out              github replay: write synthesized payloads as fixtures.
+  --out              eval / eval status <runId>: also write the full results
+                     JSON to this path. session: write the raw NDJSON trace
+                     there instead of printing (same format as run --events;
+                     playground-openable). github replay: write synthesized
+                     payloads as fixtures.
 `;
 
 async function main(argv: string[]): Promise<number> {
@@ -767,6 +780,7 @@ async function main(argv: string[]): Promise<number> {
             apiKey: values["api-key"],
             slug: values.slug,
             bearerToken: values["bearer-token"],
+            out: values.out,
           })
         );
       }
@@ -811,6 +825,7 @@ async function main(argv: string[]): Promise<number> {
           artifacts: values["no-artifacts"] ? false : values.artifacts,
           skipReport: values["skip-report"],
           maxConcurrency: parseMaxConcurrency(values["max-concurrency"]),
+          out: values.out,
         })
       );
     }
@@ -904,6 +919,23 @@ async function main(argv: string[]): Promise<number> {
           json: values.json,
           text: values.text,
           rawEvents: values["raw-events"],
+          out: values.out,
+        })
+      );
+    }
+
+    case "cost": {
+      return cmdCost(
+        positionals[0] ?? values["session-id"] ?? values.session,
+        axFromOptions({
+          dir,
+          url: values.url,
+          prod: values.prod,
+          team: values.team,
+          apiKey: values["api-key"],
+          slug: values.slug,
+          bearerToken: values["bearer-token"],
+          json: values.json,
         })
       );
     }
@@ -1267,6 +1299,7 @@ function axFromOptions(
     artifacts: partial.artifacts,
     skipReport: partial.skipReport,
     maxConcurrency: partial.maxConcurrency,
+    out: partial.out,
   };
 }
 
@@ -1383,11 +1416,15 @@ function printServeBanner(
 ): void {
   const c = stdoutPalette();
   const agents = handle.agents;
+  // Name the framework build in the boot line: hosted engines install the
+  // published package at provision time, so the serve log is the only
+  // durable record of which build a deployment's turns actually ran on.
+  const versionTag = c.dim(`(${PACKAGE_NAME} ${packageVersion()})`);
   if (agents.length > 1) {
-    process.stdout.write(`${agents.length} agents listening\n`);
+    process.stdout.write(`${agents.length} agents listening ${versionTag}\n`);
   } else {
     const info = projectInfo(agents[0]?.project ?? handle.project);
-    process.stdout.write(`${info.name} listening\n`);
+    process.stdout.write(`${info.name} listening ${versionTag}\n`);
   }
 
   const playgroundUrl = resolvePlaygroundBannerUrl(handle, opts.noPlayground);

package/src/channels/slack/auth.ts

@@ -4,29 +4,39 @@
 
 import { samePrincipal } from "../../internal/auth.js";
 import type { AuthContext } from "../../types.js";
-import type { SlackBinding, SlackBlockAction, SlackMessage } from "./types.js";
+import type {
+  SlackBinding,
+  SlackBlockAction,
+  SlackMessage,
+  SlackRespondTo,
+} from "./types.js";
 
-/**
- * Build a thread-scoped principal so any participant in the same Slack
- * thread can continue the session. The triggering user is preserved in
- * attributes for message context.
- */
-export function buildSlackAuthContext(args: {
+export type BuildSlackAuthArgs = {
   channelId: string;
   threadTs: string;
   teamId?: string;
   userId?: string;
   userName?: string;
   isBot?: boolean;
-  /**
-   * Engagement surface that started the session (e.g. `"channel_post"` for
-   * the opt-in channel watch). Recorded as an attribute; the principal stays
-   * thread-scoped so an @mention in the same thread continues the session.
-   */
   engagement?: string;
-}): AuthContext {
+  /** Defaults to `"thread"`. `"author"` appends `:{userId}` to the principal. */
+  respondTo?: SlackRespondTo;
+};
+
+/**
+ * Build a Slack session principal.
+ *
+ * - `"thread"` (default): any participant can continue.
+ * - `"author"`: only the starter (`…:{userId}`), same shape approvals already honor.
+ */
+export function buildSlackAuthContext(args: BuildSlackAuthArgs): AuthContext {
   const team = args.teamId ?? "unknown";
-  const principalId = `slack:${team}:${args.channelId}:${args.threadTs}`;
+  const respondTo = args.respondTo ?? "thread";
+  const base = `slack:${team}:${args.channelId}:${args.threadTs}`;
+  const authorScoped =
+    respondTo === "author" && args.userId !== undefined && args.userId !== "";
+  const principalId = authorScoped ? `${base}:${args.userId}` : base;
+
   const attributes: Record<string, string> = {
     channel_id: args.channelId,
     thread_ts: args.threadTs,
@@ -106,7 +116,7 @@ export function blockActionAuth(action: SlackBlockAction): AuthContext {
 export function defaultSlackAuth(
   message: SlackMessage,
   ctx: SlackBinding,
-  options?: { engagement?: string }
+  options?: { engagement?: string; respondTo?: SlackRespondTo }
 ): AuthContext | null {
   if (message.author === undefined) {
     return null;
@@ -114,14 +124,11 @@ export function defaultSlackAuth(
   return buildSlackAuthContext({
     channelId: ctx.slack.channelId,
     threadTs: ctx.slack.threadTs,
-    ...(message.teamId === undefined ? {} : { teamId: message.teamId }),
+    teamId: message.teamId,
     userId: message.author.userId,
-    ...(message.author.userName === undefined
-      ? {}
-      : { userName: message.author.userName }),
+    userName: message.author.userName,
     isBot: message.author.isBot,
-    ...(options?.engagement === undefined
-      ? {}
-      : { engagement: options.engagement }),
+    engagement: options?.engagement,
+    respondTo: options?.respondTo,
   });
 }

