Merge pull request #5 from Shakudo-io/fix/validate-session-before-prompt

feat: teammate delegated sessions - start sessions on behalf of owner

Author: chyuen-devsentient

.opencode/plugin/mattermost-control/index.ts

@@ -566,6 +566,17 @@ export const MattermostControlPlugin: Plugin = async ({ client, project, directo
     const { mmClient, threadManager, openCodeSessionRegistry, threadMappingStore } = PluginState;
     if (!mmClient || !threadManager) return null;
 
+    // Check for delegated session creation (teammate starting session on behalf of owner)
+    const delegatedOwnerUserId = (post as any)._delegatedOwnerUserId as string | undefined;
+    const delegatedOwnerUsername = (post as any)._delegatedOwnerUsername as string | undefined;
+    const delegatedInitiatorUserId = (post as any)._delegatedInitiatorUserId as string | undefined;
+    const delegatedInitiatorUsername = (post as any)._delegatedInitiatorUsername as string | undefined;
+    const isDelegated = !!delegatedOwnerUserId && !!delegatedOwnerUsername;
+    
+    // For delegated sessions, the owner is the mentioned user, not the poster
+    const sessionOwnerUserId = isDelegated ? delegatedOwnerUserId : userSession.mattermostUserId;
+    const sessionOwnerUsername = isDelegated ? delegatedOwnerUsername : userSession.mattermostUsername;
+    
     try {
       const result = await client.session.create({
         body: {},
@@ -576,45 +587,67 @@ export const MattermostControlPlugin: Plugin = async ({ client, project, directo
         throw new Error("Failed to create session - no data returned");
       }
 
+      const sessionTitle = isDelegated 
+        ? `Session started by @${delegatedInitiatorUsername} for @${sessionOwnerUsername}`
+        : `Mattermost DM session`;
+      
       const sessionInfo: OpenCodeSessionInfo = {
         id: result.data.id,
         shortId: result.data.id.substring(0, 8),
         projectName: projectName,
         directory: directory,
-        title: result.data.title || `Mattermost DM session`,
+        title: result.data.title || sessionTitle,
         lastUpdated: new Date(),
         isAvailable: true,
       };
 
       const threadRootId = post.root_id || post.id;
-      log.info(`[CreateSession] post.id=${post.id}, post.root_id=${post.root_id}, threadRootId=${threadRootId}, post.channel_id=${post.channel_id}`);
+      log.info(`[CreateSession] post.id=${post.id}, post.root_id=${post.root_id}, threadRootId=${threadRootId}, post.channel_id=${post.channel_id}${isDelegated ? ` (delegated by @${delegatedInitiatorUsername} for @${sessionOwnerUsername})` : ''}`);
       const mapping = await threadManager.createThread(
         sessionInfo,
-        userSession.mattermostUserId,
+        sessionOwnerUserId,
         userSession.dmChannelId,
         threadRootId,
         post.channel_id,
-        userSession.mattermostUsername
+        sessionOwnerUsername,
+        isDelegated ? delegatedInitiatorUsername : undefined
       );
 
       const approvalPolicy = (post as any)._approvalPolicy as string | undefined;
-      if (approvalPolicy && threadMappingStore) {
+      if (threadMappingStore) {
         const updatedMapping = threadMappingStore.getBySessionId(result.data.id);
         if (updatedMapping) {
+          // Apply approval policy if set
           if (approvalPolicy === "approve_all") {
             updatedMapping.approveAllUsers = true;
             log.info(`[CreateSession] Applied approve_all policy to session ${sessionInfo.shortId}`);
           } else if (approvalPolicy === "approve_next") {
             updatedMapping.approveNextMessage = true;
             log.info(`[CreateSession] Applied approve_next policy to session ${sessionInfo.shortId}`);
           }
+          
+          // For delegated sessions, auto-approve the initiating teammate
+          if (isDelegated && delegatedInitiatorUserId) {
+            if (!updatedMapping.approvedUsers) {
+              updatedMapping.approvedUsers = [];
+            }
+            if (!updatedMapping.approvedUsers.includes(delegatedInitiatorUserId)) {
+              updatedMapping.approvedUsers.push(delegatedInitiatorUserId);
+              log.info(`[Delegation] Auto-approved initiator @${delegatedInitiatorUsername} (${delegatedInitiatorUserId}) for session ${sessionInfo.shortId}`);
+            }
+          }
+          
           threadMappingStore.update(updatedMapping);
         }
       }
 
       await openCodeSessionRegistry?.refresh();
 
