Repository navigation
Add iMessage and WhatsApp capabilities to CLAUDE.md - #118
Merged
Merged
Conversation
Document imsg (iMessage) and wacli (WhatsApp) CLI tools now installed. Include send/read examples and the "confirm before sending" reminder. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
liususan091219
pushed a commit
to liususan091219/sutando-fork
that referenced
this pull request
May 28, 2026
Document imsg (iMessage) and wacli (WhatsApp) CLI tools now installed. Include send/read examples and the "confirm before sending" reminder. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
liususan091219
added a commit
that referenced
this pull request
Jul 8, 2026
* fix(voice): misfire-guard description for get_current_time (#118 item 3 sibling) 3-day trace audit across live voice sessions: 12 of 14 get_current_time fires were spurious — triggered by 'Shh.', 'Mm-hm.', 'Open a tab', and 'what is the paper about?' (Chi's demo, announced the date instead of answering). The bare one-line description ('Get the current date and time. Instant.') gave the model nothing about when NOT to fire; it had become the confusion fallback. The description now scopes the tool to explicit time/date asks and instructs firing nothing when unsure. Sibling of sonichi/sutando-meeting#125 (same audit, voice-server-side tools). Behavior unchanged; description only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(voice): round-2 misfire guards from the full 7-day trace audit Owner-ordered follow-up ('search sqlite for any other tools called without explicitly requesting'). Audit of every tool call paired with its preceding utterance found these firing unprompted: - press_key: fired twice on 'Hey Google' (user addressing their Google speaker; the bot pressed keys on the host) — now excludes speech addressed to other assistants - summon: 4/4 spurious ('you're not showing the slide though') — now routes display complaints to display tools, not Zoom - switch_voice_config: fired on a sentence about search engines — now marked HIGH-IMPACT, explicit-switch-only - add_to_vault: 2/3 spurious ('summarize all the bugs you found' got vaulted instead of summarized) — capture-intent only - get_core_status: 3/4 spurious ('Hello') — explicit status asks only - describe_screen / show_view / slide_control: fired on 'Um' and 'what what what I' — explicit requests only All description-only; shared clause: when unsure, fire nothing. Sibling: sonichi/sutando-meeting#125 round 2 (dismiss, open_github_url). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(voice): trim round-2 guards to frequently-misfired tools only (owner scope) Per Susan: only tools EASILY called by mistake keep the guard clause. Removed the guards from describe_screen (1/1 fire), show_view (1/1), and slide_control (2/5 — majority-legit usage). Kept: get_current_time (12/14 spurious), press_key (2/2, both 'Hey Google'), summon (4/4), switch_voice_config (2/2), add_to_vault (2/3), get_core_status (3/4). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: regenerate voice-behavior-anchors fixture for the description changes ANCHOR_UPDATE=1 per the test's documented flow — the misfire-guard description edits (get_current_time, press_key, summon, switch_voice_config, add_to_vault, get_core_status) are deliberate prompt changes; the fixture now anchors the new wording. Addresses Rui's review (CI 'tool-table anchor' failure). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
john-the-dev
added a commit
to john-the-dev/sutando
that referenced
this pull request
Aug 4, 2026
…onichi#2533 spec - The audit-log references were to AG2Platform/agent-universe#118 (log-before-mutate staff audit), not sonichi#118 (unrelated) — qualified all three. - Noted that src/credential-resolver.ts (shipped, tested) should converge with the pending capability-resolver spec sonichi#2533. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XaocEvWwhBokFUmK5ECsfs
john-the-dev
added a commit
to john-the-dev/sutando
that referenced
this pull request
Aug 4, 2026
sonichi review (comment-only): 1. Motivating failure sonichi#1 was backwards — the sandboxed PR-review path already mediates (review-pr.sh fetches the diff OUTSIDE the sandbox = scoped github:read, then codex --sandbox read-only). Reframed: the capability layer is present but SELECTING it is an unenforced judgment call (agent took the generic sandbox action, not the PR-review action; nothing caught the mismatch). Sharper motivating failure, same shape as sonichi#2. 2. Policy matrix quietly widened team tier on credentials. Split the merged 'creds->use' cell into credential USE (mediator exercises, never discloses; team allow) vs credential READ (raw value; team DENY) — preserving today's 'Never read .env' rule verbatim instead of hiding a loosened cell. 3. Open-question 2 inverted: hook-from-day-one for needs-authorization + prohibited rows, library only for reversible reads. An advisory library the agent can skip is discipline not mechanism (comm-sweep / context-source-guard precedent), and library-first would ship the prompt-injection property in name but the honor system in fact. + Failure sonichi#3 now states the audit records the VERIFIED outcome, not the callee's self-reported return (a log-after-execute would have logged {ok:true} too). + Open-question 1 resolved (sonichi): credential:* + github:* is the right first cut. bassil review: + credential-resolver code has since landed (src/credential-resolver.ts + credential_resolver.py, sonichi#2533 spec / sonichi#2575) — 'reuses shipped code' is now literal; noted it was aspirational at review time. + Audit citation is AG2Platform/agent-universe#118 (fully-qualified, correct = 'audit log for all staff actions'); inlined the title so it's self-verifying (bassil had misread it as sonichi#118).
