Let the operator open agent to Slack, behind a double opt-in - #27
Merged
Conversation
`agent` is the command with file tools, which is exactly why it was excluded: it acts on the host on behalf of anyone in the workspace. It now sits behind two switches rather than zero — GRAPHARC_SLACK_ALLOW_AGENT because it acts, and the existing GRAPHARC_SLACK_ALLOW_MODEL because it cannot run spend-free. One without the other stays off, and the refusal names both. Once on, the gate still decides the shape of every Slack-launched agent: the executor stays sandbox (--executor is not admitted), --system-prompt is unreachable, the workspace defaults into the bot's working directory instead of the CLI's fresh temp dir so the run's trace can be read back from Slack, and --max-seconds defaults to ten seconds under the bot's timeout so the CLI's graceful interrupt fires before the bot's kill. --allow/--deny globs pass through, repeatable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
agentfrom Slack, off by default, on only when the operator sets bothGRAPHARC_SLACK_ALLOW_AGENT=1(it acts on the host) andGRAPHARC_SLACK_ALLOW_MODEL=1(it cannot run spend-free). Either switch alone keeps it off, and the refusal message names both.When on, the gate still dictates the shape of every Slack-launched agent:
sandbox—--executoris not admitted, solocalis unreachable--system-promptnot admitted<workdir>/agent(the CLI mkdirs it) instead of the CLI's fresh temp dir, sotrace.jsonland outputs stay readable from Slack; an explicit--workspaceis confined like every other path--max-secondsdefaults to ten seconds under the bot's timeout, so the CLI's graceful interrupt-and-report fires before the bot's hard kill--allow/--denytool globs pass through and are repeatableEight new gate tests (double-switch enforcement, injected defaults, no-override of explicit values, executor/system-prompt/path-escape refusals, repeatable globs); the startup line now reports
agent on/off; cookbook 07 gains "The agent opt-in" section and 08's refusal bullet is updated. Full suite green,ruffclean.🤖 Generated with Claude Code