-      log.info(`[CreateSession] Created new session ${sessionInfo.shortId} for @${userSession.mattermostUsername} in channel ${post.channel_id}`);
+      if (isDelegated) {
+        log.info(`[Delegation] Created delegated session ${sessionInfo.shortId} - owner: @${sessionOwnerUsername}, initiated by: @${delegatedInitiatorUsername} in channel ${post.channel_id}`);
+      } else {
+        log.info(`[CreateSession] Created new session ${sessionInfo.shortId} for @${sessionOwnerUsername} in channel ${post.channel_id}`);
+      }
 
       return {
         sessionId: result.data.id,

.opencode/plugin/mattermost-control/tools/connect.ts

@@ -502,12 +502,15 @@ function setupWebSocketListeners(
         const mapping = threadMappingStore?.getByThreadRootPostId(threadRootId);
 
         if (!mapping) {
-          // No existing session - only owner can create new sessions
+          // No existing session in this thread
+          const sessionOwnershipHandler = PluginState.sessionOwnershipHandler;
+          const mmClient = PluginState.mmClient;
+          if (!mmClient || !sessionOwnershipHandler) return;
+          
+          const ownerUserId = config.mattermost.ownerUserId;
+          
           if (isOwner) {
-            const sessionOwnershipHandler = PluginState.sessionOwnershipHandler;
-            const mmClient = PluginState.mmClient;
-            if (!mmClient || !sessionOwnershipHandler) return;
-            
+            // Owner herself @mentioned bot - standard ownership confirmation flow
             let userUsername = "unknown";
             try {
               const user = await mmClient.getUserById(postData.user_id);
@@ -524,12 +527,78 @@ function setupWebSocketListeners(
               channel.id
             );
             return;
-          } else {
-            // Team members and guests cannot create sessions - silently ignore
-            // (their own OpenCode instance may handle it)
-            log.debug(`[Channel] Non-owner @mention in unmapped thread - ignoring to allow other bots to handle (channel: ${channel.id})`);
+          }
+          
+          // Non-owner mentioned bot - only allow delegated session creation
+          // They MUST also mention the session owner (e.g., "@kaji @christine fix this")
+          // Just mentioning @kaji alone does nothing for non-owners
+          if (ownerUserId && botUser) {
+            const mentionedUsers = sessionOwnershipHandler.detectMentionedUsers(
+              postData.message,
+              botUser.username,
+              botUser.id,
+              postData.user_id
+            );
+            
+            // Check if the owner was @mentioned
+            let ownerMentioned = false;
+            let ownerUsername = "unknown";
+            if (mentionedUsers.length > 0) {
+              try {
+                const ownerUser = await mmClient.getUserById(ownerUserId);
+                ownerUsername = ownerUser.username;
+                ownerMentioned = mentionedUsers.some(
+                  m => m.toLowerCase() === ownerUsername.toLowerCase()
+                );
+              } catch (e) {
+                log.warn(`[Delegation] Could not fetch owner user info: ${e}`);
+              }
+            }
+            
+            if (!ownerMentioned) {
+              // Non-owner mentioned only @kaji without the owner - silently ignore
+              log.debug(`[Channel] Non-owner @mentioned bot without owner - ignoring (channel: ${channel.id})`);
+              return;
+            }
+            
+            // Owner was mentioned - verify the owner is actually in this channel
+            try {
+              const members = await mmClient.getChannelMembers(channel.id);
+              const ownerInChannel = members.some(m => m.user_id === ownerUserId);
+              if (!ownerInChannel) {
+                log.info(`[Delegation] Owner @${ownerUsername} is not a member of channel ${channel.id} - ignoring`);
+                return;
+              }
+            } catch (e) {
+              log.warn(`[Delegation] Could not check channel membership: ${e}`);
+            }
+            
+            let initiatorUsername = "unknown";
+            try {
+              const initiatorUser = await mmClient.getUserById(postData.user_id);
+              initiatorUsername = initiatorUser.username;
+            } catch (e) {
+              log.warn(`[Delegation] Could not fetch initiator username: ${e}`);
+            }
+            
+            log.info(`[Delegation] @${initiatorUsername} mentioned both bot and owner @${ownerUsername} - creating delegated session`);
+            
+            // Set delegation flags on the post for handleUserMessage to process
+            const delegatedPost = { ...postData } as any;
+            delegatedPost._ownershipConfirmed = true;
+            delegatedPost._approvalPolicy = "none";
+            delegatedPost._delegatedOwnerUserId = ownerUserId;
+            delegatedPost._delegatedOwnerUsername = ownerUsername;
+            delegatedPost._delegatedInitiatorUserId = postData.user_id;
+            delegatedPost._delegatedInitiatorUsername = initiatorUsername;
+            
+            await handleUserMessage(delegatedPost);
             return;
           }
+          
+          // No owner configured or bot user not available - ignore
+          log.debug(`[Channel] Non-owner @mention in unmapped thread - ignoring (channel: ${channel.id})`);
+          return;
         }
 
         // Existing session - check access permissions

README.md

@@ -5,6 +5,57 @@
 
 Control [OpenCode](https://opencode.ai) remotely via Mattermost direct messages. Send prompts to your OpenCode session by messaging a bot user, and receive real-time streaming responses.
 