package/src/channels/slack/cursor-account.ts

@@ -172,6 +172,8 @@ export async function dispatchCursorSlackEnvelope(args: {
     log,
     evalCommandsEnabled: runtime.options.evalCommands !== false,
     cursorAgentName: envelope.agentName,
+    // Backend router already refused externals for this envelope.
+    blockExternals: false,
     ...(args.hasContinuationSession === undefined
       ? {}
       : { hasContinuationSession: args.hasContinuationSession }),

package/src/channels/slack/defaults.ts

@@ -20,9 +20,11 @@ import { createStreamDeliveryStrategy } from "./live-delivery.js";
 import { defaultSlackLog, type SlackLog } from "./log.js";
 import { buildTaskChunkForResult, buildTaskChunksForCalls } from "./stream.js";
 import type {
+  SlackAccessPolicy,
   SlackChannelState,
   SlackCredentials,
   SlackMessageHandler,
+  SlackRespondTo,
   SlackSuggestedPrompt,
 } from "./types.js";
 
@@ -30,6 +32,19 @@ const SLACK_TURN_FAILURE_FALLBACK =
   "I hit an error while handling your request. Please try again or rephrase.";
 const SLACK_TURN_FAILURE_MAX_CHARS = 400;
 
+export function resolveSlackRespondTo(
+  policy: SlackAccessPolicy | undefined
+): SlackRespondTo {
+  return policy?.respondTo === "author" ? "author" : "thread";
+}
+
+/** Defaults to true when omitted. */
+export function resolveSlackBlockExternals(
+  policy: SlackAccessPolicy | undefined
+): boolean {
+  return policy?.blockExternals !== false;
+}
+
 /** Scrubbed turn.failed body for Slack (secrets / paths / URLs stripped). */
 export function formatSlackTurnFailureMessage(raw: string | undefined): string {
   const scrubbed = scrubSlackErrorDetail(raw?.trim() ?? "");
@@ -68,29 +83,34 @@ function resolveLoadingMessages(
 
 /** Default mention/DM inbound handler (optional custom loading rotation). */
 export function createDefaultOnInbound(
-  loadingMessages?: readonly string[]
+  loadingMessages?: readonly string[],
+  policy?: SlackAccessPolicy
 ): SlackMessageHandler {
   const rotating = resolveLoadingMessages(loadingMessages);
+  const respondTo = resolveSlackRespondTo(policy);
   return async (ctx, message) => {
     await ctx.thread.startTyping("Thinking…", rotating);
-    const auth = defaultSlackAuth(message, ctx);
+    const auth = defaultSlackAuth(message, ctx, { respondTo });
     return auth === null ? null : { auth };
   };
 }
 
 /**
  * Default watched-channel-post handler (optional custom loading rotation).
- * Same thread-scoped principal as mentions, tagged with
+ * Same principal policy as mentions, tagged with
  * `engagement: "channel_post"` for auth policies.
  */
 export function createDefaultOnChannelPost(
-  loadingMessages?: readonly string[]
+  loadingMessages?: readonly string[],
+  policy?: SlackAccessPolicy
 ): SlackMessageHandler {
   const rotating = resolveLoadingMessages(loadingMessages);
+  const respondTo = resolveSlackRespondTo(policy);
   return async (ctx, message) => {
     await ctx.thread.startTyping("Thinking…", rotating);
     const auth = defaultSlackAuth(message, ctx, {
       engagement: "channel_post",
+      respondTo,
     });
     return auth === null ? null : { auth };
   };