@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/src/http/webhooks.ts

@@ -31,6 +31,17 @@ import {
   isAzureDevOpsEnabled,
   verifyAzureDevOpsWebhook,
 } from "../azure-devops";
+import {
+  pullRequestCommentEventOf as bitbucketCommentEventOf,
+  pullRequestEventOf as bitbucketPullRequestEventOf,
+  handlePullRequestClosed as handleBitbucketPullRequestClosed,
+  handlePullRequestCommentCreated as handleBitbucketPullRequestCommentCreated,
+  handlePullRequestCreated as handleBitbucketPullRequestCreated,
+  isBitbucketEnabled,
+  isDuplicateDelivery as isDuplicateBitbucketDelivery,
+  markDeliveryProcessed as markBitbucketDeliveryProcessed,
+  verifyBitbucketWebhook,
+} from "../bitbucket";
 import type {
   CheckRunEvent,
   CheckSuiteEvent,
@@ -180,6 +191,28 @@ const azureDevOpsWebhook = route({
   },
 });
 
+const bitbucketWebhook = route({
+  method: "post",
+  path: "/api/bitbucket/webhook",
+  pattern: ["api", "bitbucket", "webhook"],
+  summary: "Handle Bitbucket Cloud webhook events",
+  tags: ["Webhooks"],
+  auth: { apiKey: false },
+  rbac: {
+    ungated:
+      "provider webhook: authenticated by the per-webhook HMAC secret, not a swarm principal",
+  },
+  responses: {
+    200: { description: "Event processed", schema: WebhookDispatchResultSchema },
+    401: { description: "Invalid signature" },
+    413: { description: "Body exceeds 1 MiB" },
+    503: { description: "Bitbucket integration not configured" },
+  },
+});
+
+/** Bitbucket Cloud event payloads are far below this. */
+const BITBUCKET_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+
 const agentmailWebhook = route({
   method: "post",
   path: "/api/agentmail/webhook",
@@ -710,6 +743,114 @@ export async function handleWebhooks(
     return true;
   }
 