+---
+
+## Release Notes
+
+### v0.3.94 — Teammate Delegated Sessions (New Feature)
+
+**Teammates can now summon the session owner's Kaji on their behalf.**
+
+#### Setup
+
+The session owner adds teammates via DM with Kaji:
+
+```
+!team add @bonnie
+!team add @yiran
+!team list
+```
+
+#### How It Works
+
+In any channel where **Kaji, the owner, and the teammate** are all members, the teammate tags both:
+
+```
+@kaji @christine please fix the login bug on line 42
+```
+
+This creates a session **owned by @christine**, using her Kaji instance. The teammate is auto-approved and can keep sending prompts and approve others to collaborate in the thread.
+
+#### Rules
+
+| Scenario | Result |
+|----------|--------|
+| Teammate tags `@kaji @owner` in a shared channel | Session created under owner's Kaji |
+| Teammate tags only `@kaji` (without owner) | Owner's Kaji stays silent; teammate's own Kaji may respond |
+| Teammate tags `@kaji @owner` in a channel the owner isn't in | Nothing happens |
+| Non-teammate tags `@kaji @owner` | Owner's Kaji does not respond |
+| Owner tags `@kaji` directly | Standard session creation flow (unchanged) |
+
+#### What the session announcement looks like
+
+```
+:rocket: OpenCode Session Started
+
+Owner: @christine
+Started by: @bonnie
+Project: my-project
+Session: a1b2c3d4
+```
+
+---
+
 ## Features
 
 ### Core Features

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-mattermost-control",
-  "version": "0.3.93",
+  "version": "0.3.94",
   "description": "OpenCode plugin for remote control via Mattermost DMs",
   "type": "module",
   "main": ".opencode/plugin/mattermost-control/index.ts",

src/models/index.ts

@@ -194,4 +194,6 @@ export interface ThreadRootPostContent {
   startedAt: Date;
   sessionTitle?: string;
   ownerUsername?: string;
+  /** Username of the teammate who initiated a delegated session (if any) */
+  delegatedByUsername?: string;
 }

src/session-ownership-handler.ts

@@ -22,6 +22,17 @@ export interface ExistingSessionOwner {
   found: boolean;
 }
 
+export interface DelegatedSessionRequest {
+  /** The user ID of the person who should own the session (the mentioned session owner) */
+  ownerUserId: string;
+  /** The username of the session owner */
+  ownerUsername: string;
+  /** The user ID of the person who initiated the request (the teammate) */
+  initiatorUserId: string;
+  /** The username of the initiator */
+  initiatorUsername: string;
+}
+
 export class SessionOwnershipHandler {
   private mmClient: any;
   private botUserId: string | null = null;
@@ -291,6 +302,31 @@ _Reply with a number (1, 2, or 3)_`;
     }
   }
 
+  /**
+   * Detect @mentions in a message, excluding the bot.
+   * Used to check if a teammate mentioned the session owner for delegation.
+   * Returns usernames (without @) of all mentioned users excluding the bot.
+   */
+  detectMentionedUsers(
+    message: string,
+    botUsername: string,
+    botUserId: string,
+    senderUserId: string
+  ): string[] {
+    const mentionRegex = /@(\w[\w.-]*)/gi;
+    const mentions: string[] = [];
+    let match;
+    
+    while ((match = mentionRegex.exec(message)) !== null) {
+      const mentionedUsername = match[1].toLowerCase();
+      if (mentionedUsername !== botUsername.toLowerCase()) {
+        mentions.push(match[1]); // Keep original casing
+      }
+    }
+    
+    return mentions;
+  }
+
   cleanupExpired(): number {
     let cleaned = 0;
     const now = Date.now();

src/thread-manager.ts

@@ -19,7 +19,8 @@ export class ThreadManager {
     dmChannelId: string,
     userPostId?: string,
     channelId?: string,
-    ownerUsername?: string
+    ownerUsername?: string,
+    delegatedByUsername?: string
   ): Promise<ThreadSessionMapping> {
     const existing = this.store.getBySessionId(sessionInfo.id);
     if (existing) {
@@ -37,6 +38,7 @@ export class ThreadManager {
       startedAt: new Date(),
       sessionTitle: sessionInfo.title,
       ownerUsername,
+      delegatedByUsername,
     };
 
     const message = this.formatThreadRootPost(content);
@@ -197,6 +199,13 @@ export class ThreadManager {
       lines.splice(2, 0, `**Owner**: @${content.ownerUsername}`);
     }
 
+    if (content.delegatedByUsername) {
+      const ownerIndex = lines.findIndex(l => l.startsWith("**Owner**:"));
+      if (ownerIndex >= 0) {
+        lines.splice(ownerIndex + 1, 0, `**Started by**: @${content.delegatedByUsername}`);
+      }
+    }
+
     lines.push(``, `_Reply in this thread to send prompts to this session._`);
 
     return lines.join("\n");