npm - @cursor/july - Versions diffs - 0.1.27 → 0.1.28 - Mend

@cursor/july 0.1.27 → 0.1.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (122) hide show

package/dist/bin/agent-serve.js +12 -3
package/dist/channels/slack/auth.d.ts +13 -13
package/dist/channels/slack/auth.d.ts.map +1 -1
package/dist/channels/slack/auth.js +19 -10
package/dist/channels/slack/cursor-account.d.ts.map +1 -1
package/dist/channels/slack/cursor-account.js +3 -1
package/dist/channels/slack/defaults.d.ts +7 -4
package/dist/channels/slack/defaults.d.ts.map +1 -1
package/dist/channels/slack/defaults.js +14 -4
package/dist/channels/slack/dispatch.d.ts +6 -0
package/dist/channels/slack/dispatch.d.ts.map +1 -1
package/dist/channels/slack/dispatch.js +59 -21
package/dist/channels/slack/external-policy.d.ts +27 -0
package/dist/channels/slack/external-policy.d.ts.map +1 -0
package/dist/channels/slack/external-policy.js +53 -0
package/dist/channels/slack/index.d.ts +1 -0
package/dist/channels/slack/index.d.ts.map +1 -1
package/dist/channels/slack/index.js +1 -0
package/dist/channels/slack/interactive.d.ts +6 -0
package/dist/channels/slack/interactive.d.ts.map +1 -1
package/dist/channels/slack/interactive.js +42 -15
package/dist/channels/slack/slack-channel.d.ts.map +1 -1
package/dist/channels/slack/slack-channel.js +19 -6
package/dist/channels/slack/types.d.ts +10 -0
package/dist/channels/slack/types.d.ts.map +1 -1
package/dist/docs/404.html +2 -2
package/dist/docs/ab.html +3 -3
package/dist/docs/assets/{app.BICLoJYF.js → app.CqjrYaT2.js} +1 -1
package/dist/docs/assets/chunks/@localSearchIndexroot.VWQoPFJ1.js +1 -0
package/dist/docs/assets/chunks/{VPLocalSearchBox.wN4Ko9dT.js → VPLocalSearchBox.ag-MwUel.js} +1 -1
package/dist/docs/assets/chunks/{theme.dnnTE-Co.js → theme.BS-DJWat.js} +2 -2
package/dist/docs/assets/{guides_slack.md.D_xFKlnF.js → guides_slack.md.CjmJSvZS.js} +8 -4
package/dist/docs/assets/guides_slack.md.CjmJSvZS.lean.js +1 -0
package/dist/docs/assets/guides_webhooks.md.wSOYas3X.js +183 -0
package/dist/docs/assets/{guides_webhooks.md.B1EswtUu.lean.js → guides_webhooks.md.wSOYas3X.lean.js} +1 -1
package/dist/docs/assets/{index.md.Dfv5ic9t.js → index.md.CH_s5uZe.js} +1 -1
package/dist/docs/assets/{reference_channels.md.DdmiKgqf.js → reference_channels.md.CDhTRfUz.js} +2 -2
package/dist/docs/assets/{reference_channels.md.DdmiKgqf.lean.js → reference_channels.md.CDhTRfUz.lean.js} +1 -1
package/dist/docs/building-with-agents.html +3 -3
package/dist/docs/concepts.html +3 -3
package/dist/docs/deployment.html +3 -3
package/dist/docs/evals.html +3 -3
package/dist/docs/example-agents/approval-buddy.html +3 -3
package/dist/docs/example-agents/benny.html +3 -3
package/dist/docs/example-agents/bugbot.html +3 -3
package/dist/docs/example-agents/codebase-wiki.html +3 -3
package/dist/docs/example-agents/codeowners-review.html +3 -3
package/dist/docs/example-agents/concierge.html +3 -3
package/dist/docs/example-agents/fsd.html +3 -3
package/dist/docs/example-agents/index.html +3 -3
package/dist/docs/example-agents/knowledge-base.html +3 -3
package/dist/docs/example-agents/oncall.html +3 -3
package/dist/docs/example-agents/security-reviewer.html +3 -3
package/dist/docs/example-agents/slack-agent.html +3 -3