+  // Bitbucket Cloud webhook — HMAC over the raw body, event keyed by X-Event-Key
+  if (bitbucketWebhook.match(req.method, pathSegments)) {
+    if (!isBitbucketEnabled()) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Bitbucket integration not configured" }));
+      return true;
+    }
+
+    // The body is read before the HMAC check, so cap it like the Chat SDK
+    // route: reject a declared or streamed body over the limit with 413.
+    if (enforceContentLengthCap(req, res, BITBUCKET_WEBHOOK_MAX_BODY_BYTES) === BODY_TOO_LARGE) {
+      return true;
+    }
+    const chunks: Buffer[] = [];
+    let receivedBytes = 0;
+    let tooLarge = false;
+    for await (const chunk of req) {
+      if (tooLarge) continue;
+      receivedBytes += (chunk as Buffer).byteLength;
+      if (receivedBytes > BITBUCKET_WEBHOOK_MAX_BODY_BYTES) {
+        tooLarge = true;
+        chunks.length = 0;
+        jsonError(res, `Payload too large (max ${BITBUCKET_WEBHOOK_MAX_BODY_BYTES} bytes)`, 413);
+        continue;
+      }
+      chunks.push(chunk as Buffer);
+    }
+    if (tooLarge) return true;
+    const rawBody = Buffer.concat(chunks).toString();
+
+    const signature = req.headers["x-hub-signature"] as string | undefined;
+    if (!verifyBitbucketWebhook(rawBody, signature)) {
+      console.log("[Bitbucket] Invalid webhook signature");
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid signature" }));
+      return true;
+    }
+
+    let body: unknown;
+    try {
+      body = JSON.parse(rawBody);
+    } catch {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid JSON body" }));
+      return true;
+    }
+
+    const eventKey = req.headers["x-event-key"] as string | undefined;
+    const requestUuid = req.headers["x-request-uuid"] as string | undefined;
+    if (isDuplicateBitbucketDelivery(requestUuid)) {
+      console.log(`[Bitbucket] Skipping duplicate delivery ${requestUuid}`);
+      bitbucketWebhook.respond(res, 200, { created: false });
+      return true;
+    }
+    console.log(`[Bitbucket] Received ${eventKey} event`);
+
+    try {
+      const result = await runBlockableHandler("Bitbucket", async () => {
+        switch (eventKey) {
+          case "pullrequest:created":
+            return await handleBitbucketPullRequestCreated(body);
+          case "pullrequest:comment_created":
+            return await handleBitbucketPullRequestCommentCreated(body);
+          case "pullrequest:fulfilled":
+            return await handleBitbucketPullRequestClosed(body, "merged");
+          case "pullrequest:rejected":
+            return await handleBitbucketPullRequestClosed(body, "declined");
+          default:
+            console.log(`[Bitbucket] Ignoring unsupported event type: ${eventKey}`);
+            return { created: false };
+        }
+      });
+
+      // Emit workflow trigger events for Bitbucket
+      const workflowEvent = {
+        "pullrequest:created": "created",
+        "pullrequest:comment_created": "commented",
+        "pullrequest:fulfilled": "merged",
+        "pullrequest:rejected": "declined",
+      }[eventKey ?? ""];
+      const prEvent = workflowEvent ? bitbucketPullRequestEventOf(body) : null;
+      if (workflowEvent && prEvent) {
+        const pr = prEvent.pullrequest;
+        const comment =
+          workflowEvent === "commented" ? bitbucketCommentEventOf(body)?.comment : undefined;
+        const user = comment?.user ?? prEvent.actor;
+        workflowEventBus.emit(`bitbucket.pull_request.${workflowEvent}`, {
+          repo: prEvent.repository.full_name,
+          number: pr.id,
+          ...(workflowEvent === "commented"
+            ? { body: comment?.content.raw }
+            : { title: pr.title, body: pr.description ?? undefined }),
+          action: workflowEvent,
+          user_login: user.account_id ?? user.nickname ?? user.display_name,
+        });
+      }
+
+      markBitbucketDeliveryProcessed(requestUuid);
+      bitbucketWebhook.respond(res, 200, result);
+    } catch (err) {
+      const errorMessage = err instanceof Error ? err.message : String(err);
+      console.error(`[Bitbucket] Error handling ${eventKey} event: ${scrubSecrets(errorMessage)}`);
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Internal server error" }));
+    }
+    return true;
+  }
+
   // AgentMail webhook — needs raw body for Svix signature verification
   if (agentmailWebhook.match(req.method, pathSegments)) {
     if (!isAgentMailEnabled()) {

package/src/integrations/chat-sdk/adapters.ts

@@ -1,5 +1,7 @@
+import type { TelegramMessage } from "@chat-adapter/telegram";
 import type { Adapter, Logger } from "chat";
 import { type ChatSdkAdapterName, type ResolvedAdapterConfig, readApiUrlOverrides } from "./config";
+import { isTelegramReplyToBot, type TelegramRawMessage } from "./facts";
 import { withInfoFilter } from "./logger";
 import { getChatSdkTestHooks } from "./test-hooks";
 
@@ -61,15 +63,29 @@ export async function loadAdapter(
   const base = { ...config, apiUrl, logger };
   switch (name) {
     case "telegram": {
-      const { createTelegramAdapter } = await import("@chat-adapter/telegram");
+      const { TelegramAdapter } = await import("@chat-adapter/telegram");
+      // The adapter's `mentionOnReply` skips a reply whose target id equals
+      // `message_thread_id`, meant for forum topic roots. A plain supergroup
+      // reply to a bot message that starts a reply chain has that same shape,
+      // so it was never a mention and never reached a handler. Core decides
+      // with `is_topic_message`, as the task header facts do.
+      class SwarmTelegramAdapter extends TelegramAdapter {
+        protected override isBotMentioned(message: TelegramMessage, text: string): boolean {
+          return (
+            super.isBotMentioned(message, text) ||
+            (String(message.from?.id) !== this.botUserId &&
+              isTelegramReplyToBot(message as TelegramRawMessage, this.botUserId))
+          );
+        }
+      }
       // Explicit `false` blocks the TELEGRAM_ALLOW_UNVERIFIED_WEBHOOKS env fallback.
       // Explicit `true` makes a reply to the bot a mention whatever
       // TELEGRAM_MENTION_ON_REPLY says.
-      return createTelegramAdapter({
+      return new SwarmTelegramAdapter({
         ...base,
         allowUnverifiedWebhooks: false,
         mentionOnReply: true,
-      } as Parameters<typeof createTelegramAdapter>[0]);
+      } as ConstructorParameters<typeof TelegramAdapter>[0]);
     }
     case "slack": {
       const { createSlackAdapter } = await import("@chat-adapter/slack");

