feat(mattermost): thread context seeding, allowlist-filtered

[crisap94]

What does this PR do?

Seeds prior thread history as context when the bot is @mentioned inside an existing thread for the first time, so the agent understands the conversation it was pulled into — not just the single message it was tagged in. History is injected via MessageEvent.channel_context (consumed in gateway/run.py).

🔗 Stacked on #43804 (in-thread auto-response). This branch contains that PR's commit plus one more — please review the thread context seeding commit here, and merge after #43804. (Cross-fork PRs can't target a fork branch as base, hence the cumulative diff.)

Security: the allowlist must apply to seeded context

The user allowlist is enforced in gateway/authz_mixin.py::_is_user_authorized, per message, by the triggering author — downstream of the adapter. Injected channel_context rides inside the authorized user's message and is not re-checked by authz. So seeding the whole thread verbatim would feed a non-allowlisted user's messages into the model (an unauthorized-content / prompt-injection vector).

This PR filters seeded history to authors in MATTERMOST_ALLOWED_USERS (or everyone when *_ALLOW_ALL_USERS is set), and adds MATTERMOST_THREAD_CONTEXT to control the policy explicitly:

Value	Behavior
allowlisted (default)	Seed only messages from allowlisted authors
off	Never seed thread history (no fetch)
all	Seed the full thread regardless of author, without widening who may invoke the bot

This filtering is the piece the existing thread-context PRs (#38362, #38152) do not have.

Type of Change

• ✨ New feature (thread-context seeding)
• 🔒 Security fix (allowlist-filtered context)
• ✅ Tests
• 📝 Documentation update

Changes Made

All in plugins/platforms/mattermost/adapter.py (the thread-context commit):

• _fetch_thread_context() — fetches GET /posts/{root}/thread, fails open via the existing _api_get, TTL-cached, excludes the trigger/bot/system posts, filters to allowlisted authors, injects via channel_context.
• _thread_context_author_allowed() — mirrors the authz allowlist; honors MATTERMOST_THREAD_CONTEXT=all.
• _thread_context_mode() — off / allowlisted / all.
• First-turn injection guarded by _has_active_session_for_thread (from feat(mattermost): in-thread auto-response (Slack parity) #43804) so it runs once per thread.
• Tests: TestMattermostThreadContext (filter, allow-all, knob off/all, fail-open, DM).
• Docs: MATTERMOST_THREAD_CONTEXT + the allowlist-context warning.

How to Test

1. MATTERMOST_ALLOWED_USERS=<you>. @mention the bot in a thread with prior messages → reply reflects them.
2. A non-allowlisted user posts in the thread → ignored, and their text does not appear in the bot's context.
3. MATTERMOST_THREAD_CONTEXT=off → no seeding; =all → full thread seeded without opening invocation.
4. pytest tests/gateway/test_mattermost.py -q → 63 passed.

Checklist

• Conventional Commits (feat(mattermost): …)
• Searched existing PRs — supersedes fix: preserve Mattermost thread context for prompts #38362, fix(mattermost): seed first thread turn context #38152 (adds the allowlist filter they lack); stacked on feat(mattermost): in-thread auto-response (Slack parity) #43804
• Tests added; pytest tests/gateway/test_mattermost.py -q passes (63)
• Docs updated
• Tested on Debian 13 (Linux 6.8)
• cli-config.yaml.example — N/A (env/config.extra-driven)

[teknium1]

Thanks for addressing a real Mattermost context gap: current main creates the event without thread history at plugins/platforms/mattermost/adapter.py:949-958, while gateway/run.py:10394-10395 already consumes channel_context.

Problems

• plugins/platforms/mattermost/adapter.py:723-746 reimplements only part of authorization. It misses the global allowlist and pairing-store grants used by gateway/authz_mixin.py:454-465. Current main’s adapter callback (gateway/platforms/base.py:2838-2869, gateway/run.py:8785-8815) exists specifically to reuse that full chain for fetched context.
• The cache at proposed adapter.py:795-797 is keyed only by thread root although the rendered result excludes current_post_id at lines 811-813. A second user’s first turn within the TTL can therefore receive stale context that omits the first user’s now-prior post. The added tests (tests/gateway/test_mattermost.py:946-1010) do not cover that sequence.
• The two new controls are documented but absent from the Mattermost setup manifest (plugins/platforms/mattermost/plugin.yaml:15-49).

Suggested changes

• Use _is_sender_authorized(...) and test global/pairing authorization.
• Make cache results trigger-specific or regenerate them from cached raw posts; test two first-session users.
• Register both controls in the Mattermost plugin manifest.

Automated hermes-sweeper review.

[teknium1]

This duplicates only a subset of gateway authorization: it misses GATEWAY_ALLOWED_USERS and pairing-store grants. Current main provides _is_sender_authorized(author, chat_type=chat_type, chat_id=channel_id) specifically so fetched context uses the complete GatewayRunner._is_user_authorized chain; please use that callback instead of re-parsing env vars.

[teknium1]

The cached string depends on current_post_id because the loop excludes that post, but this key is only thread_root_id. A later first turn by another user during the TTL receives the earlier rendered string and loses the first trigger as prior context. Cache raw posts or make this result trigger-specific, with a two-user regression test.

[teknium1]

Please add regression coverage for two authorized users entering the same thread within the cache TTL: the second user’s seeded context must include the first user’s earlier triggering post.