mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 19:43:15 +00:00
* fix(webhooks): fall back to vision model for Slack/Linear image threads Re-land upstream #1626 onto the modular webhook structure. When a Slack mention or Linear issue carries images but the resolved model is text-only, fall back to a vision-capable model instead of dropping the images. Re-points default_vision_model_pair at the fork's image-capable models (Opus 4.8 default, else any supports_images model) rather than upstream's openai:/anthropic: provider filter. Refs #80, upstream #1626 * fix(slack): persist trace_message_ts so web-handoff updates the trace reply Re-land upstream #1630 onto the modular structure. The first-mention store_slack_run_mapping call did not pass trace_message_ts, so it was never persisted (nothing to preserve from on first mention) and _notify_slack_web_handoff always skipped the trace-reply update on web handoff. Pass it through and cover it with a test. Refs #80, upstream #1630 * feat(slack): include channel context in Slack prompts Re-land upstream #1633 onto the modular structure. Fetch cached Slack channel metadata once per event (_get_slack_channel_context) and thread it through the docs-plz gate, repo resolution, and process_slack_mention so prompts carry the channel name and a clearly-marked untrusted channel description. Avoids duplicate conversations.info calls. Refs #80, upstream #1633 * feat(tools): add slack_start_new_thread breakout tool Re-land upstream #1638 onto the modular structure. Adds the slack_start_new_thread tool (posts a top-level Slack message and dispatches a fresh agent run for a broken-out task via the durable dispatch_agent_run contract), wires it into the agent tool list and tools/__init__, adds prompt guidance, and excludes it from plan mode so it can't bypass the approval flow. Tool imports only live modules. Refs #80, upstream #1638 * feat(plan): notify Slack on plan approval Re-land upstream #1632 onto the modular structure. When a plan is approved via the dashboard approve endpoint, post a thread reply to the originating Slack thread noting the comment count and approver, after the follow-up run is dispatched. Slack post failures never break approval. Adapted to the fork's approve_plan (no plan_markdown read). Refs #80, upstream #1632 * feat(plan): publish plans from sandbox files Re-land upstream #1635 onto the modular structure, completing the partially-ported change so dev is internally consistent. save_plan now takes a plan_file_path, reads the agent-authored Markdown file from /workspace/plans/ (validating extension/location/UTF-8/size) and publishes it, instead of taking a plan_markdown string. Removes write_file/edit_file from PLAN_MODE_EXCLUDED_TOOLS so the agent can author the plan file, updates enter_plan_mode/reject_plan guidance and the e2e fake LLM. Skips the #1610-only update_plan hunk (not on dev). Refs #80, upstream #1635 * fix(security): SSRF-harden server-side image fetch + stop logging raw image URLs INJ-01 (high): fetch_image_block used follow_redirects=True with no per-hop revalidation and discarded the resolved-IP pin, so an attacker-authored Slack/ Linear image URL could 302-redirect the fetch to an internal host / cloud metadata endpoint (blind SSRF), and DNS-rebinding could bypass the one-shot is_url_safe check. Route image fetches through the same per-hop resolve+pin+ revalidate loop the http_request tool uses, lifted into url_safety as the shared request_with_safe_redirects. Also strip the per-host Slack/Linear bearer token on redirect so it can't be replayed to a redirect target. SC-1 (low): linear.py logged full image URLs (which can carry signed tokens) at DEBUG; multimodal logged them at INFO on every fetch. Log host-only. Sink lived in multimodal.py (unchanged by the feature work) but PR #128 widened its reach by no longer dropping images for text-only models. Fixing on the base branch so #130/#129 inherit it on rebase. Adds fetch_image_block SSRF regression tests (redirect-to-internal blocked; auth stripped on redirect).
241 lines
9.4 KiB
Python
241 lines
9.4 KiB
Python
"""Linear webhook handler — moved out of webapp.py (behavior-identical).
|
|
|
|
Helpers and constants stay in webapp.py; they are accessed through the module
|
|
object (``webapp.X``) so tests that monkeypatch them keep working.
|
|
"""
|
|
|
|
from typing import Any
|
|
from urllib.parse import urlparse
|
|
|
|
import httpx
|
|
from langchain_core.messages.content import create_text_block
|
|
|
|
from agent import webapp
|
|
|
|
|
|
async def process_linear_issue( # noqa: PLR0912, PLR0915
|
|
issue_data: dict[str, Any], repo_config: dict[str, str]
|
|
) -> None:
|
|
"""Process a Linear issue by creating a new LangGraph thread and run.
|
|
|
|
Args:
|
|
issue_data: The Linear issue data from webhook (basic info only).
|
|
repo_config: The repo configuration with owner and name.
