fix(webapp,slack): guard webhook composer path writes and fix package checks

Guard the webhook console path builder against prototype-pollution keys
(__proto__, constructor, prototype) flagged by static analysis.

Route webhook delivery run lookups through the run store instead of the
control-plane replica, matching how run tables are read elsewhere.

Update @trigger.dev/slack to a type-export checker compatible with the
current TypeScript, keep compiled test files out of its build, and format
two JSON fixtures.

Author: ericallam

apps/webapp/app/components/webhookConsole/WebhookComposer.tsx

@@ -449,8 +449,13 @@ function HeadersEditor({
   );
 }
 
+const UNSAFE_PATH_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
 function setPath(target: Record<string, unknown>, path: string, value: unknown) {
   const parts = path.split(".");
+  if (parts.some((part) => UNSAFE_PATH_KEYS.has(part))) {
+    return;
+  }
   let cursor = target;
   for (let i = 0; i < parts.length - 1; i++) {
     const key = parts[i];

apps/webapp/app/presenters/v3/WebhookDeliveriesListPresenter.server.ts

@@ -2,6 +2,7 @@ import { type ClickHouse } from "@internal/clickhouse";
 import { type PrismaClientOrTransaction, type WebhookDeliveryStatus } from "@trigger.dev/database";
 import parseDuration from "parse-duration";
 import { webhookReplica } from "~/db.server";
+import { runStore } from "~/v3/runStore.server";
 import { webhookDeliveriesRepository } from "~/services/webhookDeliveriesRepository/webhookDeliveriesRepository.server";
 import {
   resolveDeliveryRunTargets,
@@ -77,10 +78,11 @@ export class WebhookDeliveriesListPresenter {
     // Resolve it, and force empty results when no run matches.
     let internalRunId: string | undefined;
     if (runId) {
-      const run = await this.replica.taskRun.findFirst({
-        where: { friendlyId: runId },
-        select: { id: true },
-      });
+      const run = await runStore.findRun(
+        { friendlyId: runId },
+        { select: { id: true } },
+        this.replica
+      );
       internalRunId = run?.id ?? "__none__";
     }
 

apps/webapp/app/presenters/v3/WebhookDeliveryDetailPresenter.server.ts

@@ -6,6 +6,7 @@ import {
   type WebhookDeliveryStatus,
 } from "@trigger.dev/database";
 import { webhookReplica } from "~/db.server";
+import { runStore } from "~/v3/runStore.server";
 import { webhookDeliveriesRepository } from "~/services/webhookDeliveriesRepository/webhookDeliveriesRepository.server";
 
 export type WebhookDeliveryDetail = {
@@ -80,10 +81,7 @@ export class WebhookDeliveryDetailPresenter {
     let session: { friendlyId: string; externalId: string | null } | null = null;
     if (delivery.runId) {
       const [taskRun, sessionRun] = await Promise.all([
-        this.replica.taskRun.findFirst({
-          where: { id: delivery.runId },
-          select: { friendlyId: true },
-        }),
+        runStore.findRun({ id: delivery.runId }, { select: { friendlyId: true } }, this.replica),
         this.replica.sessionRun.findUnique({
           where: { runId: delivery.runId },
           select: { session: { select: { friendlyId: true, externalId: true } } },

apps/webapp/app/presenters/v3/WebhookDetailPresenter.server.ts

@@ -10,6 +10,7 @@ import parseDuration from "parse-duration";
 import { z } from "zod";
 import { type Direction } from "~/components/ListPagination";
 import { webhookReplica } from "~/db.server";
+import { runStore } from "~/v3/runStore.server";
 import { findCurrentWorkerFromEnvironment } from "~/v3/models/workerDeployment.server";
 import { webhookDeliveriesRepository } from "~/services/webhookDeliveriesRepository/webhookDeliveriesRepository.server";
 import {
@@ -89,10 +90,10 @@ export async function resolveDeliveryRunTargets(
   if (runIds.length === 0) return { runFriendlyIdById, sessionByRunId };
 
   const [runs, sessionRuns] = await Promise.all([
-    replica.taskRun.findMany({
-      where: { id: { in: runIds } },
-      select: { id: true, friendlyId: true },
-    }),
+    runStore.findRuns(
+      { where: { id: { in: runIds } }, select: { id: true, friendlyId: true } },
+      replica
+    ),
     replica.sessionRun.findMany({
       where: { runId: { in: runIds } },
       select: { runId: true, session: { select: { friendlyId: true, externalId: true } } },

internal-packages/webhook-sources/catalog/providers.json

@@ -3,23 +3,10 @@
   "scope": "ai-agent-first",
   "updatedAt": null,
   "definitionOfDone": {
-    "first-class": [
-      "registryEntry",
-      "samples",
-      "roundTrip",
-      "producer"
-    ],
-    "sample-only": [
-      "registryEntry",
-      "samples"
-    ]
+    "first-class": ["registryEntry", "samples", "roundTrip", "producer"],
+    "sample-only": ["registryEntry", "samples"]
   },
-  "statusValues": [
-    "not-started",
-    "in-progress",
-    "complete",
-    "blocked"
-  ],
+  "statusValues": ["not-started", "in-progress", "complete", "blocked"],
   "providers": [
     {
       "id": "anthropic",