agent-messenger 2.26.0 → 2.27.1

package/src/platforms/discordbot/listener.ts

@@ -13,6 +13,11 @@ const RECONNECT_MAX_DELAY = 30_000
 const NON_RECOVERABLE_CLOSE_CODES = [4004, 4010, 4011, 4012, 4013, 4014]
 const SESSION_RESET_CLOSE_CODES = [4007, 4009]
 
+// Hello arrives within milliseconds and READY within a few seconds on a healthy gateway;
+// 15s is generous for a successful handshake while still failing fast on bad tokens,
+// network stalls, or a gateway that accepts the socket but never delivers READY.
+const DEFAULT_CONNECT_TIMEOUT_MS = 15_000
+
 const DEFAULT_INTENTS =
   DiscordIntent.Guilds |
   DiscordIntent.GuildMessages |
@@ -26,11 +31,13 @@ type EventKey = keyof DiscordBotListenerEventMap
 
 export interface DiscordBotListenerOptions {
   intents?: number
+  connectTimeoutMs?: number
 }
 
 export class DiscordBotListener {
   private client: DiscordBotClient
   private intents: number
+  private connectTimeoutMs: number
   private running = false
   private ws: WebSocket | null = null
   private emitter = new EventEmitter()
@@ -39,6 +46,7 @@ export class DiscordBotListener {
   private heartbeatJitterTimer: ReturnType<typeof setTimeout> | null = null
   private invalidSessionTimer: ReturnType<typeof setTimeout> | null = null
   private reconnectTimer: ReturnType<typeof setTimeout> | null = null
+  private connectTimeoutTimer: ReturnType<typeof setTimeout> | null = null
   private reconnectAttempts = 0
   private sequence: number | null = null
   private sessionId: string | null = null
@@ -46,24 +54,91 @@ export class DiscordBotListener {
   private token: string | null = null
   private cachedUser: { id: string; username: string } | null = null
   private generation = 0
+  private startPromise: Promise<void> | null = null
+  private pendingStartReject: ((error: Error) => void) | null = null
 
   constructor(client: DiscordBotClient, options?: DiscordBotListenerOptions) {
     this.client = client
     this.intents = options?.intents ?? DEFAULT_INTENTS
+    this.connectTimeoutMs = options?.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS
   }
 
   async start(): Promise<void> {
+    if (this.startPromise) return this.startPromise
     if (this.running) return
+
     this.running = true
     this.reconnectAttempts = 0
-    this.generation++
-    await this.connect(this.generation)
+    const generation = ++this.generation
+
+    const ready = new Promise<void>((resolve, reject) => {
+      let settled = false
+
+      const cleanup = () => {
+        this.emitter.off('connected', onConnected)
+        this.emitter.off('error', onError)
+        this.pendingStartReject = null
+        if (this.connectTimeoutTimer) {
+          clearTimeout(this.connectTimeoutTimer)
+          this.connectTimeoutTimer = null
+        }
+      }
+
+      const onConnected = () => {
+        if (settled || !this.isCurrent(generation)) return
+        settled = true
+        cleanup()
+        resolve()
+      }
+
+      const onError = (error: Error) => {
+        if (settled || !this.isCurrent(generation)) return
+        settled = true
+        cleanup()
+        this.teardownFailedStart(generation)
+        reject(error)
+      }
+
+      this.emitter.once('connected', onConnected)
+      this.emitter.once('error', onError)
+
+      // Generation-agnostic on purpose: stop() invokes this to reject an in-flight start
+      // (after bumping generation) without leaking the once() handlers.
+      this.pendingStartReject = (error: Error) => {
+        if (settled) return
+        settled = true
+        cleanup()
+        reject(error)
+      }
+
+      this.connectTimeoutTimer = setTimeout(() => {
+        onError(new Error(`Discord gateway did not become ready within ${this.connectTimeoutMs}ms`))
+      }, this.connectTimeoutMs)
+    })
+
+    const run = async (): Promise<void> => {
+      try {
+        await Promise.all([this.connect(generation), ready])
+      } finally {
+        if (this.generation === generation) this.startPromise = null
+      }
+    }
+    const startPromise = run()
+    this.startPromise = startPromise
+    return startPromise
   }
 
   stop(): void {
     this.running = false
     this.generation++
     this.clearTimers()
+    if (this.connectTimeoutTimer) {
+      clearTimeout(this.connectTimeoutTimer)
+      this.connectTimeoutTimer = null
+    }
+    const rejectStart = this.pendingStartReject
+    this.pendingStartReject = null
+    this.startPromise = null
     if (this.ws) {
       this.ws.close()
       this.ws = null
@@ -73,6 +148,12 @@ export class DiscordBotListener {
     this.resumeGatewayUrl = null
     this.token = null
     this.cachedUser = null
+    rejectStart?.(new Error('Discord gateway start was stopped before becoming ready'))
+  }
+
+  private teardownFailedStart(generation: number): void {
+    if (!this.isCurrent(generation)) return
+    this.stop()
   }
 