|
|
"""
|
|
issue_id = issue_data.get("id", "")
|
|
webapp.logger.info(
|
|
"Processing Linear issue %s for repo %s/%s",
|
|
issue_id,
|
|
repo_config.get("owner"),
|
|
repo_config.get("name"),
|
|
)
|
|
|
|
triggering_comment_id = issue_data.get("triggering_comment_id", "")
|
|
if triggering_comment_id:
|
|
await webapp.react_to_linear_comment(triggering_comment_id, "👀")
|
|
|
|
thread_id = webapp.generate_thread_id_from_issue(issue_id)
|
|
|
|
full_issue = await webapp.fetch_linear_issue_details(issue_id)
|
|
if not full_issue:
|
|
full_issue = issue_data
|
|
|
|
user_email = None
|
|
user_name = None
|
|
comment_author = issue_data.get("comment_author", {})
|
|
if comment_author:
|
|
user_email = comment_author.get("email")
|
|
user_name = comment_author.get("name")
|
|
if not user_email:
|
|
creator = full_issue.get("creator", {})
|
|
if creator:
|
|
user_email = creator.get("email")
|
|
user_name = user_name or creator.get("name")
|
|
if not user_email:
|
|
assignee = full_issue.get("assignee", {})
|
|
if assignee:
|
|
user_email = assignee.get("email")
|
|
user_name = user_name or assignee.get("name")
|
|
|
|
webapp.logger.info("User email for issue %s: %s", issue_id, user_email)
|
|
|
|
title = full_issue.get("title", "No title")
|
|
description = full_issue.get("description") or "No description"
|
|
image_urls: list[str] = []
|
|
description_image_urls = webapp.extract_image_urls(description)
|
|
if description_image_urls:
|
|
image_urls.extend(description_image_urls)
|
|
webapp.logger.debug(
|
|
"Found %d image URL(s) in issue description",
|
|
len(description_image_urls),
|
|
)
|
|
|
|
comments = full_issue.get("comments", {}).get("nodes", [])
|
|
comments_text = ""
|
|
triggering_comment = issue_data.get("triggering_comment", "")
|
|
triggering_comment_id = issue_data.get("triggering_comment_id", "")
|
|
|
|
bot_message_prefixes = (
|
|
"🔐 **GitHub Authentication Required**",
|
|
"✅ **Pull Request Created**",
|
|
"✅ **Pull Request Updated**",
|
|
"**Pull Request Created**",
|
|
"**Pull Request Updated**",
|
|
"🤖 **Agent Response**",
|
|
"❌ **Agent Error**",
|
|
)
|
|
|
|
comment_ids: set[str] = set()
|
|
comment_id_to_index: dict[str, int] = {}
|
|
if comments:
|
|
for i, comment in enumerate(comments):
|
|
comment_id = comment.get("id", "")
|
|
if comment_id:
|
|
comment_ids.add(comment_id)
|
|
comment_id_to_index[comment_id] = i
|
|
|
|
relevant_comments = []
|
|
trigger_index = None
|
|
if triggering_comment_id:
|
|
trigger_index = comment_id_to_index.get(triggering_comment_id)
|
|
if trigger_index is not None:
|
|
relevant_comments = comments[trigger_index:]
|
|
webapp.logger.debug(
|
|
"Using triggering comment index %d to build relevant comments",
|
|
trigger_index,
|
|
)
|
|
else:
|
|
relevant_comments = webapp.get_recent_comments(comments, bot_message_prefixes)
|
|
|
|
if relevant_comments:
|
|
comments_text = "\n\n## Comments:\n"
|
|
for comment in relevant_comments:
|
|
user = comment.get("user") or {}
|
|
author = user.get("name", "User")
|
|
body = comment.get("body", "")
|
|
body_image_urls = webapp.extract_image_urls(body)
|
|
if body_image_urls:
|
|
image_urls.extend(body_image_urls)
|
|
webapp.logger.debug(
|
|
"Found %d image URL(s) in comment by %s",
|
|
len(body_image_urls),
|
|
author,
|
|
)
|
|
if any(body.startswith(prefix) for prefix in bot_message_prefixes):
|
|
continue
|
|
comments_text += f"\n**{author}:** {body}\n"
|
|
|
|
if triggering_comment and triggering_comment_id not in comment_ids:
|
|
if not comments_text:
|
|
comments_text = "\n\n## Comments:\n"
|
|
trigger_author = comment_author.get("name", "Unknown")
|
|
trigger_body = triggering_comment
|
|
trigger_image_urls = webapp.extract_image_urls(trigger_body)
|
|
if trigger_image_urls:
|
|
image_urls.extend(trigger_image_urls)
|
|
webapp.logger.debug(
|
|
"Found %d image URL(s) in triggering comment by %s",
|
|
len(trigger_image_urls),
|
|
trigger_author,
|
|
)
|
|
comments_text += f"\n**{trigger_author}:** {trigger_body}\n"
|
|
webapp.logger.debug(
|
|
"Appended triggering comment %s not present in issue comments list",
|
|
triggering_comment_id or "<missing-id>",
|
|
)
|
|
|
|
identifier = full_issue.get("identifier", "") or issue_data.get("identifier", "")
|
|
|
|
triggered_by_line = f"## Triggered by: {user_name}\n\n" if user_name else ""
|
|
tag_instruction = (
|
|
f"When calling linear_comment, tag @{user_name} if you are asking them a question, need their input, or are notifying them of something important (e.g. a completed PR). For simple answers, tagging is not required."
