@cursor/july 0.1.26 → 0.1.28

package/src/channels/slack/dispatch.ts

@@ -17,6 +17,7 @@ import {
   parseSlackEvalDirective,
 } from "./eval-directive.js";
 import type { EventIdDedupe } from "./event-id-dedupe.js";
+import { isExternalSlackSender } from "./external-policy.js";
 import {
   formatSlackContextBlock,
   parseAppMentionEvent,
@@ -91,6 +92,11 @@ export interface SlackInboundDispatchDeps extends SlackContinuationProbes {
   evalCommandsEnabled?: boolean;
   /** cursorAccount agent name stripped before `eval` directive parsing. */
   cursorAgentName?: string;
+  /**
+   * Drop external senders before the handler. Defaults to `true`; pass
+   * `false` to admit them (or when an upstream gate already refused them).
+   */
+  blockExternals?: boolean;
 }
 
 function triggeringMergeMessage(
@@ -132,6 +138,7 @@ export async function dispatchInboundMessage(args: {
    * (`OncallBuddy eval list`).
    */
   cursorAgentName?: string;
+  blockExternals?: boolean;
 }): Promise<void> {
   const { message, kind } = args;
   const log = args.log ?? defaultSlackLog;
@@ -142,7 +149,7 @@ export async function dispatchInboundMessage(args: {
     host: args.host,
     artifacts: args.artifacts,
     log,
-    ...(message.teamId === undefined ? {} : { teamId: message.teamId }),
+    teamId: message.teamId,
   });
 
   log.info("inbound", {
@@ -155,6 +162,38 @@ export async function dispatchInboundMessage(args: {
     team: message.teamId,
   });
 
+  if (args.blockExternals !== false && message.author?.isBot !== true) {
+    const userId = message.author?.userId ?? "";
+    const teamId = message.teamId;
+    if (teamId === undefined || teamId === "") {
+      log.info("inbound dropped (missing team)", {
+        kind,
+        channel: message.channelId,
+        thread_ts: message.threadTs,
+        user: userId,
+        event_id: args.eventId,
+      });
+      return;
+    }
+    if (
+      await isExternalSlackSender({
+        botToken: args.credentials?.botToken,
+        slackTeamId: teamId,
+        userId,
+      })
+    ) {
+      log.info("inbound dropped (external sender)", {
+        kind,
+        channel: message.channelId,
+        thread_ts: message.threadTs,
+        user: userId,
+        team: teamId,
+        event_id: args.eventId,
+      });
+      return;
+    }
+  }
+
   const continuation = slackContinuationKey(
     message.channelId,
     message.threadTs
@@ -463,6 +502,7 @@ export function dispatchInboundFromEventBody(
         log,
         evalCommandsEnabled: deps.evalCommandsEnabled,
         cursorAgentName: deps.cursorAgentName,
+        blockExternals: deps.blockExternals,
         ...(deps.hasContinuationSession === undefined
           ? {}
           : { hasContinuationSession: deps.hasContinuationSession }),
@@ -504,6 +544,7 @@ export function dispatchInboundFromEventBody(
         log,
         evalCommandsEnabled: deps.evalCommandsEnabled,
         cursorAgentName: deps.cursorAgentName,
+        blockExternals: deps.blockExternals,
         ...(deps.hasContinuationSession === undefined
           ? {}
           : { hasContinuationSession: deps.hasContinuationSession }),