package/src/integrations/chat-sdk/facts.ts

@@ -30,7 +30,7 @@ export interface ChatMessageFacts {
 
 const SNIPPET_MAX = 80;
 
-interface TelegramRawMessage {
+export interface TelegramRawMessage {
   message_id?: number;
   message_thread_id?: number;
   is_topic_message?: boolean;
@@ -57,16 +57,37 @@ function personLabel(name: string | undefined, username: string | undefined, fal
   return name || fallback;
 }
 
-function telegramFacts(raw: TelegramRawMessage, message: Message, botUserId?: string) {
+/**
+ * In a forum topic every plain message replies to the topic's creation
+ * message, so that reply is the topic, not an answer to anyone. Only
+ * `is_topic_message` marks a topic: a plain supergroup reply also carries
+ * `message_thread_id`, the id of its reply chain's first message.
+ */
+function replyIsTopicRoot(raw: TelegramRawMessage): boolean {
   const reply = raw.reply_to_message;
-  // In a forum topic every plain message replies to the topic's creation
-  // message, so that reply is the topic, not an answer to anyone.
-  const replyIsTopicRoot =
+  return (
     reply !== undefined &&
     (reply.forum_topic_created !== undefined ||
-      (raw.is_topic_message === true && reply.message_id === raw.message_thread_id));
-  const realReply = reply && !replyIsTopicRoot ? reply : undefined;
-  const topicName = replyIsTopicRoot ? reply?.forum_topic_created?.name : undefined;
+      (raw.is_topic_message === true && reply.message_id === raw.message_thread_id))
+  );
+}
+
+/** The raw Telegram message replies to one of the bot's own messages, not to a forum topic root. */
+export function isTelegramReplyToBot(raw: TelegramRawMessage, botUserId?: string): boolean {
+  const fromId = raw.reply_to_message?.from?.id;
+  return (
+    !replyIsTopicRoot(raw) &&
+    fromId !== undefined &&
+    botUserId !== undefined &&
+    String(fromId) === botUserId
+  );
+}
+
+function telegramFacts(raw: TelegramRawMessage, message: Message, botUserId?: string) {
+  const reply = raw.reply_to_message;
+  const topicRoot = replyIsTopicRoot(raw);
+  const realReply = reply && !topicRoot ? reply : undefined;
+  const topicName = topicRoot ? reply?.forum_topic_created?.name : undefined;
   const name = [raw.from?.first_name, raw.from?.last_name].filter(Boolean).join(" ").trim();
   return {
     chatType: raw.chat?.type,
@@ -79,10 +100,7 @@ function telegramFacts(raw: TelegramRawMessage, message: Message, botUserId?: st
           : `#${raw.message_thread_id}`
         : undefined,
     from: personLabel(name || undefined, raw.from?.username, message.author.userId),
-    replyToBot:
-      realReply?.from?.id !== undefined &&
-      botUserId !== undefined &&
-      String(realReply.from.id) === botUserId,
+    replyToBot: isTelegramReplyToBot(raw, botUserId),
     replyToSnippet: snippet(realReply?.text ?? realReply?.caption),
   } satisfies ChatMessageFacts;
 }

package/src/integrations/chat-sdk/outbound.ts

@@ -84,6 +84,42 @@ interface PostTarget {
   }): Promise<{ id: string; threadId?: string }>;
 }
 
