@misterhuydo/sentinel 1.5.5 → 1.5.7

package/python/sentinel/notify.py

@@ -193,6 +193,35 @@ def slack_dm(bot_token: str, user_id: str, text: str) -> None:
         logger.warning("slack_dm: failed to DM %s: %s", user_id, exc)
 
 
+def notify_nexus_auth_failure(cfg, repo_name: str, context: str, mvn_output: str) -> None:
+    """
+    DM the first admin user when a Maven build fails due to missing/invalid Nexus credentials.
+    Called from git_manager, dependency_manager, and sentinel_boss (chain_release) when
+    MavenAuthError is raised.
+    """
+    if not cfg.slack_admin_users or not cfg.slack_bot_token:
+        logger.warning("Cannot DM admin about Nexus auth failure — no admin users or bot token configured")
+        return
+    snippet = mvn_output[-400:].strip() if mvn_output else ""
+    lines = [
+        f":lock: *Maven authentication failed* during `{context}` on `{repo_name}`",
+        "",
+        "Nexus credentials in `~/.m2/settings.xml` are missing or invalid.",
+        "",
+        "Fix it by sending me one of:",
+        "",
+        "*Option 1 — paste your settings.xml*",
+        "`nexus settings`",
+        "then the full XML content on the next line(s).",
+        "",
+        "*Option 2 — credentials per host*",
+        "`nexus creds <host> <username> <password>`",
+    ]
+    if snippet:
+        lines += ["", f"```\n{snippet}\n```"]
+    slack_dm(cfg.slack_bot_token, cfg.slack_admin_users[0], "\n".join(lines))
+
+
 def notify_fix_blocked(
     cfg,
     source: str,
@@ -200,13 +229,13 @@ def notify_fix_blocked(
     reason: str,
     repo_name: str = "",
     submitter_user_id: str = "",
+    origin_channel: str = "",
 ) -> None:
     """
     Notify that a fix needs human intervention.
 
-    - If submitter_user_id is known: DM that person directly.
-    - Otherwise: @channel in the configured Slack channel.
-    - Always: email admins via reporter.send_failure_notification.
+    Posts to origin_channel if set (where the issue was raised), otherwise
+    falls back to cfg.slack_channel. Always emails admins.
     """
     short_reason = (reason or "Claude could not determine a safe fix.")[:600]
     repo_line = f"\n*Repo:* {repo_name}" if repo_name else ""
@@ -218,11 +247,11 @@ def notify_fix_blocked(
         f"*Reason:*\n{short_reason}"
     )
 
-    # Post to channel — mention submitter if known, otherwise broadcast
+    target_channel = origin_channel or cfg.slack_channel
     if submitter_user_id:
-        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<@{submitter_user_id}> {slack_text}")
+        slack_alert(cfg.slack_bot_token, target_channel, f"<@{submitter_user_id}> {slack_text}")
     else:
-        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<!channel> {slack_text}")
+        slack_alert(cfg.slack_bot_token, target_channel, f"<!channel> {slack_text}")
 
     # Always email admins
     try:
@@ -260,6 +289,7 @@ def notify_missing_tool(
     repo_name: str,
     source: str,
     submitter_user_id: str = "",
+    origin_channel: str = "",
 ) -> None:
     """
     Notify admins that a build tool is missing on this server.
@@ -282,10 +312,11 @@ def notify_missing_tool(
         f"*How to fix:*\n{steps}\n\n"
         f"Then tell me: `retry {repo_name or source}`"
     )
+    target_channel = origin_channel or cfg.slack_channel
     if submitter_user_id:
-        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<@{submitter_user_id}> {slack_text}")
+        slack_alert(cfg.slack_bot_token, target_channel, f"<@{submitter_user_id}> {slack_text}")
     else:
-        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<!channel> {slack_text}")
+        slack_alert(cfg.slack_bot_token, target_channel, f"<!channel> {slack_text}")
 
 
 def notify_fix_applied(
@@ -296,10 +327,11 @@ def notify_fix_applied(
     branch: str,
     pr_url: str,
     submitter_user_id: str = "",
+    origin_channel: str = "",
 ) -> None:
     """
-    DM the submitter (if known) that their issue was fixed.
-    Falls back to posting in the Slack channel if no submitter.
+    Notify that a fix was applied. Posts to origin_channel if set (where
+    the issue was raised), otherwise falls back to cfg.slack_channel.
     """
     repo_line = f" in *{repo_name}*" if repo_name else ""
     if pr_url:
@@ -315,9 +347,9 @@ def notify_fix_applied(
         + (f"{action_line}\n" if action_line else "")
     ).rstrip()
 