   on<K extends EventKey>(event: K, listener: (...args: DiscordBotListenerEventMap[K]) => void): this {

package/src/platforms/slack/qr-http-login.test.ts

@@ -132,6 +132,53 @@ describe('loginWithQr', () => {
     await expect(promise).rejects.toThrow(/expired/)
   })
 
+  it('reports SSO enforcement when the z-app hop redirects to an identity provider', async () => {
+    // Given a workspace whose z-app hop redirects off Slack to an SSO IdP (no d cookie issued)
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return redirect('https://accounts.google.com/o/oauth2/auth?redirect_uri=https://slack.com/sso/google')
+    }) as typeof fetch
+
+    // When logging in, the error names SSO + the detected provider and points to a working auth method
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/enforces SSO \(via Google\)/)
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/auth extract/)
+  })
+
+  it('reports SSO enforcement for an unrecognized/vanity IdP host', async () => {
+    // Given a z-app hop that redirects off Slack to a custom SAML IdP not in the known-provider list
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return redirect('https://login.acme.example/saml')
+    }) as typeof fetch
+
+    // When logging in, it is still classified as SSO (without naming a provider) and routes to auth extract
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/enforces SSO/)
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/auth extract/)
+  })
+
+  it('reports an expired link when the final page is Slack\u2019s "Link Expired" page', async () => {
+    // Given a z-app chain that completes on a Slack host but returns the expired page with no d cookie
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return new Response('<title>Link Expired | Slack</title>', { status: 200 })
+    }) as typeof fetch
+
+    // When logging in, the error names the expiry explicitly
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/has expired or was already used/)
+  })
+
   it('fails with qr_token_failed when the token cannot be retrieved', async () => {
     const dataUrl = await qrDataUrl(ZAPP_URL)
 

package/src/platforms/slack/qr-http-login.ts

@@ -23,10 +23,10 @@ export async function loginWithQr(dataUrl: string, options: QrLoginOptions = {})
   const debug = options.debug
   debug?.(`Decoded QR for workspace ${login.workspace}`)
 
-  const cookie = await captureDCookie(login.url, options)
+  const { cookie, denialReason, ssoProvider } = await captureDCookie(login.url, options)
   if (!cookie) {
     throw new SlackError(
-      'Could not establish a Slack session from the QR code. The link may have expired — generate a new QR code and try again.',
+      qrSessionFailureMessage(denialReason, { workspace: login.workspace, ssoProvider }),
       'qr_session_failed',
     )
   }
@@ -44,13 +44,74 @@ export async function loginWithQr(dataUrl: string, options: QrLoginOptions = {})
   return { token, cookie, workspace: login.workspace }
 }
 
-async function captureDCookie(startUrl: string, options: QrLoginOptions): Promise<string | null> {
+interface QrFailureContext {
+  workspace?: string
+  ssoProvider?: string | null
+}
+
+function qrSessionFailureMessage(denialReason: string | null, context: QrFailureContext = {}): string {
+  const workspace = context.workspace ? `"${context.workspace}"` : 'this workspace'
+
+  if (denialReason === 'sso_required') {
+    const via = context.ssoProvider ? ` (via ${context.ssoProvider})` : ''
+    return [
+      `Slack workspace ${workspace} enforces SSO${via}, so QR sign-in cannot complete here.`,
+      '',
+      `Why: scanning the QR redirects the login to your identity provider${via}. agent-slack follows the`,
+      'redirect chain over plain HTTP and never sends your session cookie off Slack-owned hosts, so it',
+      'stops at the IdP and no Slack session (the "d" cookie) is ever issued. Completing SSO requires a',
+      'real browser, which a headless environment does not have.',
+      '',
+      'What to do instead:',
+      '  On a computer where you are already signed in to Slack (desktop app or a Chromium browser),',
+      '  run:  agent-slack auth extract',
+      '  This reads your existing session locally — no SSO re-login, no DevTools.',
+      '',
+      'Background: https://github.com/agent-messenger/agent-messenger/issues/260',
+    ].join('\n')
+  }
+  if (denialReason === 'link_expired') {
+    return [
+      `The Slack QR code for ${workspace} has expired or was already used.`,
+      'The z-app sign-in link is single-use and short-lived: it is consumed the first time it is opened',
+      '(including previewing or scanning it), and re-using it returns "Link Expired".',
+      '',
+      'Generate a fresh QR (your name → "Sign in on mobile") and pipe it in immediately, without',
+      'previewing or scanning it first.',
+    ].join('\n')
+  }
+  if (denialReason === 'awaiting_device_confirmation') {
+    return [
+      `Slack requires this sign-in to ${workspace} to be confirmed on an already-authenticated device.`,
+      'QR sign-in over HTTP cannot complete that approval step.',
+      '',
+      'Use  agent-slack auth extract  on a computer already signed in to Slack instead.',
+    ].join('\n')
+  }
+  return [
+    `Could not establish a Slack session for ${workspace} from the QR code.`,
+    'The link may have expired, or the workspace requires a sign-in step that QR-over-HTTP cannot complete.',
+    '',
+    'Generate a fresh QR and try again, or run  agent-slack auth extract  on a computer already signed in',
+    'to Slack.',
+  ].join('\n')
+}
+
+interface CookieCapture {
+  cookie: string | null
+  denialReason: string | null
+  ssoProvider: string | null
+}
+
+async function captureDCookie(startUrl: string, options: QrLoginOptions): Promise<CookieCapture> {
   const doFetch = options.fetchImpl ?? fetch
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS
   const debug = options.debug
 