package/dist/docs/example-agents/weather-agent.html +3 -3
package/dist/docs/guides/agent-to-agent.html +3 -3
package/dist/docs/guides/cloud-runtime.html +3 -3
package/dist/docs/guides/github.html +3 -3
package/dist/docs/guides/human-in-the-loop.html +3 -3
package/dist/docs/guides/mcp-oauth.html +3 -3
package/dist/docs/guides/slack.html +11 -7
package/dist/docs/guides/webhooks.html +138 -5
package/dist/docs/hashmap.json +1 -1
package/dist/docs/hillclimbing.html +3 -3
package/dist/docs/index.html +5 -5
package/dist/docs/quickstart.html +3 -3
package/dist/docs/reference/agent-config.html +3 -3
package/dist/docs/reference/channels.html +5 -5
package/dist/docs/reference/cli.html +3 -3
package/dist/docs/reference/connections.html +3 -3
package/dist/docs/reference/hooks.html +3 -3
package/dist/docs/reference/http-api.html +3 -3
package/dist/docs/reference/instructions.html +3 -3
package/dist/docs/reference/playground.html +3 -3
package/dist/docs/reference/project-layout.html +3 -3
package/dist/docs/reference/prompt.html +3 -3
package/dist/docs/reference/schedules.html +3 -3
package/dist/docs/reference/sessions.html +3 -3
package/dist/docs/reference/skills.html +3 -3
package/dist/docs/reference/subagents.html +3 -3
package/dist/docs/reference/tools.html +3 -3
package/dist/docs/scaffolding-agents.html +3 -3
package/dist/docs/storage.html +3 -3
package/dist/docs/troubleshooting.html +3 -3
package/dist/internal/cli-ax.d.ts +8 -0
package/dist/internal/cli-ax.d.ts.map +1 -1
package/dist/internal/cli-ax.js +116 -57
package/dist/internal/cursor-slack-relay.d.ts +2 -0
package/dist/internal/cursor-slack-relay.d.ts.map +1 -1
package/dist/internal/cursor-slack-relay.js +1 -0
package/dist/internal/deploy-client.d.ts +2 -0
package/dist/internal/deploy-client.d.ts.map +1 -1
package/dist/internal/deploy-client.js +1 -0
package/dist/internal/discovery.js +8 -1
package/dist/internal/server.js +10 -5
package/dist/playground/assets/{index-BDCeW4uc.js → index-CkN74U_L.js} +48 -47
package/dist/playground/index.html +1 -1
package/docs/README.md +1 -0
package/docs/guides/slack.md +32 -7
package/docs/guides/webhooks.md +183 -0
package/docs/reference/channels.md +2 -1
package/package.json +1 -1
package/skills/setup-slack/SKILL.md +3 -0
package/src/bin/agent-serve.ts +12 -3
package/src/channels/slack/auth.ts +29 -22
package/src/channels/slack/cursor-account.ts +2 -0
package/src/channels/slack/defaults.ts +24 -4
package/src/channels/slack/dispatch.ts +42 -1
package/src/channels/slack/external-policy.ts +62 -0
package/src/channels/slack/index.ts +1 -0
package/src/channels/slack/interactive.ts +42 -10
package/src/channels/slack/slack-channel.ts +20 -3
package/src/channels/slack/types.ts +12 -0
package/src/internal/cli-ax.ts +110 -34
package/src/internal/cursor-slack-relay.ts +3 -0
package/src/internal/deploy-client.ts +3 -0
package/src/internal/discovery.ts +8 -1
package/src/internal/server.ts +9 -5
package/dist/docs/assets/chunks/@localSearchIndexroot.CQJytDwU.js +0 -1
package/dist/docs/assets/guides_slack.md.D_xFKlnF.lean.js +0 -1
package/dist/docs/assets/guides_webhooks.md.B1EswtUu.js +0 -50
/package/dist/docs/assets/{index.md.Dfv5ic9t.lean.js → index.md.CH_s5uZe.lean.js} +0 -0