package/src/channels/slack/external-policy.ts

@@ -0,0 +1,62 @@
+/**
+ * Workspace-membership checks for AgentKit Slack agents.
+ * Mirrors backend `isExternalSlackUser` (cloud-agent/slack/externalChannelPolicy).
+ */
+
+import { callSlackApi } from "./api.js";
+import type { SlackBotToken } from "./types.js";
+
+type SlackUserInfo = {
+  team_id?: string;
+  is_stranger?: boolean;
+  is_restricted?: boolean;
+  is_ultra_restricted?: boolean;
+  enterprise_user?: { teams?: string[] };
+};
+
+/** Pure classifier over a `users.info` user object. Fails open to external. */
+export function classifySlackUserExternality(args: {
+  slackTeamId: string;
+  user: SlackUserInfo;
+}): boolean {
+  const { slackTeamId, user } = args;
+  if (
+    user.is_stranger === true ||
+    user.is_restricted === true ||
+    user.is_ultra_restricted === true
+  ) {
+    return true;
+  }
+  return (
+    user.team_id !== undefined &&
+    user.team_id !== slackTeamId &&
+    !(user.enterprise_user?.teams ?? []).includes(slackTeamId)
+  );
+}
+
+/** Lookup + classify. Empty userId / API failure → external. */
+export async function isExternalSlackSender(args: {
+  botToken: SlackBotToken | undefined;
+  slackTeamId: string;
+  userId: string;
+}): Promise<boolean> {
+  if (args.userId === "") {
+    return true;
+  }
+  try {
+    const result = await callSlackApi({
+      botToken: args.botToken,
+      operation: "users.info",
+      body: { user: args.userId },
+    });
+    if (result.ok !== true || result.user === undefined) {
+      return true;
+    }
+    return classifySlackUserExternality({
+      slackTeamId: args.slackTeamId,
+      user: result.user as SlackUserInfo,
+    });
+  } catch {
+    return true;
+  }
+}

package/src/channels/slack/index.ts

@@ -33,6 +33,7 @@ export * from "./dispatch.js";
 export * from "./doctor.js";
 export * from "./eval-directive.js";
 export * from "./event-id-dedupe.js";
+export * from "./external-policy.js";
 export * from "./inbound.js";
 export * from "./init.js";
 export * from "./interactive.js";

package/src/channels/slack/interactive.ts

@@ -20,6 +20,7 @@ import { updateMessage } from "./api.js";
 import { decisionFromActionId, parseApprovalActionValue } from "./approvals.js";
 import { buildSlackInteractiveApprovalAuth } from "./auth.js";
 import { dispatchInboundMessage } from "./dispatch.js";
+import { isExternalSlackSender } from "./external-policy.js";
 import { defaultSlackLog, type SlackLog } from "./log.js";
 import type {
   SlackBlockAction,
@@ -41,6 +42,8 @@ export interface SlackInteractiveDispatchDeps {
   ) => Promise<PendingApproval>;
   waitUntil: (promise: Promise<unknown>) => void;
   log?: SlackLog;
+  /** Defaults to true. */
+  blockExternals?: boolean;
 }
 
 /**
@@ -116,11 +119,35 @@ export async function dispatchInteractiveFromPayload(
   }
 
   const teamId = attrs.team_id;
+  if (deps.blockExternals !== false && parsed.userId !== "") {
+    if (teamId === undefined || teamId === "") {
+      log.info("interactive approval dropped (missing team)", {
+        session: value.sessionId,
+        user: parsed.userId,
+      });
+      return true;
+    }
+    if (
+      await isExternalSlackSender({
+        botToken: deps.credentials?.botToken,
+        slackTeamId: teamId,
+        userId: parsed.userId,
+      })
+    ) {
+      log.info("interactive approval dropped (external sender)", {
+        session: value.sessionId,
+        user: parsed.userId,
+        team: teamId,
+      });
+      return true;
+    }
+  }
+
   const clickingAuth = buildSlackInteractiveApprovalAuth({
     sessionAuth,
     channelId: parsed.channelId || sessionChannel,
     threadTs: parsed.threadTs || sessionThread,
-    ...(teamId === undefined || teamId === "" ? {} : { teamId }),
+    teamId: teamId === undefined || teamId === "" ? undefined : teamId,
     clickingUserId: parsed.userId,
   });
 