   let url = startUrl
   let dCookie: string | null = null
+  let sessionDenialReason: string | null = null
+  let ssoProvider: string | null = null
   const cookieJar: string[] = []
 
   for (let hop = 0; hop < maxRedirects; hop++) {
@@ -72,27 +133,71 @@ async function captureDCookie(startUrl: string, options: QrLoginOptions): Promis
       },
     })
 
+    const cookieNames: string[] = []
     for (const setCookie of getSetCookies(response)) {
       const value = parseDCookie(setCookie)
       if (value) dCookie = value
+      const name = setCookie.split('=')[0]?.trim()
+      if (name) cookieNames.push(name)
       const pair = setCookie.split(';')[0]?.trim()
       if (pair) cookieJar.push(pair)
     }
 
-    debug?.(`hop ${hop}: ${response.status}`)
+    debug?.(`hop ${hop}: ${response.status} set-cookie=[${cookieNames.join(',') || 'none'}]`)
 
     const location = response.status >= 300 && response.status < 400 ? response.headers.get('location') : null
-    if (!location) break
+    if (!location) {
+      if (!dCookie) sessionDenialReason = await classifySessionDenial(response)
+      break
+    }
 
     const next = new URL(location, url).toString()
     if (!isSlackHost(next)) {
-      debug?.(`hop ${hop}: redirect target is not a Slack host, stopping`)
+      // A no-cookie login QR that redirects off Slack is an SSO/IdP hand-off the
+      // HTTP flow cannot complete — classify it regardless of whether the IdP
+      // host is a recognized provider (custom/vanity SAML domains included).
+      if (!dCookie) {
+        sessionDenialReason = 'sso_required'
+        ssoProvider = ssoProviderFromUrl(next)
+      }
+      debug?.(`hop ${hop}: redirect target is not a Slack host (${new URL(next).hostname}), stopping`)
       break
     }
     url = next
   }
 
-  return dCookie
+  return { cookie: dCookie, denialReason: sessionDenialReason, ssoProvider }
+}
+
+function ssoProviderFromUrl(rawUrl: string): string | null {
+  let hostname: string
+  try {
+    hostname = new URL(rawUrl).hostname
+  } catch {
+    return null
+  }
+  if (hostname === 'accounts.google.com') return 'Google'
+  if (hostname.endsWith('.okta.com') || hostname.endsWith('.oktapreview.com')) return 'Okta'
+  if (hostname === 'login.microsoftonline.com') return 'Microsoft'
+  if (hostname.endsWith('.onelogin.com')) return 'OneLogin'
+  if (hostname.endsWith('.pingidentity.com') || hostname.endsWith('.pingone.com')) return 'Ping Identity'
+  if (hostname.endsWith('.auth0.com')) return 'Auth0'
+  return null
+}
+
+async function classifySessionDenial(response: Response): Promise<string | null> {
+  try {
+    const body = await response.text()
+    if (/Link Expired/i.test(body) || /trouble signing you in/i.test(body)) {
+      return 'link_expired'
+    }
+    if (/sign in on your other device/i.test(body) || /open Slack/i.test(body) || /confirm/i.test(body)) {
+      return 'awaiting_device_confirmation'
+    }
+    return null
+  } catch {
+    return null
+  }
 }
 
 export function isSlackHost(rawUrl: string): boolean {