package/dist/playground/index.html CHANGED Viewed

@@ -8,7 +8,7 @@
     />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>agent-serve playground</title>
-    <script type="module" crossorigin src="./assets/index-BDCeW4uc.js"></script>
+    <script type="module" crossorigin src="./assets/index-CkN74U_L.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-Bul1WfrB.css">
   </head>
   <body>

package/docs/README.md CHANGED Viewed

@@ -56,6 +56,7 @@ Pick your entry point based on your goal.
 | Learning from working agents | [Example agents](./example-agents/index.md) |
 | Wiring an agent to Slack | [Slack guide](./guides/slack.md) |
 | Wiring an agent to GitHub webhooks | [GitHub guide](./guides/github.md) |
+| Driving an agent from Linear (or another tracker) | [Webhooks guide: Linear example](./guides/webhooks.md#example-linear-as-the-control-plane) |
 | Making an existing agent measurably better | [Evals](./evals.md), then [Hillclimbing](./hillclimbing.md) |
 | Comparing variants on live traffic | [Live A/B metrics](./ab.md) |
 | Deploying with Cursor or on your own infrastructure | [Deployment](./deployment.md) |

package/docs/guides/slack.md CHANGED Viewed

@@ -1,6 +1,6 @@
 ---
 title: "Slack"
-description: "Put the agent in Slack over Socket Mode: manifests, tokens, doctor, engagement rules, and approval buttons."
+description: "Put the agent in Slack over Socket Mode: manifests, tokens, doctor, engagement rules, access policy, and approval buttons."
 ---
 # Slack agents
@@ -31,12 +31,13 @@ export default slackChannel({ envPrefix: "WEATHER_AGENT" });
 By default the channel connects over Socket Mode (the app connects
 outward, so it works from behind any firewall) and responds only to
-`app_mention` events and direct messages. Threads bind to sessions with
-`continuationToken = channelId:threadTs`, so a thread is one durable
-conversation. Replies stream (`chat.startStream` / `appendStream` /
-`stopStream`) with a plain-message fallback, a rotating status shows
-while the agent works, and the pack sets thread titles and suggested
-prompts. When a Slack API is unavailable (`method_not_found`,
+`app_mention` events and direct messages. It also refuses Slack Connect
+users, guests, and senders from other workspaces. Threads bind to
+sessions with `continuationToken = channelId:threadTs`, so a thread is
+one durable conversation. Replies stream (`chat.startStream` /
+`appendStream` / `stopStream`) with a plain-message fallback, a rotating
+status shows while the agent works, and the pack sets thread titles and
+suggested prompts. When a Slack API is unavailable (`method_not_found`,
 `missing_scope`), the pack degrades to `postMessage` instead of failing.
 Missing tokens leave the channel idle (`channel idle … missing
@@ -71,6 +72,30 @@ claimed-thread reply). Channel watching and `toolApprovals` /
 Block Kit clicks. Agent names must be unique on the host; an unmatched
 `@Cursor <name>` stays on Cursor's normal Slack agent.
+## Control who can message the agent
+External senders are blocked by default. Slack Connect users, guests, and
+people whose home workspace is not the install team never reach the
+handler. That applies to Socket Mode and `cursorAccount: true`. Set
+`blockExternals: false` only when the agent should serve people outside
+your org:
+```ts
+export default slackChannel({
+  policy: { blockExternals: false },
+});
+```
+Sessions are thread-scoped by default, so anyone in the thread can
+continue. Restrict follow-ups to the person who started the session with
+`respondTo: "author"`:
+```ts
+export default slackChannel({
+  policy: { respondTo: "author" },
+});
+```
 ## Set it up
 ### Generate the app assets