|
|
if user_name
|
|
else ""
|
|
)
|
|
prompt = (
|
|
f"Please work on the following issue:\n\n"
|
|
f"## Repository: {repo_config.get('owner')}/{repo_config.get('name')}\n\n"
|
|
f"## Title: {title}\n\n"
|
|
f"{triggered_by_line}"
|
|
f"## Linear Ticket: {identifier} - Ticket ID: {issue_id}\n\n"
|
|
f"## Description:\n{description}\n"
|
|
f"{comments_text}\n\n"
|
|
f"Please analyze this issue and implement the necessary changes. "
|
|
f"When you're done, commit and push your changes. {tag_instruction}"
|
|
)
|
|
content_blocks: list[dict[str, Any]] = [create_text_block(prompt)]
|
|
image_model_override: tuple[str, str] | None = None
|
|
if image_urls:
|
|
image_urls = webapp.dedupe_urls(image_urls)
|
|
linear_login = (
|
|
await webapp.resolve_login_from_email_async(user_email) if user_email else None
|
|
)
|
|
resolved_model_id = await webapp.resolve_agent_model_id(linear_login)
|
|
if not webapp.model_supports_images(resolved_model_id):
|
|
fallback_model_id, fallback_effort = webapp.default_vision_model_pair()
|
|
webapp.logger.info(
|
|
"Using vision fallback model %s for %d Linear image(s); configured model %s "
|
|
"does not support images",
|
|
fallback_model_id,
|
|
len(image_urls),
|
|
resolved_model_id,
|
|
)
|
|
resolved_model_id = fallback_model_id
|
|
image_model_override = (fallback_model_id, fallback_effort)
|
|
webapp.logger.info("Preparing %d image(s) for multimodal content", len(image_urls))
|
|
webapp.logger.debug("Image hosts: %s", [urlparse(u).hostname for u in image_urls])
|
|
|
|
async with httpx.AsyncClient(timeout=webapp.DEFAULT_HTTP_TIMEOUT) as client:
|
|
for image_url in image_urls:
|
|
image_block = await webapp.fetch_image_block(image_url, client)
|
|
if image_block:
|
|
content_blocks.append(image_block)
|
|
webapp.logger.info("Built %d content block(s) for prompt", len(content_blocks))
|
|
|
|
linear_project_id = ""
|
|
linear_issue_number = ""
|
|
if identifier and "-" in identifier:
|
|
parts = identifier.split("-", 1)
|
|
linear_project_id = parts[0]
|
|
linear_issue_number = parts[1]
|
|
|
|
configurable: dict[str, Any] = {
|
|
"repo": repo_config,
|
|
"linear_issue": {
|
|
"id": issue_id,
|
|
"title": title,
|
|
"url": full_issue.get("url", "") or issue_data.get("url", ""),
|
|
"identifier": identifier,
|
|
"linear_project_id": linear_project_id,
|
|
"linear_issue_number": linear_issue_number,
|
|
"triggering_user_name": user_name or "",
|
|
},
|
|
"user_email": user_email,
|
|
"source": "linear",
|
|
}
|
|
if image_model_override:
|
|
configurable["agent_model_id"] = image_model_override[0]
|
|
configurable["agent_effort"] = image_model_override[1]
|
|
|
|
await webapp.upsert_agent_thread_owner_metadata(
|
|
thread_id,
|
|
source="linear",
|
|
repo_config=repo_config,
|
|
user_email=user_email or "",
|
|
title=title or identifier or "Linear issue",
|
|
source_context={"linear_issue": configurable["linear_issue"]},
|
|
)
|
|
|
|
run = await webapp.dispatch_agent_run(
|
|
thread_id,
|
|
content_blocks,
|
|
configurable,
|
|
source="linear",
|
|
metadata=webapp._AGENT_VERSION_METADATA,
|
|
)
|
|
webapp.logger.info(
|
|
"LangGraph run dispatched for thread %s (run=%s)",
|
|
thread_id,
|
|
run.get("run_id") if isinstance(run, dict) else None,
|
|
)
|
|
await webapp.post_linear_trace_comment(issue_id, thread_id, triggering_comment_id)
|