[zimeg]

Summary

This pull request brings the claude-agent-sdk app to parity with the OpenAI Agents SDK team agent from #5: the agent writes what channel messages settle into runbooks, then answers from those runbooks next time.

• Runbooks are canvases titled Runbook: <topic>.
• Bot-token runbook tools list_runbooks (files.list), read_runbook (canvases.getContent), and create_runbook (canvases.create with channel_id) are served in-process with create_sdk_mcp_server(), next to the emoji reaction tool.
• The Slack MCP Server is optional. When a person has connected it, the agent uses the Slack MCP Server's search and canvas tools in place of the bot-token runbook tools, so it works as them and can edit existing runbooks.
• Tools are limited with permission_mode="dontAsk" and an allowed_tools list for each path, replacing bypassPermissions. The Claude Agent SDK has no tool filter, so the model still sees the other Slack MCP tools, but calls to them are denied.
• The in-process tool server is built for each run with only that path's tools, so the bot-token runbook tools aren't offered next to the Slack MCP Server. disallowed_tools would deny them but leave them visible, and the model kept calling them.
• slack_search_public is allowed next to slack_search_public_and_private. The model picks public search to find runbooks, and it reaches no further than the private search already allowed.
• One agent learns as it answers. The message listener runs it on each channel message. When a run calls a runbook write tool, the message's author gets an ephemeral note with the link. Nothing is posted to the channel.
• run_agent() also returns the names of the tools it called, which is how the learn pass knows a runbook was written. The reply is the result message's final text.
• Runs are capped at 50 turns, and a run that hits the cap ends with a message.
• Matching bolt-python-coding-agent, the model is pinned to claude-sonnet-5-5, and the agent gets none of Claude Code's built-in tools, settings, or local MCP servers (tools=[], setting_sources=[], strict_mcp_config=True, verbatim_prompts=True).
• New bot scopes: canvases:read, canvases:write, files:read. Both scope lists are sorted.

Known risks (same as #5):

• With the Slack MCP Server connected, a crafted message could steer the agent into searching the author's DMs and private channels, or into editing any canvas they can open.
• Two messages close together are learned from at the same time, which can create two copies of a new runbook.
• Learning sees only the message itself, not its thread.

Testing

• Run slack run and invite the agent to a channel. Post "Fixed it: rotate the signing secret, then redeploy." Confirm a Runbook: <topic> tab appears in the channel and only you see an ephemeral note with the link.
• Post small talk and confirm nothing changes and no note appears.
• @mention the agent with the same problem and confirm it answers from the runbook and links it.
• With OAuth (app_oauth.py), connect the Slack MCP Server from the Home tab. Post a correction ("Actually, redeploy before rotating") and confirm the existing runbook is updated.
• With the Slack MCP Server connected, @mention the agent asking it to post a message in another channel, and confirm it doesn't.

🤖 Generated with Claude Code