package/docs/guides/webhooks.md CHANGED Viewed

@@ -177,6 +177,189 @@ swaps the default for `bearerAuth` on every channel that doesn't author
 its own chain, and `--allow-anonymous` swaps it for `allowAll()`
 (trusted networks only). Authored `auth` arrays always win over both.
+## Example: Linear as the control plane
+Everything above composes into a working ticket-driven agent. This
+example wires Linear to the agent: new issues and comments start or
+resume sessions, and replies land back on the issue as comments. The
+same shape works for any tracker with signed webhooks.
+Create the webhook in Linear under Settings → API → "New webhook",
+pointed at `https://<your-host>/<slug>/v1/channels/linear`, and copy
+the signing secret. Linear requires a public HTTPS URL, so use a
+tunnel during local development or test with signed fixtures (below).
+Set three environment variables:
+```bash
+LINEAR_WEBHOOK_SECRET=lin_wh_...   # the webhook's signing secret
+LINEAR_API_KEY=lin_api_...         # posts replies as comments
+LINEAR_AGENT_USER_ID=...           # the API key's user: query { viewer { id } }
+```
+`LINEAR_AGENT_USER_ID` matters: replies posted with the API key
+trigger the Comment webhook again, so the channel must recognize and
+skip its own comments. Without the guard, every reply starts another
+turn.
+Author `agent/channels/linear.ts`:
+```ts
+import { Buffer } from "node:buffer";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { allowAll, defineChannel, POST } from "@cursor/july/channels";
+import { z } from "zod";
+const secret = process.env.LINEAR_WEBHOOK_SECRET ?? "";
+const apiKey = process.env.LINEAR_API_KEY ?? "";
+const agentUserId = process.env.LINEAR_AGENT_USER_ID ?? "";
+interface LinearWebhook {
+  action: string;
+  type: string;
+  url?: string;
+  webhookTimestamp: number;
+  data: {
+    id: string;
+    title?: string;
+    description?: string;
+    body?: string;
+    issueId?: string;
+    userId?: string;
+  };
+}
+// Linear signs the raw body: hex HMAC-SHA256 in `Linear-Signature`.
+function verified(rawBody: string, header: string | null): boolean {
+  if (secret === "" || header === null) {
+    return false;
+  }
+  const expected = createHmac("sha256", secret).update(rawBody).digest();
+  const received = Buffer.from(header, "hex");
+  return (
+    received.length === expected.length && timingSafeEqual(received, expected)
+  );
+}
+async function postComment(issueId: string, body: string): Promise<void> {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: apiKey },
+    body: JSON.stringify({
+      query:
+        "mutation($input: CommentCreateInput!) { commentCreate(input: $input) { success } }",
+      variables: { input: { issueId, body } },
+    }),
+  });
+  if (!response.ok) {
+    throw new Error(`commentCreate failed: ${response.status}`);
+  }
+}
+function issueIdFromToken(token: string | null): string | null {
+  if (token === null || !token.startsWith("linear:")) {
+    return null;
+  }
+  return token.slice("linear:".length);
+}
+export default defineChannel({
+  // The HMAC check is the request auth, so admit everything at the route.
+  auth: [allowAll()],
+  routes: [
+    POST("/", {
+      description: "Linear webhook ingress",
+      // The payload shape varies by `Linear-Event`; parse after verifying.
+      bodySchema: z.unknown(),
+      handler: async (request, { send, waitUntil }) => {
+        const rawBody = await request.text();
+        if (!verified(rawBody, request.headers.get("linear-signature"))) {
+          return Response.json({ ok: false }, { status: 401 });
+        }
+        const event = JSON.parse(rawBody) as LinearWebhook;
+        // Reject stale deliveries to guard against replay.
+        if (Math.abs(Date.now() - event.webhookTimestamp) > 60_000) {
+          return Response.json({ ok: false }, { status: 401 });
+        }
+        // Skip the agent's own comments so replies don't re-trigger it.
+        if (event.type === "Comment" && event.data.userId === agentUserId) {
+          return Response.json({ ok: true });
+        }
+        // New issue → new session. New comment → follow-up on the same
+        // session, keyed by issue id through the continuation token.
+        let issueId: string | undefined;
+        let message: string | undefined;
+        if (event.type === "Issue" && event.action === "create") {
+          issueId = event.data.id;
+          message = `New Linear issue: ${event.data.title}\n\n${
+            event.data.description ?? ""
+          }\n${event.url ?? ""}`;
+        } else if (event.type === "Comment" && event.action === "create") {
+          issueId = event.data.issueId;
+          message = event.data.body;
+        }
+        if (issueId === undefined || message === undefined) {
+          return Response.json({ ok: true });
+        }
+        // Linear retries on any non-200 and times out after five
+        // seconds: ACK now, run the turn in the background.
+        waitUntil(send(message, { continuationToken: `linear:${issueId}` }));
+        return Response.json({ ok: true });
+      },
+    }),
+  ],
+  events: {
+    async "message.completed"(event, channel) {
+      if (event.data.finishReason === "tool_call" || event.data.text === "") {
+        return;
+      }
+      const issueId = issueIdFromToken(channel.continuationToken);
+      if (issueId !== null) {
+        await postComment(issueId, event.data.text);
+      }
+    },
+    async "turn.failed"(event, channel) {
+      const issueId = issueIdFromToken(channel.continuationToken);
+      if (issueId !== null) {
+        await postComment(issueId, `Turn failed: ${event.data.message}`);
+      }
+    },
+  },
+});
+```
+The channel handles ingress and reply delivery deterministically. To
+let the model read and update Linear during the turn (search related
+issues, change state, assign), add the Linear MCP connection alongside
+it:
+```ts
+// agent/mcp-connections/linear.ts
+import { defineConnection } from "@cursor/july/connections";
+// Uses the signed-in Cursor account's Linear connector.
+export default defineConnection({ cursorAccount: true, servers: ["Linear"] });
+```
+See [MCP connections](../reference/connections.md) for the direct
+`https://mcp.linear.app/mcp` form when the host isn't signed in to
+Cursor.
+To test without a public URL, save a payload from the webhook's
+delivery log (or the sample in
+[Linear's webhook docs](https://linear.app/developers/webhooks)) under
+`fixtures/`, refresh its `webhookTimestamp`, and sign it yourself:
+```bash
+SIG=$(node -e 'const {createHmac}=require("node:crypto");const fs=require("node:fs");
+process.stdout.write(createHmac("sha256",process.env.LINEAR_WEBHOOK_SECRET)
+  .update(fs.readFileSync("fixtures/issue-create.json")).digest("hex"))')
+curl -X POST http://127.0.0.1:3000/<slug>/v1/channels/linear/ \
+  -H 'content-type: application/json' -H "linear-signature: $SIG" \
+  --data-binary @fixtures/issue-create.json
+```
 ## Test a channel
 Start with curl and saved payloads under `fixtures/`. The playground's

