Notify tasks: merge main, real-transport tests, Slack structural broadcasts, webhook redaction by sroussey · Pull Request #744 · workglow-dev/libs

feat(tasks): add webhook, Slack, and Discord notification tasks

sroussey

authored and

claude

committed

de049e1

fix(tasks): fail closed on private webhook destinations reached via a credential

sroussey

authored and

claude

committed

9135ba3

refactor(tasks): categorize notify tasks and rename their credential port

sroussey

authored and

claude

committed

fcaa8f5

fix(tasks): stop notify tasks leaking webhook tokens and mass-pinging (#714)

sroussey

and

claude

committed

b1aa63d

fix(tasks): refuse webhook redirects and withhold private failure bodies

claude

committed

b9eeb9f

fix(tasks): detect safeFetch redirect refusals by sentinel, not message shape

claude

committed

a9cb0b8

fix(tasks): redact partial webhook URLs echoed in response bodies

claude

committed

4db0e21

fix(tasks): neutralize Slack broadcasts inside `blocks`

claude

committed

dc30ef0

fix(tasks): redact the success response body before returning it

claude

committed

3ca5bcf

fix(tasks): fail closed when a configured credential resolves to nothing

claude

committed

1967de0

fix(tasks)!: declare private webhook destinations instead of inferring them

claude

committed

de9061b

fix(tasks): enforce the network:private grant when a webhook posts to a private destination

claude

committed

8b944ae

test(tasks): pin the allowPrivate / privateResourceScopes arguments handed to safeFetch

claude

committed

3c8a739

test(tasks): drive the notify tasks through the real server transport

claude

committed

130a08e

fix(tasks): neutralize Slack's structural Block Kit broadcasts

claude

committed

707ca62

fix(tasks): redact webhook query values and the reason phrase

claude

committed

9a2a626

fix(tasks): bound an endpoint-supplied Retry-After so it cannot strand a job (#758)

sroussey

and

claude

committed

9df2efb

fix(tasks): report the network cause, close two webhook leaks and a Slack escape gap (#761)

sroussey

and

claude

committed

58942f6

fix(tasks): exempt Slack's date token from the broadcast escape

claude

committed

24069dc

fix(tasks): bound the webhook timeout port so it cannot throw a RangeError or fire after 1 ms

claude

committed

7e18a8c

fix(tasks)!: let allow_private_destination govern the transport it declares

claude

committed

f44775f

fix(tasks): escape Slack markup by default, closing link/label injection (#805)

sroussey

and

claude

committed

744e81d

fix(tasks): classify invalid webhook headers permanently, add a header credential seam (#800)

sroussey

and

claude

committed

b14dc61

fix(tasks): close structural masked links and the date-token arity hole in Slack blocks

claude

committed

aaa55e2

fix(tasks): fail closed when a configured webhook header credential cannot be resolved

claude

committed

3f3b621

fix(tasks): redact the header credential out of webhook output, errors and stacks

claude

committed

53dce09

fix(tasks)!: require a graded network:private grant to widen past a URL's own classification

claude

committed

ca99c92

fix(tasks): rewrite a webhook error whenever redaction changes it, not only on a whole-URL match

claude

committed

21bd6eb

fix(tasks): reduce a video block's title_url masked link and correct the coverage claim

claude

committed

c1c6446

chore(tasks): name the two credential keys apart and fix the run-input private denial reason

claude

committed

308649e

Navigation Menu

Notify tasks: merge main, real-transport tests, Slack structural broadcasts, webhook redaction - #744

Notify tasks: merge main, real-transport tests, Slack structural broadcasts, webhook redaction#744
sroussey wants to merge 30 commits into
mainfrom
claude/notify-merge-main

Commits on Sep 20, 2026

feat(tasks): add webhook, Slack, and Discord notification tasks

fix(tasks): fail closed on private webhook destinations reached via a credential

refactor(tasks): categorize notify tasks and rename their credential port

fix(tasks): stop notify tasks leaking webhook tokens and mass-pinging (#714)

fix(tasks): refuse webhook redirects and withhold private failure bodies

fix(tasks): detect safeFetch redirect refusals by sentinel, not message shape

fix(tasks): redact partial webhook URLs echoed in response bodies

fix(tasks): neutralize Slack broadcasts inside `blocks`

fix(tasks): redact the success response body before returning it

fix(tasks): fail closed when a configured credential resolves to nothing

fix(tasks)!: declare private webhook destinations instead of inferring them

fix(tasks): enforce the network:private grant when a webhook posts to a private destination

test(tasks): pin the allowPrivate / privateResourceScopes arguments handed to safeFetch

test(tasks): drive the notify tasks through the real server transport

fix(tasks): neutralize Slack's structural Block Kit broadcasts

fix(tasks): redact webhook query values and the reason phrase

fix(tasks): bound an endpoint-supplied Retry-After so it cannot strand a job (#758)

fix(tasks): report the network cause, close two webhook leaks and a Slack escape gap (#761)

fix(tasks): exempt Slack's date token from the broadcast escape

fix(tasks): bound the webhook timeout port so it cannot throw a RangeError or fire after 1 ms

fix(tasks)!: let allow_private_destination govern the transport it declares

fix(tasks): escape Slack markup by default, closing link/label injection (#805)

fix(tasks): classify invalid webhook headers permanently, add a header credential seam (#800)

fix(tasks): close structural masked links and the date-token arity hole in Slack blocks

fix(tasks): fail closed when a configured webhook header credential cannot be resolved

fix(tasks): redact the header credential out of webhook output, errors and stacks

fix(tasks)!: require a graded network:private grant to widen past a URL's own classification

fix(tasks): rewrite a webhook error whenever redaction changes it, not only on a whole-URL match

fix(tasks): reduce a video block's title_url masked link and correct the coverage claim

chore(tasks): name the two credential keys apart and fix the run-input private denial reason