Repository navigation
LOU-D18, LOU-X7: verify Slack request signatures; built-in todo tools - #55
Merged
Merged
Conversation
LOU-D18: SlackTriggerAdapter gains signingSecret + handleRequest(): verifies X-Slack-Signature (HMAC-SHA256 over v0:{ts}:{raw body}, constant-time, 5 minute replay window) before parsing, generic 401 on failure, signed url_verification handshake, one-time warning when unset. verifySlackSignature() is exported for custom handlers and used by the ops-pipeline example when SLACK_SIGNING_SECRET is set. Reuses webhookAuth.ts helpers.
LOU-X7: createTodoTools() returns todo_write/todo_read (shared store, stable ids, at most one in_progress, onChange, pluggable TodoStore, getTodos()).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…re-and-todo-tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
SlackTriggerAdaptergetssigningSecret,loggerandhandleRequest({ headers, rawBody }). Every request is verified against the raw body before parsing (HMAC-SHA256 overv0:{ts}:{raw body}, constant-time compare, 5 minute window), generic 401 on failure, signedurl_verificationhandshake answered after verification, one-time warning atlisten()when no secret is set. New publicverifySlackSignature({ signingSecret, timestamp, signature, rawBody, now? }), used by the ops-pipeline example whenSLACK_SIGNING_SECRETis set.createTodoTools({ store?, onChange? })returns{ tools, todoWrite, todoRead, getTodos }(todo_write/todo_read).Why
Slack endpoints accepted unauthenticated requests (security finding from LOU-D13 review). Long-running agents also need a way to plan and track work (open-harness parity).
How verified
npx tsc --noEmit: clean;npm run lint: 0 errors (no new warnings in touched files)npm run build+ create-loushy-agent build: successnpm run test:coverage: 100 files passed, 1309 tests passed, 3 skippednpm run fallow: 0 above thresholdnpm run docs:verify-snippets: all 35 snippets type-check, 5 run cleanlyNotes for reviewer
handleEvent), sohandleRequestis new; the host keeps its own HTTP server. Scheme confirmed at https://docs.slack.dev/authentication/verifying-requests-from-slack (api.slack.com redirects there).examples/slack-notifierreceives no Slack requests (it only drafts text), so it is unchanged.in_progress, unique ids, non-empty content) is a zod refinement, so failures reach the model asToolArgumentsValidationError.handleRequestawaits the agent before responding (documented; Slack expects a reply in 3s).🤖 Generated with Claude Code