+/** A fence opener or closer: up to 3 spaces, then 3+ backticks or tildes. */
+const FENCE_LINE = /^ {0,3}(`{3,}|~{3,})/;
+/**
+ * A `#` run at the start of a line's text (after blockquote, list and task
+ * markers) that CommonMark does not read as a heading: 7+ `#`, or `#` followed
+ * by a character other than whitespace or `#`.
+ */
+const NON_HEADING_HASH =
+  /^( {0,3}(?:>[ \t]?)*[ \t]*(?:(?:[-*+]|\d{1,9}[.)])[ \t]+(?:\[[ xX]\][ \t]+)?)?)(#{7,}|#{1,6}(?=[^\s#]))/;
+
+/**
+ * Telegram renders `{ markdown }` posts with `sendRichMessage`, and Telegram's
+ * own Markdown parser reads a line-leading `#2203` or `#tag` as a heading.
+ * Escape the first `#` of such a line so only CommonMark ATX headings
+ * (`# Title`) stay headings. Fenced code is left as is. The MarkdownV2
+ * fallback parses the escape back to a literal `#`.
+ */
+export function escapeTelegramHashLines(markdown: string): string {
+  let fence: string | undefined;
+  return markdown
+    .split("\n")
+    .map((line) => {
+      const marker = FENCE_LINE.exec(line)?.[1];
+      if (fence) {
+        if (marker && marker[0] === fence[0] && marker.length >= fence.length) fence = undefined;
+        return line;
+      }
+      if (marker) {
+        fence = marker;
+        return line;
+      }
+      return line.replace(NON_HEADING_HASH, "$1\\$2");
+    })
+    .join("\n");
+}
+
 async function postChunks(
   adapter: string,
   target: PostTarget,
@@ -92,7 +128,8 @@ async function postChunks(
   const messageIds: string[] = [];
   let threadId: string | undefined;
   for (const chunk of splitChatMessage(text, chatMessageLimit(adapter))) {
-    const sent = await target.post({ markdown: chunk });
+    const markdown = adapter === "telegram" ? escapeTelegramHashLines(chunk) : chunk;
+    const sent = await target.post({ markdown });
     messageIds.push(sent.id);
     threadId ??= sent.threadId;
   }

package/src/providers/acp-targets.ts

@@ -359,7 +359,7 @@ const copilotTargetProfile: AcpTargetProfile = {
   },
 };
 
-/** Qwen Code's `--auth-type` choices (0.25.3). `qwen-oauth` needs a browser, so it is left out. */
+/** Qwen Code's `--auth-type` choices (0.26.0). `qwen-oauth` needs a browser, so it is left out. */
 const QWEN_AUTH_TYPES = ["openai", "openai-responses", "anthropic", "gemini", "vertex-ai"] as const;
 
 // Qwen Code is a Gemini CLI fork: QWEN_SYSTEM_MD replaces its built-in prompt

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792584044-g15483c";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792670445-ge8d5b3";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/providers/pi-mono-adapter.ts

@@ -1523,8 +1523,10 @@ const DEFAULT_CODEMODE_LIMITS: CodemodeLimits = {
  * pi has no option for either: a script runs until it returns unless its own
  * `// @options` line sets `timeout_ms`. Both limits abort the signal pi hands
  * the sandbox, which interrupts the QuickJS worker and fails the codemode call.
- * A call refused by pi's process-wide worker cap waits for a free worker
- * within the same deadline instead of failing.
+ * pi 1.4 caps live codemode workers per process (two unless
+ * `PI_CODEMODE_MAX_WORKERS` raises it) and queues a script for a free one for
+ * at most 60 seconds. The deadline's abort also ends that wait, before the
+ * script starts.
  *
  * "on" keeps declared tools declared; "only" would hide the lifecycle tools
  * behind scripts. `models` stays off unless `PI_CODEMODE_MODELS` asks for it.
@@ -1551,43 +1553,6 @@ export function createBoundedCodemodeExtension(
     );
 }
 