-    # Post to channel — mention submitter if known
+    target_channel = origin_channel or cfg.slack_channel
     channel_text = f"<@{submitter_user_id}> {slack_text}" if submitter_user_id else slack_text
-    slack_alert(cfg.slack_bot_token, cfg.slack_channel, channel_text)
+    slack_alert(cfg.slack_bot_token, target_channel, channel_text)
 
 
 def notify_cascade_started(

package/python/sentinel/repo_task_engine.py

@@ -12,6 +12,7 @@ File format:
     TYPE: feature|fix|refactor|chore
     SUBMITTED_BY: <@UXXX> (UXXX)
     SUBMITTED_AT: 2026-03-27T10:00:00+00:00
+    RUN_AT: 2026-03-28T02:00:00+00:00  # optional — task is held until this UTC time
     NOTIFY: U1234567,U7654321          # optional
 
     Full task description — what to implement, fix, or refactor.
@@ -33,7 +34,7 @@ from .git_manager import _git_env
 
 logger = logging.getLogger(__name__)
 
-_META_PREFIXES = ("REPO:", "TYPE:", "SUBMITTED_BY:", "SUBMITTED_AT:", "NOTIFY:")
+_META_PREFIXES = ("REPO:", "TYPE:", "SUBMITTED_BY:", "SUBMITTED_AT:", "RUN_AT:", "NOTIFY:")
 _TASK_TIMEOUT = 900  # 15 minutes
 
 
@@ -48,6 +49,7 @@ class RepoTask:
     notify_user_ids: list = field(default_factory=list)
     fingerprint: str = ""
     timestamp: str = ""
+    run_at: datetime | None = None  # UTC; task is held until this time if set
 
     def __post_init__(self):
         if not self.fingerprint:
@@ -331,8 +333,13 @@ def drop_repo_task(
     description: str,
     submitter_user_id: str = "",
     notify_user_ids: list | None = None,
+    run_at: datetime | None = None,
 ) -> Path:
-    """Drop a repo task file into <project_dir>/repo-tasks/."""
+    """Drop a repo task file into <project_dir>/repo-tasks/.
+
+    If run_at (UTC-aware datetime) is given the task will be held by the poll
+    loop until that time has passed before executing.
+    """
     tasks_dir = project_dir / "repo-tasks"
     tasks_dir.mkdir(exist_ok=True)
     import uuid as _uuid
@@ -346,11 +353,16 @@ def drop_repo_task(
          if submitter_user_id else "SUBMITTED_BY: system"),
         f"SUBMITTED_AT: {datetime.now(timezone.utc).isoformat()}",
     ]
+    if run_at is not None:
+        lines.append(f"RUN_AT: {run_at.astimezone(timezone.utc).isoformat()}")
     if notify_user_ids:
         lines.append(f"NOTIFY: {','.join(notify_user_ids)}")
     lines += ["", description]
     fpath.write_text("\n".join(lines), encoding="utf-8")
-    logger.info("Dropped repo task: %s", fname)
+    if run_at:
+        logger.info("Dropped repo task (scheduled): %s — run_at=%s", fname, run_at.isoformat())
+    else:
+        logger.info("Dropped repo task: %s", fname)
     return fpath
 
 
@@ -375,6 +387,7 @@ def scan_repo_tasks(project_dir: Path) -> list[RepoTask]:
         task_type = "feature"
         submitter_user_id = ""
         notify_user_ids: list = []
+        run_at: datetime | None = None
         body_start = 0
 
         for i, line in enumerate(lines):
@@ -392,6 +405,13 @@ def scan_repo_tasks(project_dir: Path) -> list[RepoTask]:
                 if m:
                     submitter_user_id = m.group(1)
                 body_start = i + 1
+            elif upper.startswith("RUN_AT:"):
+                raw_ts = stripped[7:].strip()
+                try:
+                    run_at = datetime.fromisoformat(raw_ts).astimezone(timezone.utc)
+                except ValueError:
+                    logger.warning("Repo task %s: invalid RUN_AT value '%s' — ignoring", f.name, raw_ts)
+                body_start = i + 1
             elif upper.startswith("NOTIFY:"):
                 notify_user_ids = [u.strip() for u in stripped[7:].split(",") if u.strip()]
                 body_start = i + 1
@@ -407,6 +427,19 @@ def scan_repo_tasks(project_dir: Path) -> list[RepoTask]:
             logger.warning("Repo task %s has no REPO: header — skipping", f.name)
             continue
 
