Repository navigation
feat(agent): let the admin allow stacklet commands for the agent - #233
Conversation
The agent's allowlist needs the same answer the CLI uses to build its parser: which commands each stacklet has, and each command's HELP line. Both now live in `stack.plugins`, so the two cannot disagree and nothing imports private names from `cli.py`. No behaviour change.
The agent reaches the CLI only through the core API, which ran a fixed
set of `memory` and `docs show` commands. An admin can now list more in
`stack.toml`:
[agent]
allow = ["kettle"] # every command of the kettle stacklet
allow = ["kettle status"] # only this one
- The API reads the list on every plaintext request, so a change
applies without a restart.
- Only stacklet commands qualify: an entry must name a discovered
stacklet with CLI commands and, optionally, one of its commands. No
entry can allow a framework command such as `up` or `destroy`.
`stack up agent` warns about every entry it ignores.
- `stack up agent` writes the allowed commands, each with its own
`HELP` line, into the agent's workspace as an always-loaded skill, so
the agent can call one without asking for `--help`. With nothing
allowed there is no such skill and the prompt is unchanged.
Anything allowed runs, including commands that change something.
|
Cache alignment of the always-loaded skill (open point from the design). Measured with the Qwen3.5 tokenizer from the local model files (the rig's default, Qwen3.6-35B-A3B, is served remotely and is the same family). The example: one stacklet with five commands and HELP lines that name their arguments.
The pad tunes the stable prefix to about 8,213 tokens, just past the 8,192 boundary of two 4,096-token blocks. Five commands move it to at most about 8,340. The next boundary is 12,288, so no block is crossed and the pad stays as it is. An instance without Checks run: |
|
Validated on the test rig (port mode, 0.5 branch plus this PR,
The first chat attempt failed for an unrelated reason: every |
## Summary - The agent's shell could not run any `stack` command: nanobot 0.3.5 starts commands without PATH, so the client's `#!/usr/bin/env python3` did not find the image's Python and every call exited 127. Calls only worked when the model asked for a login shell. - The exec tool now passes PATH through. Found while validating PR #233 on the test rig; with it, the agent ran an allowed extension command from chat.
1 participant
Summary
memoryanddocs showcommands.[agent] allowinstack.tomlnow adds stacklet commands:"kettle"for all of a stacklet's commands,"kettle status"for one. The API reads it on every request.stack up agentwarns about it, so no entry can allowup,destroyorconfig.stack up agentwrites the allowed commands, each with itsHELPline, into the agent's workspace as an always-loaded skill. With nothing allowed there is no skill and the prompt is unchanged.