-const CODEMODE_WORKER_RETRY_MIN_MS = 25;
-const CODEMODE_WORKER_RETRY_MAX_MS = 250;
-
-/**
- * pi 1.3 admits at most two live codemode workers per process, across all
- * sessions, and counts a stopped worker until its thread exits. A call over
- * that cap fails before the script runs. The runner hosts every task's pi
- * session in one process and pi runs a turn's tool calls in parallel, so a
- * third concurrent script, or one started right after another, can be
- * refused. Nothing ran (no nested calls, no store writes), so it is safe to
- * retry until a worker frees up, within the same deadline.
- */
-function isCodemodeWorkerLimitRefusal(result: {
-  content: Array<{ type: string; text?: string }>;
-  details?: unknown;
-  isError?: boolean;
-}): boolean {
-  if (!result.isError) return false;
-  const calls = (result.details as { calls?: unknown[] } | undefined)?.calls;
-  if (calls && calls.length > 0) return false;
-  return result.content.some((item) =>
-    item.text?.includes("Script sandbox failed: Codemode worker limit reached"),
-  );
-}
-
-function abortableSleep(ms: number, signal: AbortSignal): Promise<void> {
-  return new Promise((resolve) => {
-    const timer = setTimeout(done, ms);
-    function done() {
-      clearTimeout(timer);
-      signal.removeEventListener("abort", done);
-      resolve();
-    }
-    signal.addEventListener("abort", done, { once: true });
-  });
-}
-
 export function boundCodemodeTool(tool: ToolDefinition, limits: CodemodeLimits): ToolDefinition {
   return {
     ...tool,
@@ -1653,20 +1618,7 @@ export function boundCodemodeTool(tool: ToolDefinition, limits: CodemodeLimits):
         : ctx;
 
       try {
-        let delayMs = CODEMODE_WORKER_RETRY_MIN_MS;
-        for (;;) {
-          const result = await tool.execute(
-            toolCallId,
-            params,
-            script.signal,
-            onUpdate,
-            boundedCtx,
-          );
-          if (!isCodemodeWorkerLimitRefusal(result) || script.signal.aborted) return result;
-          await abortableSleep(delayMs, script.signal);
-          if (script.signal.aborted) return result;
-          delayMs = Math.min(delayMs * 2, CODEMODE_WORKER_RETRY_MAX_MS);
-        }
+        return await tool.execute(toolCallId, params, script.signal, onUpdate, boundedCtx);
       } finally {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onOuterAbort);

package/src/scripts-runtime/types/swarm-extension.d.ts

@@ -15,6 +15,7 @@ declare module "swarm-extension" {
       | "github"
       | "gitlab"
       | "azure-devops"
+      | "bitbucket"
       | "system"
       | "linear"
       | "jira"
@@ -41,7 +42,7 @@ declare module "swarm-extension" {
     slackTriggerMessageTs?: string | undefined;
     slackUserId?: string | undefined;
     overrideSlackContext?: boolean | undefined;
-    vcsProvider?: "github" | "gitlab" | "azure-devops" | undefined;
+    vcsProvider?: "github" | "gitlab" | "azure-devops" | "bitbucket" | undefined;
     vcsRepo?: string | undefined;
     vcsEventType?: string | undefined;
     vcsNumber?: number | undefined;
@@ -132,6 +133,7 @@ declare module "swarm-extension" {
       | "github"
       | "gitlab"
       | "azure-devops"
+      | "bitbucket"
       | "system"
       | "linear"
       | "jira"
@@ -172,7 +174,7 @@ declare module "swarm-extension" {
     slackUserId?: string | undefined;
     slackProgressMessageTs?: string | undefined;
     slackTreeRootMessageTs?: string | undefined;
-    vcsProvider?: "github" | "gitlab" | "azure-devops" | undefined;
+    vcsProvider?: "github" | "gitlab" | "azure-devops" | "bitbucket" | undefined;
     vcsRepo?: string | undefined;
     vcsEventType?: string | undefined;
     vcsNumber?: number | undefined;
@@ -625,7 +627,7 @@ declare module "swarm-extension" {
     /** The text, or a placeholder naming the type for a non-text message. */
     text: string;
   }
-  export type VcsProvider = "github" | "gitlab" | "azure-devops";
+  export type VcsProvider = "github" | "gitlab" | "azure-devops" | "bitbucket";
   /**
    * The provider object the event is about, as the provider names it. GitLab
    * calls a pull request a merge request, and a comment a `note`.
@@ -648,7 +650,7 @@ declare module "swarm-extension" {
     provider: VcsProvider;
     kind: VcsEventKind;
     action: string;
-    /** `owner/name` on GitHub and GitLab, the repository URL on Azure DevOps. */
+    /** `owner/name` on GitHub and GitLab, `workspace/repo_slug` on Bitbucket, the repository URL on Azure DevOps. */
     repo: string;
     /** The PR, merge request, or issue number. Absent for a pipeline outside a merge request. */
     number?: number;