+        # Hold scheduled tasks until their run_at time has passed
+        if run_at is not None:
+            now_utc = datetime.now(timezone.utc)
+            if now_utc < run_at:
+                remaining = run_at - now_utc
+                hours, rem = divmod(int(remaining.total_seconds()), 3600)
+                minutes = rem // 60
+                logger.debug(
+                    "Repo task %s scheduled for %s — holding (%dh %dm remaining)",
+                    f.name, run_at.isoformat(), hours, minutes,
+                )
+                continue
+
         tasks.append(RepoTask(
             task_file=f,
             repo_name=repo_name,
@@ -415,6 +448,7 @@ def scan_repo_tasks(project_dir: Path) -> list[RepoTask]:
             message=message,
             submitter_user_id=submitter_user_id,
             notify_user_ids=notify_user_ids,
+            run_at=run_at,
         ))
         logger.info("Found repo task: %s → %s (type=%s)", f.name, repo_name, task_type)
 

package/python/sentinel/sentinel_boss.py

@@ -516,6 +516,8 @@ When to act vs. when to ask:
 - Write/action tools (create_issue, trigger_poll, pull_repo, pause_sentinel, install_tool, merge_pr,
   retry_issue, cancel_issue, post_file) → act immediately for clear commands; confirm only when intent is ambiguous
   (e.g. unclear which project or repo to target).
+- trigger_poll → trigger it, then IMMEDIATELY call get_status and report what is happening.
+  Never stop at "poll triggered" — the human wants to know the outcome, not that the trigger was sent.
 - Explaining a tool ("what does X do?") → explain naturally, then offer to run it if relevant.
 - NEVER gate investigation on user approval. If diagnosing a problem, run all relevant read tools
   first, then present findings. Asking "Want me to look?" wastes a round trip.
@@ -578,7 +580,9 @@ Sentinel is a 24/7 autonomous agent. Act on clear signals without asking permiss
 3. Populate `findings` with curated evidence — only when relevant and concise:
    - Summarise: which services, how often, key pattern, 1-3 example lines. Max 500 words.
    - Do NOT paste raw tool output.
-4. After creating, tell them the issue was queued and Sentinel will pick it up on the next poll.
+4. After creating, immediately call get_status and report: how many items are now in the queue,
+   what is already in progress, and when the next poll will pick things up.
+   Tell them they will get an @mention in this channel when the fix is applied or blocked.
 
 Autonomous action policy — Sentinel acts, humans review outcomes:
 - Read/investigate tools → always act immediately, no confirmation needed.
@@ -588,6 +592,35 @@ Autonomous action policy — Sentinel acts, humans review outcomes:
 - pause_sentinel → confirm once (halts all monitoring).
 - Everything else → use judgment. When in doubt, act and report what you did.
 
