Allow configured tools in shared Slack channels

[penso]

Summary

• persist and expose Slack untrusted_audience and untrusted_tools settings
• preserve fail-closed defaults while allowing explicit policy-based tool access for shared and non-operator turns
• document configuration, security constraints, and web UI storage limitations
• test defaults, serialization, redaction, round trips, and invalid enum values

Validation

Completed

• cargo fmt --all -- --check
• cargo test -p moltis-slack config::tests
• just lint
• ./scripts/local-validate.sh 1238
• CI format, lint, test, app, E2E, security, CodeQL, and benchmark checks

Remaining

• Code Coverage: blocked by unrelated browser_profile_lock_prevents_live_singleton_cleanup failure tracked as moltis-qxgf

Manual QA

Not performed because this environment has no Slack workspace credentials. Suggested verification:

1. Configure restrictive Slack channel and direct-message tool policies.
2. Set untrusted_audience = "trusted" and untrusted_tools = "policy".
3. Confirm configured tools are available in a shared channel and non-operator DM.
4. Remove either setting and confirm the same turns return to fail-closed tool access.
5. Confirm /sh, privileged commands, and owner-private prompt context remain unavailable outside an operator direct chat.

[greptile-apps]

Greptile Summary

The PR adds persisted Slack configuration for explicitly delegating untrusted-turn tool selection to configured policies while retaining fail-closed defaults.

• Adds and exposes untrusted_audience and untrusted_tools through Slack account configuration.
• Includes defaulting, redacted serialization, round-trip, and invalid-value tests.
• Documents shared-channel and non-operator DM policy configuration, security boundaries, and database-backed policy limitations.

Confidence Score: 5/5

The PR appears safe to merge because the new Slack settings remain fail-closed by default and are consistently propagated into the existing tool-policy boundary.

The added fields deserialize compatibly for existing accounts, survive persistence and configuration updates, map to the gateway’s untrusted-turn ceiling, and use policy-group names that match Slack’s runtime chat classification.

Important Files Changed

Filename	Overview
crates/slack/src/config.rs	Adds fail-closed Slack tool-ceiling fields, exposes them through the shared configuration view, preserves them in redacted output, and covers defaults and serialization behavior.
crates/config/src/template.rs	Adds commented Slack examples for both untrusted-turn ceiling settings.
docs/src/slack.md	Documents Slack configuration, restrictive policy examples, retained privileged-command boundaries, and web UI storage limitations.
docs/src/channels.md	Updates the shared channel security model to describe explicit Slack and WhatsApp ceiling overrides.
docs/src/tool-policy.md	Clarifies how supported channel accounts can lift the default ceiling while remaining subject to layered tool policies.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Slack message] --> B{Operator direct chat?}
    B -->|Yes| C[Trusted operator context]
    B -->|No| D[Slack untrusted-turn ceiling]
    D --> E{Audience setting}
    E -->|public| F[Public-audience tools only]
    E -->|trusted| G[Trusted-audience tools eligible]
    F --> H{Tool-name setting}
    G --> H
    H -->|deny_all| I[No tools]
    H -->|policy| J[Apply global, provider, chat-type, and sender policies]
    J --> K[Model-visible tool set]

Loading

_{Reviews (1): Last reviewed commit: "fix(slack): allow configured tools in sh..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 39 untouched benchmarks
⏩ 9 skipped benchmarks¹

---

_{Comparing plucky-keeper (185b51a) with main (a7e0847)}

Footnotes

1. 9 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