package/docs/reference/channels.md CHANGED Viewed

@@ -174,7 +174,8 @@ declares `[localDevStrict()]` stays loopback-only even on an
 ## First class channels
 **Slack** (`@cursor/july/channels/slack`): Socket Mode
-transport, streaming replies, engagement rules, approval cards. Author
+transport, streaming replies, engagement rules, approval cards, and a
+default block on Slack Connect / guest / other-workspace senders. Author
 `agent/channels/slack.ts` with `slackChannel()`. Guide:
 [Slack](../guides/slack.md).

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@cursor/july",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {

package/skills/setup-slack/SKILL.md CHANGED Viewed

@@ -97,6 +97,9 @@ export default slackChannel({
 single token — string literals with spaces fail typecheck; runtime
 values throw at construction/serve. Names must be unique on the host;
 an unmatched `@Cursor <name>` stays with Cursor's normal Slack agent.
+External senders (Slack Connect / guests / other workspaces) are
+blocked by default; see `policy.blockExternals` in
+[docs/guides/slack.md](../../docs/guides/slack.md).
 ### A2 — Sign in + serve (agent)

package/src/bin/agent-serve.ts CHANGED Viewed

@@ -85,7 +85,7 @@ Usage:
   ${CLI} sessions    [--url <baseUrl> | --prod] [--json]
                           [--slug <slug>] [--team <id>] [--dir <path>]
   ${CLI} session     <sessionId> [--url <baseUrl> | --prod]
-                          [--json | --text | --events]
+                          [--json | --text | --events] [--out <file.ndjson>]
                           [--slug <slug>] [--team <id>] [--dir <path>]
   ${CLI} cost        [sessionId] [--url <baseUrl> | --prod] [--json]
                           [--slug <slug>] [--team <id>] [--dir <path>]
@@ -110,11 +110,12 @@ Usage:
                           [--tag <tag>]... [--verbose] [--timeout-ms <n>]
                           [--strict] [--max-concurrency <n>]
                           [--junit <path>] [--artifacts <dir>|--no-artifacts]
+                          [--out <file.json>]
                           [--skip-report] [--no-stream] [--no-wait]
                           [--prod | --url <baseUrl>] [--slug <slug>]
                           [--team <id>]
   ${CLI} eval status [runId] --prod|--url <baseUrl> [--dir <path>] [--json]
-                          [--slug <slug>] [--team <id>]
+                          [--out <file.json>] [--slug <slug>] [--team <id>]
   ${CLI} eval cancel <runId> --prod|--url <baseUrl> [--dir <path>] [--json]
                           [--slug <slug>] [--team <id>]
   ${CLI} info        [--dir <path>] [--json]
@@ -392,7 +393,11 @@ Options:
   --comment          github replay: comment body for comment events.
   --context          github replay: commit-status context.
   --dry-run          github replay: print synthesized payloads, don't POST.
-  --out              github replay: write synthesized payloads as fixtures.
+  --out              eval / eval status <runId>: also write the full results
+                     JSON to this path. session: write the raw NDJSON trace
+                     there instead of printing (same format as run --events;
+                     playground-openable). github replay: write synthesized
+                     payloads as fixtures.
 `;
 async function main(argv: string[]): Promise<number> {
@@ -775,6 +780,7 @@ async function main(argv: string[]): Promise<number> {
             apiKey: values["api-key"],
             slug: values.slug,
             bearerToken: values["bearer-token"],
+            out: values.out,
           })
         );
       }
@@ -819,6 +825,7 @@ async function main(argv: string[]): Promise<number> {
           artifacts: values["no-artifacts"] ? false : values.artifacts,
           skipReport: values["skip-report"],
           maxConcurrency: parseMaxConcurrency(values["max-concurrency"]),
+          out: values.out,
         })
       );
     }
@@ -912,6 +919,7 @@ async function main(argv: string[]): Promise<number> {
           json: values.json,
           text: values.text,
           rawEvents: values["raw-events"],
+          out: values.out,
         })
       );
     }
@@ -1291,6 +1299,7 @@ function axFromOptions(
     artifacts: partial.artifacts,
     skipReport: partial.skipReport,
     maxConcurrency: partial.maxConcurrency,
+    out: partial.out,
   };
 }

