Prevent passive Slack thread participants from receiving plugin OAuth prompts

Abierto
  • ¿Algo no está bien?
#1,377 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
typescript
Área
authentication, backend-api-design

Línea de trabajo

Comienza en SlackTurnRuntime.handleSubscribedMessage y rastrea cómo la procedencia del actor de conversation-store llega a la autenticación de MCP, comparando las conversaciones suscritas activas y en reposo. Usa los casos de reproducción y aceptación para añadir cobertura para respuestas pasivas entre actores, menciones explícitas y la entrega mediante OAuth; se considera terminado cuando se conserva el contexto sin cambiar la autoridad y ningún participante incidental recibe un prompt.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Problem

Junior treats the author of every subscribed Slack reply as the actor for a new turn, even when that person only joined an existing thread to provide context.

This produces a bad OAuth flow in shared threads:

  1. Alice asks Junior to debug an engineering problem.
  2. Junior begins an investigation that uses an authenticated MCP plugin such as PlanetScale.
  3. Bob replies without mentioning Junior and adds support context, an identifier, or a correction.
  4. The subscribed-reply router decides Bob's message continues Junior's work.
  5. Junior starts the turn with Bob as the actor.
  6. When PlanetScale requires authentication, Junior sends Bob an OAuth link.

Bob never requested PlanetScale access, may not have a PlanetScale account, and did not take ownership of the investigation. The original task also stalls waiting for an authorization Bob cannot complete.

Current behavior

SlackTurnRuntime.handleSubscribedMessage assigns the latest message author as the turn actor:

const actorId = isResourceEventNotification
  ? undefined
  : message.author.userId;

MCP authentication then creates and delivers the authorization request for that actor:

userId: input.actorId

The conversation store already preserves the original conversation actor when another Slack user participates, but the subscribed-turn runtime does not use that distinction.

Plugin manifests also have no audience or eligibility configuration. Every actor can reach every plugin's OAuth flow if the model selects its tools.

Expected behavior

Posting a passive reply in a subscribed thread must not implicitly make someone the task authority or credential principal.

  • A cross-actor reply without an explicit Junior mention may contribute context to the existing task.
  • It must not trigger an OAuth link for its author.
  • It must not authorize new work or broaden the original task.
  • Junior may continue using the task owner's authority only within the work that owner already requested.
  • If attribution is ambiguous, Junior should wait for the task owner instead of asking the incidental participant to authenticate.
  • An explicit mention from another actor may start a separate turn under that actor's credentials.
  • Junior must never reuse the task owner's credentials for a new request from another participant.

Reproduction

  1. Alice mentions Junior in a Slack thread and requests an investigation that requires an MCP plugin.
  2. Alice has authorized the plugin.
  3. Allow the initial turn to complete or pause.
  4. Bob replies in the same thread without mentioning Junior.
  5. Make Bob's reply a natural continuation, such as supplying the requested record ID.
  6. Observe Junior send Bob the plugin OAuth link.

Acceptance

  • Passive cross-actor subscribed replies never send their author an OAuth link.
  • The message remains available as attributed conversation context.
  • Existing task authority and credential ownership do not silently change.
  • Explicit cross-actor mentions remain separate actor-owned turns.
  • Tests cover both active and idle subscribed conversations.

Related

  • #773 tracks actor and instruction provenance across multi-actor runs.
  • #956 tracks cross-actor mentions arriving during an active run.
  • This issue covers the remaining subscribed-thread case where an incidental participant becomes the actor for a later turn and receives an unintended OAuth prompt.
Lenguaje dominante
TypeScript
Estrellas
385
Forks
42
Merge medio
8 h 29 min
PR fusionados (30 d)
495

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de getsentry/junior

Todos los issues de getsentry/junior

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.