package/src/slack/handlers.test.ts

@@ -20,6 +20,7 @@ import {
   checkUserAccess,
   isBotMessage,
   isSwarmThreadRoot,
+  type isUserAllowed,
   registerMessageHandler,
   type UserFilterConfig,
 } from "./handlers";
@@ -189,6 +190,163 @@ describe("checkUserAccess", () => {
   });
 });
 
+describe("isUserAllowed", () => {
+  const usersInfo = mock(async () => ({ ok: true, user: {} }));
+  const client = { users: { info: usersInfo } } as never;
+  let enrichSpy: ReturnType<typeof spyOn<typeof slackEnrichModule, "enrichSlackUserEmail">>;
+  let logSpy: ReturnType<typeof spyOn<typeof console, "log">>;
+
+  // handlers.ts reads SLACK_ALLOWED_* once at module load, so each case evaluates a fresh
+  // copy under its own env and calls the production two-argument isUserAllowed. The copy
+  // shares ./enrich with this file, so the enrichSlackUserEmail spy still applies.
+  const ENV_KEYS = ["SLACK_ALLOWED_EMAIL_DOMAINS", "SLACK_ALLOWED_USER_IDS"] as const;
+  let loadCount = 0;
+  async function loadIsUserAllowed(env: {
+    SLACK_ALLOWED_EMAIL_DOMAINS?: string;
+    SLACK_ALLOWED_USER_IDS?: string;
+  }): Promise<typeof isUserAllowed> {
+    const saved = ENV_KEYS.map((key) => [key, process.env[key]] as const);
+    try {
+      for (const key of ENV_KEYS) {
+        if (env[key] === undefined) delete process.env[key];
+        else process.env[key] = env[key];
+      }
+      loadCount += 1;
+      const fresh = (await import(`./handlers?env=${loadCount}`)) as typeof import("./handlers");
+      return fresh.isUserAllowed;
+    } finally {
+      for (const [key, value] of saved) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  }
+
+  beforeEach(() => {
+    usersInfo.mockClear();
+    enrichSpy = spyOn(slackEnrichModule, "enrichSlackUserEmail");
+    logSpy = spyOn(console, "log").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    enrichSpy.mockRestore();
+    logSpy.mockRestore();
+  });
+
+  const loggedLines = () => logSpy.mock.calls.map((call) => String(call[0]));
+
+  describe("filtering off (neither env var set)", () => {
+    test("allows everyone without an email lookup", async () => {
+      const allowed = await loadIsUserAllowed({});
+      expect(await allowed(client, "U_ANY")).toBe(true);
+      expect(enrichSpy).not.toHaveBeenCalled();
+      expect(usersInfo).not.toHaveBeenCalled();
+    });
+
+    test("treats blank and comma-only values as unset", async () => {
+      const allowed = await loadIsUserAllowed({
+        SLACK_ALLOWED_EMAIL_DOMAINS: " , ",
+        SLACK_ALLOWED_USER_IDS: ",",
+      });
+      expect(await allowed(client, "U_ANY")).toBe(true);
+      expect(enrichSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("user IDs only", () => {
+    const env = { SLACK_ALLOWED_USER_IDS: " U_LISTED , U_SECOND ," };
+
+    test("allows trimmed allowlisted IDs without an email lookup", async () => {
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_LISTED")).toBe(true);
+      expect(await allowed(client, "U_SECOND")).toBe(true);
+      expect(enrichSpy).not.toHaveBeenCalled();
+      expect(usersInfo).not.toHaveBeenCalled();
+    });
+
+    test("denies an unlisted ID without an email lookup", async () => {