+PROACTIVE COMMUNICATION — CRITICAL RULES:
+You are a push-first agent. The engineer should NEVER have to ask for a status update
+on something you already know about or can find out.
+
+BANNED phrases (never say these):
+- "Want me to check again in a few minutes?"
+- "Should I check on that?"
+- "I'll keep an eye on it."
+- "I'll monitor that for you."
+- "Let me know if you'd like an update."
+- Anything that puts the follow-up burden back on the human.
+
+Instead:
+- If checking is warranted → check now, report the result in the same message.
+- If something is running async (fix, task, poll) → tell the human EXACTLY what automated
+  notification they will receive and when. Example: "The main loop will post here when the
+  fix is applied or fails — usually within 2–3 minutes."
+- After trigger_poll → wait for it, then call get_status immediately and report findings.
+  Do not stop at "poll triggered" — that is not an answer, it is a non-answer.
+
+The main poll loop sends proactive Slack messages automatically when:
+- A fix is applied (commit + PR opened)
+- A fix is blocked (test failure, patch too large, etc.)
+- A fix is confirmed (no recurrence for MARKER_CONFIRM_HOURS)
+- A repo task or dev task completes or fails
+- A health check recovers
+You do NOT need to promise to monitor — the system already does it. Tell users this explicitly
+when it is relevant, then end with [DONE].
+
 When the engineer's request is fully handled, end your LAST message with the token: [DONE]
 IMPORTANT: Always write your actual reply text FIRST, then append [DONE] at the end. Example: "Hello! I'm Sentinel. [DONE]". Never output [DONE] as your only content.
 For greetings like "hello" or empty messages, introduce yourself briefly and offer help, then end with [DONE].
@@ -657,9 +690,11 @@ _TOOLS = [
     {
         "name": "get_status",
         "description": (
-            "Get recent errors, fixes applied, fixes pending review, and open PRs. "
+            "Get recent errors, fixes applied, fixes pending review, open PRs, "
+            "and the live task queue (issues and repo tasks waiting to be picked up). "
             "Use for: 'what happened today?', 'any issues?', 'how are things?', "
-            "'what are the open PRs?', 'did sentinel fix anything?'"
+            "'what are the open PRs?', 'did sentinel fix anything?', "
+            "'what is queued?', 'what is pending?', 'progress on X?'"
         ),
         "input_schema": {
             "type": "object",
@@ -814,12 +849,13 @@ _TOOLS = [
     {
         "name": "repo_task",
         "description": (
-            "ADMIN ONLY. Submit a feature, fix, or refactor task for a managed repo. "
+            "ADMIN ONLY. Submit a feature, fix, refactor, or scheduled deploy task for a managed repo. "
             "Claude Code will run against the repo's local clone, implement the change, "
             "commit, and push (or open a PR if AUTO_PUBLISH=false). "
             "ALWAYS gather a complete spec first — ask follow-up questions until unambiguous. "
             "Use for: 'add X to elprint-connector-service', 'fix Y in cairn', "
-            "'refactor OrderService', any human-requested change to a managed repo."
+            "'refactor OrderService', 'deploy UIB at 3 AM tomorrow', "
+            "any human-requested change to a managed repo — immediate or scheduled."
         ),
         "input_schema": {
             "type": "object",
@@ -843,6 +879,16 @@ _TOOLS = [
                     "items": {"type": "string"},
                     "description": "Extra Slack user IDs to ping on completion (besides the submitter).",
                 },
+                "run_at": {
+                    "type": "string",
+                    "description": (
+                        "Optional. Schedule the task for a future time. "
+                        "Accepts natural language (e.g. '3 AM tomorrow Norwegian time', "
+                        "'kl 03:00 norsk tid', 'at 15:30 CET', 'in 2 hours') "
+                        "or an ISO 8601 datetime string. "
+                        "If omitted the task runs immediately on the next poll cycle."
+                    ),
+                },
             },
             "required": ["repo_name", "description"],
         },
@@ -1628,6 +1674,79 @@ _TOOLS = [
 ]
 
 
+# ── Scheduling helpers ────────────────────────────────────────────────────────
+
+def _parse_run_at(raw: str) -> tuple:
+    """Parse a natural-language or ISO 8601 time expression into a UTC-aware datetime.
+
+    Returns (datetime, None) on success, (None, error_str) on failure.
+
+    Understands:
+      - ISO 8601 strings with or without timezone
+      - "at HH:MM [TZ]"  /  "kl HH:MM [norsk tid|CET|CEST|Oslo]"
+      - "in N hours/minutes"
+      - "tomorrow" modifier before or after HH:MM
+      - Norwegian timezone keywords → Europe/Oslo
+    """
+    import re as _re
+    from datetime import datetime as _dt, timezone as _tz, timedelta as _td
+
+    _UTC = _tz.utc
+
+    # Build Oslo timezone — prefer zoneinfo (accurate DST), fall back to fixed offset
+    try:
+        import zoneinfo as _zi
+        _OSLO = _zi.ZoneInfo("Europe/Oslo")
+    except Exception:
+        # tzdata not installed or unavailable; use fixed UTC+1 (CET, conservative)
+        _OSLO = _tz(_td(hours=1))  # type: ignore[assignment]
+
+    raw_l = raw.lower().strip()
+
+    # ── ISO 8601 ───────────────────────────────────────────────────────────────
+    try:
+        parsed = _dt.fromisoformat(raw)
+        if parsed.tzinfo is None:
+            parsed = parsed.replace(tzinfo=_OSLO)
+        return parsed.astimezone(_UTC), None
+    except ValueError:
+        pass
+
+    # ── "in N hours/minutes" ──────────────────────────────────────────────────
+    m = _re.search(r'in\s+(\d+)\s*(hour|hr|minute|min)', raw_l)
+    if m:
+        n = int(m.group(1))
+        unit = m.group(2)
+        delta = _td(hours=n) if unit.startswith("h") else _td(minutes=n)
+        return _dt.now(_UTC) + delta, None
+
+    # ── "at HH:MM" / "kl HH:MM" with optional TZ and "tomorrow" ──────────────
+    m = _re.search(r'(?:kl\.?\s*|at\s+)?(\d{1,2})[:\.](\d{2})', raw_l)
+    if m:
+        hour, minute = int(m.group(1)), int(m.group(2))
+
+        tz_hint = raw_l
+        if any(kw in tz_hint for kw in ("norsk", "oslo", "norway", "norwegian", "cet", "cest")):
+            tz = _OSLO
+        elif "utc" in tz_hint:
+            tz = _UTC
+        else:
+            tz = _OSLO  # default for this project
+
+        today = _dt.now(tz).date()
+        tomorrow = today + _td(days=1)
+        base_date = tomorrow if "tomorrow" in raw_l or "i morgen" in raw_l else today
+
+        candidate = _dt(base_date.year, base_date.month, base_date.day, hour, minute, tzinfo=tz)
+        # If the time is already past today, roll to tomorrow automatically
+        if candidate <= _dt.now(tz) and "tomorrow" not in raw_l and "i morgen" not in raw_l:
+            candidate += _td(days=1)
+
+        return candidate.astimezone(_UTC), None
+
+    return None, f"Unrecognised time expression: '{raw}'"
+
+
 # ── Workspace helpers ─────────────────────────────────────────────────────────
 
