Add a delegated executor: agent --executor claude-cli - #31
Merged
Conversation
The claude CLI cannot be driven as a raw model (no bind_tools; it exposes a finished agent, not a tool-calling completion API), so give it the other role: --executor claude-cli hands the task, workspace and tool policy to Claude Code's headless loop on the operator's subscription. What grapharc keeps is the frame — workspace boundary, wall clock enforced from outside, --allow/--deny mapped to --allowedTools/--disallowedTools (names are Claude Code's), and start/end/stop recorded to the trace with the reported turn and token figures. The output names the trade: executor "delegated", tokens "(reported)" — coarser governance, bought deliberately. --ask is refused headless (nobody to ask); a non-claude-cli --model is refused rather than silently ignored, except the openrouter default, which argparse makes indistinguishable from --model being omitted. From Slack, --executor accepts sandbox and claude-cli, never local, and a delegated run with no explicit tool globs gets --deny Bash injected: an unsandboxed host shell is not something a bare Slack message should carry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenClaw architecture, GraphARC-shaped.
claude-cli/*cannot drive grapharc's own tool loop (nobind_tools— the CLI is a finished agent, not a completion API with tool schemas), so this gives it the inverse role:--executor claude-clidelegates the whole run to Claude Code's headless agent on the operator's subscription.What grapharc keeps: the workspace boundary (cwd of the subprocess),
--max-secondsenforced from outside,--max-turnsforwarded,--allow/--denymapped onto--allowedTools/--disallowedTools(tool names are Claude Code's), andstart/end/stoptrace events carrying the reported turns, tokens, cost and session id — sotrace/metricsread a delegated run like any other.What it says out loud: executor
delegated, tokens labelled(reported)— the governance is Claude Code's permission model rather than grapharc's per-call gate, and the numbers are the sub-agent's own accounting. Coarser, and honest about it.Refusals:
--askis refused headless (nobody to ask); a foreign--modelis refused rather than silently ignored — with the documented exception that the openrouter default spec is treated as omitted, since argparse fills the same string either way.Slack:
--executorbecomes a choice flag acceptingsandboxandclaude-cli, neverlocal; a delegated run with no explicit tool globs gets--deny Bashinjected — Claude Code's Bash is an unsandboxed shell on the host, which a bare Slack message should not carry. Explicit globs are a deliberate policy and pass through unmodified.Tests: seven against a fake
claudeon PATH that logs its argv and prints a canned JSON report (forwarding, deny-mapping, model-tail extraction, foreign-model/ask/missing-binary refusals, trace shape and token arithmetic), plus gate tests for the executor choices and the Bash injection. Full suite green,ruffclean.🤖 Generated with Claude Code