mirror of https://github.com/hanzoai/bot.git synced 2026-10-30 17:24:26 +00:00

Files

T

zeekayandHanzo Dev bba2c1905d exec with elevated denies an unset security on the default host, as without

An unset tools.exec.security now follows the configured host before elevated
moves exec to the gateway: on the default (sandbox) host it is deny, sandboxed
or not, so elevated never turns an agent doctor and the docs call denied into
one that asks for approval (RED-EXECPARITY-3).

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-27 17:36:42 -07:00

4.3 KiB

Raw Permalink Blame History

summary, read_when, title

summary

read_when

title

Elevated exec mode and /elevated directives

Adjusting elevated mode defaults, allowlists, or slash command behavior

Elevated Mode

Elevated Mode (/elevated directives)

What it does

/elevated on runs on the gateway host and keeps exec approvals (same as /elevated ask).
/elevated full runs on the gateway host and skips exec approvals where the configured policy (tools.exec.security: "full", ask: "off", and ~/.bot/exec-approvals.json) would ask nothing.
/elevated ask runs on the gateway host but keeps exec approvals (same as /elevated on).
on/ask do not force exec.security=full; configured security/ask policy still applies.
Only changes behavior when the agent is sandboxed (otherwise exec already runs on the host).
Directive forms: /elevated on|off|ask|full, /elev on|off|ask|full.
Only on|off|ask|full are accepted; anything else returns a hint and does not change state.

What it controls (and what it doesn’t)

Availability gates: tools.elevated is the global baseline. agents.list[].tools.elevated can further restrict elevated per agent (both must allow).
Per-session state: /elevated on|off|ask|full sets the elevated level for the current session key.
Inline directive: /elevated on|ask|full inside a message applies to that message only.
Groups: In group chats, elevated directives are only honored when the agent is mentioned. Command-only messages that bypass mention requirements are treated as mentioned.
Host execution: elevated forces exec onto the gateway host. It never raises tools.exec.security: deny still refuses exec, an unset security on the default host is deny as it is without elevated, and allowlist still checks the allowlist.
Approvals: full skips exec approvals only under a full/off policy; on/ask honor them when allowlist/ask rules require.
Unsandboxed agents: no-op for location; only affects gating, logging, and status.
Tool policy still applies: if exec is denied by tool policy, elevated cannot be used.
Separate from /exec: /exec adjusts per-session defaults for authorized senders and does not require elevated.

Resolution order

Inline directive on the message (applies only to that message).
Session override (set by sending a directive-only message).
Global default (agents.defaults.elevatedDefault in config).

Setting a session default

Send a message that is only the directive (whitespace allowed), e.g. /elevated full.
Confirmation reply is sent (Elevated mode set to full... / Elevated mode disabled.).
If elevated access is disabled or the sender is not on the approved allowlist, the directive replies with an actionable error and does not change session state.
Send /elevated (or /elevated:) with no argument to see the current elevated level.

Availability + allowlists

Feature gate: tools.elevated.enabled (default can be off via config even if the code supports it).
Sender allowlist: tools.elevated.allowFrom with per-provider allowlists (e.g. discord, whatsapp).
Unprefixed allowlist entries match sender-scoped identity values only (SenderId, SenderE164, From); recipient routing fields are never used for elevated authorization.
Mutable sender metadata requires explicit prefixes:
- name:<value> matches SenderName
- username:<value> matches SenderUsername
- tag:<value> matches SenderTag
- id:<value>, from:<value>, e164:<value> are available for explicit identity targeting
Per-agent gate: agents.list[].tools.elevated.enabled (optional; can only further restrict).
Per-agent allowlist: agents.list[].tools.elevated.allowFrom (optional; when set, the sender must match both global + per-agent allowlists).
Discord fallback: if tools.elevated.allowFrom.discord is omitted, the channels.discord.allowFrom list is used as a fallback (legacy: channels.discord.dm.allowFrom). Set tools.elevated.allowFrom.discord (even []) to override. Per-agent allowlists do not use the fallback.
All gates must pass; otherwise elevated is treated as unavailable.

Logging + status

Elevated exec calls are logged at info level.
Session status includes elevated mode (e.g. elevated=ask, elevated=full).

4.3 KiB Raw Permalink Blame History Unescape Escape