@@ -204,12 +231,9 @@ export function parseSlackBlockAction(
       : typeof user.name === "string"
         ? user.name
         : undefined;
-  const teamId =
-    typeof team.id === "string"
-      ? team.id
-      : typeof user.team_id === "string"
-        ? user.team_id
-        : undefined;
+  // Payload `team.id` only — never `user.team_id` (Connect home team).
+  // Membership gates must baseline the install workspace separately.
+  const teamId = typeof team.id === "string" ? team.id : undefined;
   const label =
     typeof action.text === "object" &&
     action.text !== null &&
@@ -278,6 +302,10 @@ export interface SlackBlockActionDispatchDeps extends SlackContinuationProbes {
   host: HostContext;
   artifacts: ArtifactsApi;
   log?: SlackLog;
+  /** Defaults to true. */
+  blockExternals?: boolean;
+  /** Install workspace from `auth.test`; baseline for the external gate. */
+  installTeamId?: string;
 }
 
 /**
@@ -285,7 +313,10 @@ export interface SlackBlockActionDispatchDeps extends SlackContinuationProbes {
  * `action_ts` (unique per click, never a real thread message), so ask-dedupe
  * claims and `<slack_thread>` exclusions stay per-click.
  */
-function blockActionAsMessage(action: SlackBlockAction): SlackMessage {
+function blockActionAsMessage(
+  action: SlackBlockAction,
+  installTeamId: string | undefined
+): SlackMessage {
   const text = `[clicked: ${action.label ?? action.actionId}]`;
   return {
     text,
@@ -294,7 +325,7 @@ function blockActionAsMessage(action: SlackBlockAction): SlackMessage {
     ts: action.actionTs,
     threadTs: action.threadTs,
     channelId: action.channelId,
-    teamId: action.teamId,
+    teamId: installTeamId,
     author: {
       userId: action.userId,
       userName: action.userName,
@@ -344,7 +375,7 @@ export async function dispatchBlockAction(
 
   await dispatchInboundMessage({
     kind: "block_action",
-    message: blockActionAsMessage(action),
+    message: blockActionAsMessage(action, deps.installTeamId),
     handler: (ctx) => deps.handler(ctx, action),
     send: deps.send,
     credentials: deps.credentials,
@@ -353,6 +384,7 @@ export async function dispatchBlockAction(
     log,
     // Click text is synthetic — never treat it as a stop/eval directive.
     evalCommandsEnabled: false,
+    blockExternals: deps.blockExternals,
     hasContinuationSession: deps.hasContinuationSession,
     isContinuationBusy: deps.isContinuationBusy,
     getContinuationLastBotMessageTs: deps.getContinuationLastBotMessageTs,

package/src/channels/slack/slack-channel.ts

@@ -43,6 +43,7 @@ import {
   buildDefaultEvents,
   createDefaultOnChannelPost,
   createDefaultOnInbound,
+  resolveSlackBlockExternals,
 } from "./defaults.js";
 import {
   dispatchInboundFromEventBody,
@@ -152,11 +153,14 @@ export function slackChannel<const Name extends string = string>(
       : (options.credentials ?? credentialsFromEnv(options.envPrefix));
   const envKeys = slackEnvKeys(options.envPrefix);
   const loadingMessages = options.loadingMessages;
-  const defaultInbound = createDefaultOnInbound(loadingMessages);
+  const policy = options.policy;
+  const blockExternals = resolveSlackBlockExternals(policy);
+  const defaultInbound = createDefaultOnInbound(loadingMessages, policy);
   const onAppMention = options.onAppMention ?? defaultInbound;
   const onDirectMessage = options.onDirectMessage ?? defaultInbound;
   const onChannelPost =
-    options.onChannelPost ?? createDefaultOnChannelPost(loadingMessages);
+    options.onChannelPost ??
+    createDefaultOnChannelPost(loadingMessages, policy);
   const engagement = options.engagement ?? {};
   const mentionsEnabled = engagement.mentions !== false;
   const directMessagesEnabled = engagement.directMessages !== false;
@@ -237,6 +241,8 @@ export function slackChannel<const Name extends string = string>(
       mentionsEnabled,
       directMessagesEnabled,
       evalCommandsEnabled,
+      // cursorAccount: backend router already refuses externals.
+      blockExternals: cursorAccount ? false : blockExternals,
       ...(args.hasContinuationSession === undefined
         ? {}
         : { hasContinuationSession: args.hasContinuationSession }),
@@ -329,10 +335,15 @@ export function slackChannel<const Name extends string = string>(
 