package/src/channels/slack/auth.ts CHANGED Viewed

@@ -4,29 +4,39 @@
 import { samePrincipal } from "../../internal/auth.js";
 import type { AuthContext } from "../../types.js";
-import type { SlackBinding, SlackBlockAction, SlackMessage } from "./types.js";
+import type {
+  SlackBinding,
+  SlackBlockAction,
+  SlackMessage,
+  SlackRespondTo,
+} from "./types.js";
-/**
- * Build a thread-scoped principal so any participant in the same Slack
- * thread can continue the session. The triggering user is preserved in
- * attributes for message context.
- */
-export function buildSlackAuthContext(args: {
+export type BuildSlackAuthArgs = {
   channelId: string;
   threadTs: string;
   teamId?: string;
   userId?: string;
   userName?: string;
   isBot?: boolean;
-  /**
-   * Engagement surface that started the session (e.g. `"channel_post"` for
-   * the opt-in channel watch). Recorded as an attribute; the principal stays
-   * thread-scoped so an @mention in the same thread continues the session.
-   */
   engagement?: string;
-}): AuthContext {
+  /** Defaults to `"thread"`. `"author"` appends `:{userId}` to the principal. */
+  respondTo?: SlackRespondTo;
+};
+/**
+ * Build a Slack session principal.
+ *
+ * - `"thread"` (default): any participant can continue.
+ * - `"author"`: only the starter (`…:{userId}`), same shape approvals already honor.
+ */
+export function buildSlackAuthContext(args: BuildSlackAuthArgs): AuthContext {
   const team = args.teamId ?? "unknown";
-  const principalId = `slack:${team}:${args.channelId}:${args.threadTs}`;
+  const respondTo = args.respondTo ?? "thread";
+  const base = `slack:${team}:${args.channelId}:${args.threadTs}`;
+  const authorScoped =
+    respondTo === "author" && args.userId !== undefined && args.userId !== "";
+  const principalId = authorScoped ? `${base}:${args.userId}` : base;
   const attributes: Record<string, string> = {
     channel_id: args.channelId,
     thread_ts: args.threadTs,
@@ -106,7 +116,7 @@ export function blockActionAuth(action: SlackBlockAction): AuthContext {
 export function defaultSlackAuth(
   message: SlackMessage,
   ctx: SlackBinding,
-  options?: { engagement?: string }
+  options?: { engagement?: string; respondTo?: SlackRespondTo }
 ): AuthContext | null {
   if (message.author === undefined) {
     return null;
@@ -114,14 +124,11 @@ export function defaultSlackAuth(
   return buildSlackAuthContext({
     channelId: ctx.slack.channelId,
     threadTs: ctx.slack.threadTs,
-    ...(message.teamId === undefined ? {} : { teamId: message.teamId }),
+    teamId: message.teamId,
     userId: message.author.userId,
-    ...(message.author.userName === undefined
-      ? {}
-      : { userName: message.author.userName }),
+    userName: message.author.userName,
     isBot: message.author.isBot,
-    ...(options?.engagement === undefined
-      ? {}
-      : { engagement: options.engagement }),
+    engagement: options?.engagement,
+    respondTo: options?.respondTo,
   });
 }