 def _workspace_dir() -> Path:
@@ -1745,6 +1864,61 @@ async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=Non
             }
             for e in errors[:8]
         ]
+
+        # ── Live queue scan ────────────────────────────────────────────────────
+        # Show what is physically in the queue dirs, not just what is in the DB.
+        from datetime import datetime as _dt, timezone as _tz
+        _now = _dt.now(_tz.utc)
+
+        def _queue_entries(queue_dir: Path) -> list[dict]:
+            """Return pending task/issue files with age and first-line preview."""
+            entries = []
+            if not queue_dir.exists():
+                return entries
+            for f in sorted(queue_dir.iterdir()):
+                if not f.is_file() or f.name.startswith("."):
+                    continue
+                try:
+                    lines = f.read_text(encoding="utf-8", errors="replace").splitlines()
+                except OSError:
+                    continue
+                # Parse RUN_AT if present (scheduled tasks held for the future)
+                run_at_str = next(
+                    (l.split(":", 1)[1].strip() for l in lines
+                     if l.strip().upper().startswith("RUN_AT:")), None
+                )
+                run_at_dt = None
+                if run_at_str:
+                    try:
+                        run_at_dt = _dt.fromisoformat(run_at_str).astimezone(_tz.utc)
+                    except ValueError:
+                        pass
+                age_s = int((_now - _dt.fromtimestamp(f.stat().st_mtime, _tz.utc)).total_seconds())
+                preview = next((l.strip() for l in lines if l.strip() and not l.strip().upper().startswith(
+                    ("REPO:", "TYPE:", "SUBMITTED_BY:", "SUBMITTED_AT:", "RUN_AT:", "NOTIFY:",
+                     "SOURCE:", "TARGET_REPO:", "FINGERPRINT:", "SUPPORT_URL:")
+                )), f.name)
+                entry = {
+                    "file": f.name,
+                    "age_seconds": age_s,
+                    "preview": preview[:120],
+                }
+                if run_at_dt:
+                    remaining = int((run_at_dt - _now).total_seconds())
+                    if remaining > 0:
+                        entry["scheduled_in_seconds"] = remaining
+                        entry["scheduled_at"] = run_at_dt.isoformat()
+                entries.append(entry)
+            return entries
+
+        _project_dirs = _find_project_dirs()
+        _pd = _project_dirs[0] if _project_dirs else Path(".")
+        queued_issues     = _queue_entries(_pd / "issues")
+        queued_repo_tasks = _queue_entries(_pd / "repo-tasks")
+        # Scheduled tasks are repo-tasks with a future run_at
+        scheduled_tasks   = [t for t in queued_repo_tasks if "scheduled_in_seconds" in t]
+        pending_repo_tasks = [t for t in queued_repo_tasks if "scheduled_in_seconds" not in t]
+
         return json.dumps({
             "window_hours":    hours,
             "errors_detected": len(errors),
@@ -1762,6 +1936,9 @@ async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=Non
                 for p in prs
             ],
             "sentinel_paused": Path("SENTINEL_PAUSE").exists(),
+            "queued_issues":       queued_issues,
+            "queued_repo_tasks":   pending_repo_tasks,
+            "scheduled_tasks":     scheduled_tasks,
         })
 
     if name == "check_auth_status":
@@ -2181,6 +2358,15 @@ async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=Non
         if isinstance(notify_ids, list):
             notify_ids = [u for u in notify_ids if u and u != user_id]
 