+      enrichSpy.mockResolvedValue("person@company.com");
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(false);
+      expect(enrichSpy).not.toHaveBeenCalled();
+      expect(usersInfo).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("email domains only", () => {
+    const env = { SLACK_ALLOWED_EMAIL_DOMAINS: " Company.COM , other.org " };
+
+    test("allows trimmed, case-insensitive domains after one lookup", async () => {
+      const allowed = await loadIsUserAllowed(env);
+      enrichSpy.mockResolvedValue("person@company.com");
+      expect(await allowed(client, "U_A")).toBe(true);
+      enrichSpy.mockResolvedValue("person@Other.Org");
+      expect(await allowed(client, "U_B")).toBe(true);
+      expect(enrichSpy).toHaveBeenCalledTimes(2);
+      expect(enrichSpy).toHaveBeenNthCalledWith(1, client, "U_A");
+      expect(enrichSpy).toHaveBeenNthCalledWith(2, client, "U_B");
+      expect(loggedLines()).toEqual([]);
+    });
+
+    test("denies and logs a domain that is not allowed", async () => {
+      enrichSpy.mockResolvedValue("person@evil.com");
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(false);
+      expect(loggedLines()).toEqual([
+        '[Slack] User U_OTHER email domain "evil.com" not in allowed list',
+      ]);
+    });
+  });
+
+  describe("user IDs and email domains", () => {
+    const env = {
+      SLACK_ALLOWED_EMAIL_DOMAINS: "company.com",
+      SLACK_ALLOWED_USER_IDS: "U_LISTED",
+    };
+
+    test("allows an allowlisted ID without an email lookup", async () => {
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_LISTED")).toBe(true);
+      expect(enrichSpy).not.toHaveBeenCalled();
+      expect(usersInfo).not.toHaveBeenCalled();
+    });
+
+    test("allows an unlisted ID whose email domain is allowed", async () => {
+      enrichSpy.mockResolvedValue("person@Company.com");
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(true);
+      expect(enrichSpy).toHaveBeenCalledTimes(1);
+      expect(enrichSpy).toHaveBeenCalledWith(client, "U_OTHER");
+      expect(loggedLines()).toEqual([]);
+    });
+
+    test("denies and logs a domain that is not allowed", async () => {
+      enrichSpy.mockResolvedValue("person@other.com");
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(false);
+      expect(loggedLines()).toEqual([
+        '[Slack] User U_OTHER email domain "other.com" not in allowed list',
+      ]);
+    });
+
+    test("denies and logs a user with no email", async () => {
+      enrichSpy.mockResolvedValue(null);
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(false);
+      expect(loggedLines()).toEqual(["[Slack] User U_OTHER has no email, denying access"]);
+    });
+
+    test("denies and logs a user with a malformed email", async () => {
+      enrichSpy.mockResolvedValue("no-at-sign");
+      const allowed = await loadIsUserAllowed(env);
+      expect(await allowed(client, "U_OTHER")).toBe(false);
+      expect(loggedLines()).toEqual([
+        "[Slack] User U_OTHER has invalid email format, denying access",
+      ]);
+    });
+  });
+});
+
 // Helper to create a minimal SlackFile for testing
 function makeFile(overrides: Partial<SlackFile> = {}): SlackFile {
   return {