package/src/channels/slack/cursor-account.ts CHANGED Viewed

@@ -172,6 +172,8 @@ export async function dispatchCursorSlackEnvelope(args: {
     log,
     evalCommandsEnabled: runtime.options.evalCommands !== false,
     cursorAgentName: envelope.agentName,
+    // Backend router already refused externals for this envelope.
+    blockExternals: false,
     ...(args.hasContinuationSession === undefined
       ? {}
       : { hasContinuationSession: args.hasContinuationSession }),

package/src/channels/slack/defaults.ts CHANGED Viewed

@@ -20,9 +20,11 @@ import { createStreamDeliveryStrategy } from "./live-delivery.js";
 import { defaultSlackLog, type SlackLog } from "./log.js";
 import { buildTaskChunkForResult, buildTaskChunksForCalls } from "./stream.js";
 import type {
+  SlackAccessPolicy,
   SlackChannelState,
   SlackCredentials,
   SlackMessageHandler,
+  SlackRespondTo,
   SlackSuggestedPrompt,
 } from "./types.js";
@@ -30,6 +32,19 @@ const SLACK_TURN_FAILURE_FALLBACK =
   "I hit an error while handling your request. Please try again or rephrase.";
 const SLACK_TURN_FAILURE_MAX_CHARS = 400;
+export function resolveSlackRespondTo(
+  policy: SlackAccessPolicy | undefined
+): SlackRespondTo {
+  return policy?.respondTo === "author" ? "author" : "thread";
+}
+/** Defaults to true when omitted. */
+export function resolveSlackBlockExternals(
+  policy: SlackAccessPolicy | undefined
+): boolean {
+  return policy?.blockExternals !== false;
+}
 /** Scrubbed turn.failed body for Slack (secrets / paths / URLs stripped). */
 export function formatSlackTurnFailureMessage(raw: string | undefined): string {
   const scrubbed = scrubSlackErrorDetail(raw?.trim() ?? "");
@@ -68,29 +83,34 @@ function resolveLoadingMessages(
 /** Default mention/DM inbound handler (optional custom loading rotation). */
 export function createDefaultOnInbound(
-  loadingMessages?: readonly string[]
+  loadingMessages?: readonly string[],
+  policy?: SlackAccessPolicy
 ): SlackMessageHandler {
   const rotating = resolveLoadingMessages(loadingMessages);
+  const respondTo = resolveSlackRespondTo(policy);
   return async (ctx, message) => {
     await ctx.thread.startTyping("Thinking…", rotating);
-    const auth = defaultSlackAuth(message, ctx);
+    const auth = defaultSlackAuth(message, ctx, { respondTo });
     return auth === null ? null : { auth };
   };
 }
 /**
  * Default watched-channel-post handler (optional custom loading rotation).
- * Same thread-scoped principal as mentions, tagged with
+ * Same principal policy as mentions, tagged with
  * `engagement: "channel_post"` for auth policies.
  */
 export function createDefaultOnChannelPost(
-  loadingMessages?: readonly string[]
+  loadingMessages?: readonly string[],
+  policy?: SlackAccessPolicy
 ): SlackMessageHandler {
   const rotating = resolveLoadingMessages(loadingMessages);
+  const respondTo = resolveSlackRespondTo(policy);
   return async (ctx, message) => {
     await ctx.thread.startTyping("Thinking…", rotating);
     const auth = defaultSlackAuth(message, ctx, {
       engagement: "channel_post",
+      respondTo,
     });
     return auth === null ? null : { auth };
   };

