From f0b7571fcee774fd254923aaa5277da9302c989d Mon Sep 17 00:00:00 2001 From: yatul Date: Wed, 9 Sep 2026 19:30:21 +0400 Subject: [PATCH] fix(teams): scope team tasks to the delegation origin, not the delivery channel (#1530) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(teams): scope team tasks to the delegation origin, not the delivery channel A delegated run is delivered on the internal "delegate" channel while its real origin is preserved separately — buildAgentLinkRunRequest is explicit about it: // preserves the origin's authorization-bearing identity while keeping // delegation on its internal delivery channel. Channel: "delegate", WorkspaceChannel: req.Channel, WorkspaceChatID: req.ChatID, The team tools did not consult that origin, so a task created by a lead reached through delegate was stamped with the delivery channel. Nothing is registered for it, so every notification about that task — completion, failure, blocker escalation, ask_user — was dropped: unknown channel for outbound message channel=delegate The delegatee's first answer still arrived, because it travels back as the delegation result rather than through a channel; everything the lead said after the delegation closed was lost. One session produced 16 such drops, including a blocker escalation the user needed to see. Add OriginChannelFromCtx / OriginChatIDFromCtx next to the existing workspace scope propagation helpers, and use them where team scoping and notification routing are decided: task records, list/search scoping, dispatch fallbacks, event payloads, escalation tasks, ask_user and leader notifications. The resolution is the identity when no delegation origin is present, so non-delegated flows are unchanged. Deliberately not touched: the channel used in authorization decisions (checkTeamAccess, requireLead, approve/reject lead bypass). Those ask "how did this call arrive", not "where should the answer go", and widening them is a separate question. Co-Authored-By: Claude Opus 5 * test(teams): cover delegated-lead completion routing and origin isolation Triage on #1529 named two gates this PR had not met: regression coverage for delegated lead task completion, and a guard that unrelated origins cannot receive the notification. The existing tests only covered what create persists. TestDelegatedLeadCompletionNotifiesOrigin completes a task raised in a delegated context and asserts the completion event is addressed to the caller's origin. Reverting team_event_helpers.go to the delivery channel fails it with "addressed to delegate/system". TestCompletionNotificationStaysWithinItsOwnOrigin puts two tasks from different origins on one board, completes one, and asserts no completion notification carries the other origin. Co-Authored-By: Claude Opus 5 --------- Co-authored-by: Claude Opus 5