Prevent passive Slack thread participants from receiving plugin OAuth prompts

Aperta
  • Qualcosa non va?
#1,377 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
typescript
Ambito
authentication, backend-api-design

Direzione di ricerca

Inizia da SlackTurnRuntime.handleSubscribedMessage e traccia come la provenienza dell’attore di conversation-store raggiunge l’autenticazione MCP, confrontando le conversazioni sottoscritte attive e inattive. Usa i casi di riproduzione e di accettazione per aggiungere la copertura per le risposte passive tra attori, le menzioni esplicite e la consegna OAuth; il lavoro è completato quando il contesto viene mantenuto senza modificare l’autorità e nessun partecipante incidentale riceve un prompt.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

Junior treats the author of every subscribed Slack reply as the actor for a new turn, even when that person only joined an existing thread to provide context.

This produces a bad OAuth flow in shared threads:

  1. Alice asks Junior to debug an engineering problem.
  2. Junior begins an investigation that uses an authenticated MCP plugin such as PlanetScale.
  3. Bob replies without mentioning Junior and adds support context, an identifier, or a correction.
  4. The subscribed-reply router decides Bob's message continues Junior's work.
  5. Junior starts the turn with Bob as the actor.
  6. When PlanetScale requires authentication, Junior sends Bob an OAuth link.

Bob never requested PlanetScale access, may not have a PlanetScale account, and did not take ownership of the investigation. The original task also stalls waiting for an authorization Bob cannot complete.

Current behavior

SlackTurnRuntime.handleSubscribedMessage assigns the latest message author as the turn actor:

const actorId = isResourceEventNotification
  ? undefined
  : message.author.userId;

MCP authentication then creates and delivers the authorization request for that actor:

userId: input.actorId

The conversation store already preserves the original conversation actor when another Slack user participates, but the subscribed-turn runtime does not use that distinction.

Plugin manifests also have no audience or eligibility configuration. Every actor can reach every plugin's OAuth flow if the model selects its tools.

Expected behavior

Posting a passive reply in a subscribed thread must not implicitly make someone the task authority or credential principal.

  • A cross-actor reply without an explicit Junior mention may contribute context to the existing task.
  • It must not trigger an OAuth link for its author.
  • It must not authorize new work or broaden the original task.
  • Junior may continue using the task owner's authority only within the work that owner already requested.
  • If attribution is ambiguous, Junior should wait for the task owner instead of asking the incidental participant to authenticate.
  • An explicit mention from another actor may start a separate turn under that actor's credentials.
  • Junior must never reuse the task owner's credentials for a new request from another participant.

Reproduction

  1. Alice mentions Junior in a Slack thread and requests an investigation that requires an MCP plugin.
  2. Alice has authorized the plugin.
  3. Allow the initial turn to complete or pause.
  4. Bob replies in the same thread without mentioning Junior.
  5. Make Bob's reply a natural continuation, such as supplying the requested record ID.
  6. Observe Junior send Bob the plugin OAuth link.

Acceptance

  • Passive cross-actor subscribed replies never send their author an OAuth link.
  • The message remains available as attributed conversation context.
  • Existing task authority and credential ownership do not silently change.
  • Explicit cross-actor mentions remain separate actor-owned turns.
  • Tests cover both active and idle subscribed conversations.

Related

  • #773 tracks actor and instruction provenance across multi-actor runs.
  • #956 tracks cross-actor mentions arriving during an active run.
  • This issue covers the remaining subscribed-thread case where an incidental participant becomes the actor for a later turn and receives an unintended OAuth prompt.
Lingua principale
TypeScript
Stelle
397
Fork
43
Merge medio
7h 44m
PR unite (30g)
607

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di getsentry/junior

Tutte le issue di getsentry/junior

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.