john-the-dev
added a commit
that referenced
this pull request
Aug 7, 2026
* docs(design): RFC for a mediated capability layer Owner-requested. One layer every privileged action flows through: a consumer requests a typed CAPABILITY (not a raw key/tool/merge button), and a mediator resolves + authorizes + executes + audits it against a single capability×tier policy matrix — generalizing the "capability, not key" pattern that credential-resolver.ts already proves, and folding in access tiers, vault, sandboxed delegation, and per-action owner authorization. Draft RFC only (no behavior change); ends with open questions for the owner on scope, enforcement locus (library vs PreToolUse hook), and intent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XaocEvWwhBokFUmK5ECsfs * docs(design): add observed failure cases motivating the layer Owner asked for concrete, real failures (not hypotheticals). Adds three that happened 2026-08-04, each a different symptom of the same missing layer: 1. sandboxed reviewer starved of github:read → review failed outright (the "asked to review, failed miserably" case); 2. relayed-authorization push defended only by hand (should be a mechanical needs-authorization outcome); 3. a swallowed-insert data-loss bug with no uniform privileged-write contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XaocEvWwhBokFUmK5ECsfs * docs(design): address review — fix #118 cross-repo cite, note #2533 spec - The audit-log references were to AG2Platform/agent-universe#118 (log-before-mutate staff audit), not #118 (unrelated) — qualified all three. - Noted that src/credential-resolver.ts (shipped, tested) should converge with the pending capability-resolver spec #2533. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XaocEvWwhBokFUmK5ECsfs * docs(rfc): address sonichi + bassil review on mediated-capability-layer sonichi review (comment-only): 1. Motivating failure #1 was backwards — the sandboxed PR-review path already mediates (review-pr.sh fetches the diff OUTSIDE the sandbox = scoped github:read, then codex --sandbox read-only). Reframed: the capability layer is present but SELECTING it is an unenforced judgment call (agent took the generic sandbox action, not the PR-review action; nothing caught the mismatch). Sharper motivating failure, same shape as #2. 2. Policy matrix quietly widened team tier on credentials. Split the merged 'creds->use' cell into credential USE (mediator exercises, never discloses; team allow) vs credential READ (raw value; team DENY) — preserving today's 'Never read .env' rule verbatim instead of hiding a loosened cell. 3. Open-question 2 inverted: hook-from-day-one for needs-authorization + prohibited rows, library only for reversible reads. An advisory library the agent can skip is discipline not mechanism (comm-sweep / context-source-guard precedent), and library-first would ship the prompt-injection property in name but the honor system in fact. + Failure #3 now states the audit records the VERIFIED outcome, not the callee's self-reported return (a log-after-execute would have logged {ok:true} too). + Open-question 1 resolved (sonichi): credential:* + github:* is the right first cut. bassil review: + credential-resolver code has since landed (src/credential-resolver.ts + credential_resolver.py, #2533 spec / #2575) — 'reuses shipped code' is now literal; noted it was aspirational at review time. + Audit citation is AG2Platform/agent-universe#118 (fully-qualified, correct = 'audit log for all staff actions'); inlined the title so it's self-verifying (bassil had misread it as #118). * docs(rfc): bind authority grants and verified outcomes * docs(design): address RFC review — routing totality, escalation delivery contract, dispatcher reconciliation Addresses sonichi's later reviews on #2632: - Totality at TWO levels: add inbound-content classification totality (observable unclassified terminal), distinct from the capability×tier matrix totality. - Escalation delivery contract: needs-authorization must use write-then-assert (pending-questions EOF-below-#Resolved is silently uncounted; notify is cooldown-gated) + a defined never-answered terminal state (fail-closed, never times out into allow). - Reconcile src/capability-policy.* with CLAUDE.md:42's dispatcher.py mandate: policy-as-data consumed by dispatcher + PreToolUse hook, not a competing gate; note the CLAUDE.md:42 follow-up so the two homes don't drift. - Resolve open-question 3 (owner-tier recording: yes). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(design): make policy matrix rows disjoint; align purchase/financial with CLAUDE.md Addresses qingyun's CR on #2632: the matrix had 'purchase' in the write-irreversible row (owner=allow) AND under financial/destructive=never, giving one capability two incompatible decisions, and blanket-never for all financial contradicted CLAUDE.md:7-9 (financial delegated with confirmation). Split into three disjoint rows: - write-irreversible (send/merge/publish/config-write) — owner allow is now explicitly confirm-gated unless standing approval (CLAUDE.md:7-9). - purchase (goods/services) — its own row; owner=needs-authorization (confirm), matching CLAUDE.md's checkout-with-confirmation; not prohibited. - financial-move / credential-entry — enumerated human-only set (trades/transfers of funds + entering credentials/IDs), never for all tiers incl. owner, citing the canonical standing Prohibited list. Every capability now has exactly one decision. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(design): make the decision model mechanically enforceable + disjoint (qingyun round 2) Addresses qingyun's re-review on #2632 (a0e93ac): 1. Owner write-irreversible was 'allow' (executes immediately) while the footnote required confirmation — the table couldn't enforce CLAUDE.md:7-9. Now resolves to needs-authorization; policy() gains a input; a covering standing grant auto-satisfies, else confirm. Added a standing-grant definition. 2. credential:use ('inject key server-side') overlapped credential-entry ('entering API keys'). Made disjoint: use = exercise an ALREADY-VAULTED secret, never entered/surfaced; entry = typing a NEW secret value into a field. 3. The 'standing Prohibited list' wasn't in-tree. Reframed as an external operator/platform-policy overlay (prohibited_overlay input to policy()) that the reference deployment populates — a checkable declared input, not an unverifiable citation. CLAUDE.md:7-9 stays the checked-in confirm authority. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Chi Wang <4250911+sonichi@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Both tools installed via brew (steipete/tap).
🤖 Generated with Claude Code