       let botUserId: string | undefined;
       let botId: string | undefined;
+      let installTeamId: string | undefined;
       let webClient: InstanceType<
         typeof import("@slack/web-api").WebClient
       > | null = null;
-      if (channelPosts !== undefined || botMentions !== undefined) {
+      if (
+        channelPosts !== undefined ||
+        botMentions !== undefined ||
+        routeInteractive
+      ) {
         try {
           const { WebClient } = await import("@slack/web-api");
           webClient = new WebClient(botToken);
@@ -341,6 +352,8 @@ export function slackChannel<const Name extends string = string>(
             typeof identity.user_id === "string" ? identity.user_id : undefined;
           botId =
             typeof identity.bot_id === "string" ? identity.bot_id : undefined;
+          installTeamId =
+            typeof identity.team_id === "string" ? identity.team_id : undefined;
         } catch (error) {
           getLog().error("bot identity lookup degraded", {
             error: error instanceof Error ? error.message : String(error),
@@ -416,6 +429,7 @@ export function slackChannel<const Name extends string = string>(
                   artifacts: args.artifacts,
                   log: getLog(),
                   evalCommandsEnabled,
+                  blockExternals,
                   ...(args.hasContinuationSession === undefined
                     ? {}
                     : {
@@ -491,6 +505,7 @@ export function slackChannel<const Name extends string = string>(
               resolveApproval: args.resolveApproval,
               waitUntil: args.waitUntil,
               log: getLog(),
+              blockExternals,
             }
           );
           if (handledAsApproval || onBlockAction === undefined) {
@@ -503,6 +518,8 @@ export function slackChannel<const Name extends string = string>(
             host: args.host,
             artifacts: args.artifacts,
             log: getLog(),
+            blockExternals,
+            installTeamId,
             hasContinuationSession: args.hasContinuationSession,
             isContinuationBusy: args.isContinuationBusy,
             getContinuationLastBotMessageTs:

package/src/channels/slack/types.ts

@@ -432,8 +432,20 @@ export function assertSlackCursorAgentName(name: string): void {
   }
 }
 
+/** `"thread"` = anyone in the thread (default); `"author"` = session starter only. */
+export type SlackRespondTo = "thread" | "author";
+
+export interface SlackAccessPolicy {
+  /** Defaults to `"thread"`. Applied by the default inbound handlers. */
+  respondTo?: SlackRespondTo;
+  /** Refuse Slack Connect / guest / other-workspace senders. Defaults to `true`. */
+  blockExternals?: boolean;
+}
+
 export interface SlackChannelOptions {
   credentials?: SlackCredentials;
+  /** Defaults to `{ respondTo: "thread", blockExternals: true }`. */
+  policy?: SlackAccessPolicy;
   /**
    * Per-agent env prefix for tokens. `envPrefix: "MY_AGENT"` reads
    * `MY_AGENT_SLACK_BOT_TOKEN` + `MY_AGENT_SLACK_APP_TOKEN`. Prefer this over

package/src/internal/ab-fold.ts

@@ -187,6 +187,10 @@ export function applyBuiltinMetrics(
         m.cacheReadTokens += usage.cacheReadTokens;
         m.cacheWriteTokens += usage.cacheWriteTokens;
       }
+      const cost = event.data.cost;
+      if (cost !== undefined) {
+        m.costUsd += cost.totalUsd;
+      }
       addWallTime(accum, event.at);
       break;
     }

package/src/internal/ab-snapshot.ts

@@ -323,6 +323,7 @@ function addMetrics(target: ABMetrics, delta: ABMetrics): void {
   target.outputTokens += delta.outputTokens;
   target.cacheReadTokens += delta.cacheReadTokens;
   target.cacheWriteTokens += delta.cacheWriteTokens;
+  target.costUsd += delta.costUsd;
   target.wallTimeMs += delta.wallTimeMs;
   for (const [key, value] of Object.entries(delta.custom)) {
     target.custom[key] = (target.custom[key] ?? 0) + value;