package/src/channels/slack/dispatch.ts CHANGED Viewed

@@ -17,6 +17,7 @@ import {
   parseSlackEvalDirective,
 } from "./eval-directive.js";
 import type { EventIdDedupe } from "./event-id-dedupe.js";
+import { isExternalSlackSender } from "./external-policy.js";
 import {
   formatSlackContextBlock,
   parseAppMentionEvent,
@@ -91,6 +92,11 @@ export interface SlackInboundDispatchDeps extends SlackContinuationProbes {
   evalCommandsEnabled?: boolean;
   /** cursorAccount agent name stripped before `eval` directive parsing. */
   cursorAgentName?: string;
+  /**
+   * Drop external senders before the handler. Defaults to `true`; pass
+   * `false` to admit them (or when an upstream gate already refused them).
+   */
+  blockExternals?: boolean;
 }
 function triggeringMergeMessage(
@@ -132,6 +138,7 @@ export async function dispatchInboundMessage(args: {
    * (`OncallBuddy eval list`).
    */
   cursorAgentName?: string;
+  blockExternals?: boolean;
 }): Promise<void> {
   const { message, kind } = args;
   const log = args.log ?? defaultSlackLog;
@@ -142,7 +149,7 @@ export async function dispatchInboundMessage(args: {
     host: args.host,
     artifacts: args.artifacts,
     log,
-    ...(message.teamId === undefined ? {} : { teamId: message.teamId }),
+    teamId: message.teamId,
   });
   log.info("inbound", {
@@ -155,6 +162,38 @@ export async function dispatchInboundMessage(args: {
     team: message.teamId,
   });
+  if (args.blockExternals !== false && message.author?.isBot !== true) {
+    const userId = message.author?.userId ?? "";
+    const teamId = message.teamId;
+    if (teamId === undefined || teamId === "") {
+      log.info("inbound dropped (missing team)", {
+        kind,
+        channel: message.channelId,
+        thread_ts: message.threadTs,
+        user: userId,
+        event_id: args.eventId,
+      });
+      return;
+    }
+    if (
+      await isExternalSlackSender({
+        botToken: args.credentials?.botToken,
+        slackTeamId: teamId,
+        userId,
+      })
+    ) {
+      log.info("inbound dropped (external sender)", {
+        kind,
+        channel: message.channelId,
+        thread_ts: message.threadTs,
+        user: userId,
+        team: teamId,
+        event_id: args.eventId,
+      });
+      return;
+    }
+  }
   const continuation = slackContinuationKey(
     message.channelId,
     message.threadTs
@@ -463,6 +502,7 @@ export function dispatchInboundFromEventBody(
         log,
         evalCommandsEnabled: deps.evalCommandsEnabled,
         cursorAgentName: deps.cursorAgentName,
+        blockExternals: deps.blockExternals,
         ...(deps.hasContinuationSession === undefined
           ? {}
           : { hasContinuationSession: deps.hasContinuationSession }),
@@ -504,6 +544,7 @@ export function dispatchInboundFromEventBody(
         log,
         evalCommandsEnabled: deps.evalCommandsEnabled,
         cursorAgentName: deps.cursorAgentName,
+        blockExternals: deps.blockExternals,
         ...(deps.hasContinuationSession === undefined
           ? {}
           : { hasContinuationSession: deps.hasContinuationSession }),

package/src/channels/slack/external-policy.ts ADDED Viewed

@@ -0,0 +1,62 @@
+/**
+ * Workspace-membership checks for AgentKit Slack agents.
+ * Mirrors backend `isExternalSlackUser` (cloud-agent/slack/externalChannelPolicy).
+ */
+import { callSlackApi } from "./api.js";
+import type { SlackBotToken } from "./types.js";
+type SlackUserInfo = {
+  team_id?: string;
+  is_stranger?: boolean;
+  is_restricted?: boolean;
+  is_ultra_restricted?: boolean;
+  enterprise_user?: { teams?: string[] };
+};
+/** Pure classifier over a `users.info` user object. Fails open to external. */
+export function classifySlackUserExternality(args: {
+  slackTeamId: string;
+  user: SlackUserInfo;
+}): boolean {
+  const { slackTeamId, user } = args;
+  if (
+    user.is_stranger === true ||
+    user.is_restricted === true ||
+    user.is_ultra_restricted === true
+  ) {
+    return true;
+  }
+  return (
+    user.team_id !== undefined &&
+    user.team_id !== slackTeamId &&
+    !(user.enterprise_user?.teams ?? []).includes(slackTeamId)
+  );
+}
+/** Lookup + classify. Empty userId / API failure → external. */
+export async function isExternalSlackSender(args: {
+  botToken: SlackBotToken | undefined;
+  slackTeamId: string;
+  userId: string;
+}): Promise<boolean> {
+  if (args.userId === "") {
+    return true;
+  }
+  try {
+    const result = await callSlackApi({
+      botToken: args.botToken,
+      operation: "users.info",
+      body: { user: args.userId },
+    });
+    if (result.ok !== true || result.user === undefined) {
+      return true;
+    }
+    return classifySlackUserExternality({
+      slackTeamId: args.slackTeamId,
+      user: result.user as SlackUserInfo,
+    });
+  } catch {
+    return true;
+  }
+}