+        # Parse optional scheduled time
+        run_at_raw = (inputs.get("run_at") or "").strip()
+        run_at_dt = None
+        run_at_parse_error = None
+        if run_at_raw:
+            run_at_dt, run_at_parse_error = _parse_run_at(run_at_raw)
+            if run_at_parse_error:
+                return json.dumps({"error": f"Could not parse run_at: {run_at_parse_error}"})
+
         _project_dirs = _find_project_dirs()
         if not _project_dirs:
             return json.dumps({"error": "No project directory found."})
@@ -2193,8 +2379,29 @@ async def _run_tool(name: str, inputs: dict, cfg_loader, store, slack_client=Non
             description=description,
             submitter_user_id=user_id,
             notify_user_ids=notify_ids,
+            run_at=run_at_dt,
+        )
+        logger.info(
+            "Boss repo_task: dropped %s for user %s (repo=%s, run_at=%s)",
+            task_file.name, user_id, repo_name,
+            run_at_dt.isoformat() if run_at_dt else "immediate",
         )
-        logger.info("Boss repo_task: dropped %s for user %s (repo=%s)", task_file.name, user_id, repo_name)
+        if run_at_dt:
+            import zoneinfo as _zi
+            oslo = _zi.ZoneInfo("Europe/Oslo")
+            local_str = run_at_dt.astimezone(oslo).strftime("%Y-%m-%d %H:%M %Z")
+            return json.dumps({
+                "status": "scheduled",
+                "repo": repo_name,
+                "task_type": task_type,
+                "file": task_file.name,
+                "run_at_utc": run_at_dt.isoformat(),
+                "run_at_local": local_str,
+                "note": (
+                    f"Task scheduled for `{repo_name}` at {local_str} — "
+                    "Sentinel will pick it up automatically when the time arrives."
+                ),
+            })
         return json.dumps({
             "status": "queued",
             "repo": repo_name,

package/python/sentinel/slack_bot.py

@@ -60,6 +60,10 @@ async def _get_or_create_session(user_id: str, user_name: str, channel: str) ->
     async with _sessions_lock:
         if user_id not in _sessions:
             _sessions[user_id] = _Session(user_id, user_name, channel)
+        else:
+            # Always update channel so replies go to wherever the current message came from,
+            # not the channel where the session was first created (e.g. a prior DM).
+            _sessions[user_id].channel = channel
         return _sessions[user_id]
 
 
@@ -353,12 +357,21 @@ async def _dispatch(event: dict, client, cfg_loader, store) -> None:
     if not text:
         text = "hello"
 
-    # Allowlist check — if SLACK_ALLOWED_USERS is configured, silently ignore everyone else
-    # Admins (SLACK_ADMIN_USERS) are always allowed regardless of SLACK_ALLOWED_USERS
+    # Allowlist check — if SLACK_ALLOWED_USERS is configured, only those users + admins may interact.
+    # Admins (SLACK_ADMIN_USERS) are always allowed regardless of SLACK_ALLOWED_USERS.
     allowed = cfg_loader.sentinel.slack_allowed_users
     admin_users = cfg_loader.sentinel.slack_admin_users or []
     if allowed and user_id not in allowed and user_id not in admin_users:
         logger.warning("Boss: ignoring message from unauthorised user %s", user_id)
+        # For DMs: send a polite rejection so the user knows they're not authorized
+        if event.get("channel_type") == "im":
+            try:
+                await client.chat_postMessage(
+                    channel=channel,
+                    text="Sorry, you're not authorized to interact with Sentinel. Contact an admin to get access.",
+                )
+            except Exception:
+                pass
         return
 
     user_name, user_tz = await _resolve_name(client, user_id)

package/python/sentinel/state_store.py

@@ -540,7 +540,6 @@ class StateStore:
         """Remove a fix record so Sentinel will retry the error on the next poll."""
         with self._conn() as conn:
             cur = conn.execute("DELETE FROM fixes WHERE fingerprint = ?", (fingerprint,))
-            conn.execute("UPDATE errors SET last_seen = NULL WHERE fingerprint = ?", (fingerprint,))
         return cur.rowcount > 0
 
     def get_all_errors(self, hours: int = 0) -> list[dict]: