feat: restore slack gate config and label mcp profiles#188
Open
i-am-thor[bot] wants to merge 3 commits into
Open
feat: restore slack gate config and label mcp profiles#188i-am-thor[bot] wants to merge 3 commits into
i-am-thor[bot] wants to merge 3 commits into
Conversation
Co-authored-by: Son Dao <son.dao@katalon.com>
Contributor
Author
|
Follow-up summary because the PR body dropped the backticked literals during shell quoting:
Verification:
AI-generated — verify before acting. View Thor context |
Contributor
Author
|
Corrected summary:
Verification:
AI-generated — verify before acting. View Thor context |
Co-authored-by: Son Dao <son.dao@katalon.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR re-separates Slack admission gating from MCP credential routing by restoring a dedicated Slack gated-surface allowlist in workspace config, while making MCP “profiles” an explicit mcp --profile selection that never derives from Slack/repo/session context. It also improves observability by rendering chosen MCP profiles in runner progress labels and updates docs/tests to match the new contract.
Changes:
- Replace profile-based Slack admission (
profiles.<name>.channels[]) withslack.private_channel_allowlist[]gating for private/DM/shared Slack surfaces. - Make MCP profile routing explicit (
mcp --profile NAME), remove session-derived profile inference, and disable global fallback when a profile is explicitly requested. - Update runner tool display labels and expand test coverage + documentation to reflect the new behavior.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates deployment + workspace-config documentation to reflect Slack allowlist + explicit MCP profiles. |
| packages/runner/src/prompt-stream.ts | Adds MCP-specific display-name parsing and labels mcp[PROFILE] server in progress logs. |
| packages/runner/src/prompt-stream.test.ts | Adds coverage for MCP tool display-name formatting. |
| packages/remote-cli/src/mcp-handler.ts | Removes session-derived profile routing; parses explicit --profile and stores profile snapshots for approvals. |
| packages/remote-cli/src/mcp-handler.test.ts | Updates/expands tests to assert explicit-profile routing, no session inference, and approval snapshot behavior. |
| packages/remote-cli/src/approval-store.ts | Extends approval action origin schema to include a nullable stored MCP profile snapshot. |
| packages/gateway/src/slack-channel-gate.ts | Switches gated-Slack admission checks from profile membership to private-channel allowlist. |
| packages/gateway/src/service.test.ts | Updates Slack privacy dispatch planning tests to use the allowlist; adds a negative admission case. |
| packages/gateway/src/app.test.ts | Renames/updates Slack admission tests from “profiled” to “allowlisted” semantics. |
| packages/common/src/workspace-config.ts | Removes profiles schema/helpers; adds slack.private_channel_allowlist schema and helpers. |
| packages/common/src/workspace-config.test.ts | Replaces profile tests with allowlist tests + duplicate validation. |
| packages/common/src/proxies.ts | Enforces exact profile env resolution (no global fallback) and strict bundle requirements for profiled Grafana/Langfuse. |
| packages/common/src/proxies.test.ts | Updates tests to assert “exact profile only” resolution and no fallback behavior. |
| packages/common/src/index.ts | Updates public exports to remove profile helpers and export Slack allowlist helpers instead. |
| docs/slack.md | Documents allowlist-based gated Slack admission and clarifies MCP profiles are explicit. |
| docs/feat/security-model.md | Updates security model to reflect allowlist-based Slack gating and explicit MCP profiles + approval snapshots. |
| docs/feat/profile.md | Rewrites profile documentation to “MCP profiles” (explicit CLI selection; exact env bundles). |
| docs/feat/event-flow.md | Updates Slack event admission description and notes MCP profiles do not affect Slack admission. |
| docs/examples/thor.json | Updates example workspace config to include slack.private_channel_allowlist. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
13
to
17
| origin: z | ||
| .object({ | ||
| sessionId: z.string().min(1).optional(), | ||
| profile: z.string().min(1).nullable().optional(), | ||
| trigger: z |
Co-authored-by: Son Dao <son.dao@katalon.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
AI-generated — verify before acting. View Thor context