Execution safety — 3 improvements across the message→decision→execution chain

[Jianping-Xiong]

Part of an architecture improvement initiative based on Claude Code source analysis.

Related:

• #20 Context quality preservation
• #17 Experience extraction MVP

---

Three changes that work together to prevent dangerous or duplicate actions through the execution chain.

1. IM-facing agents: no bash, only skill interfaces

We already have exec-approvals with per-agent allowlists. But the safer end state: IM-facing agents don't have bash at all. They only see skill-exposed functions like search_knowledge, reply_issue, generate_report.

Attack surface shrinks from "any allowed bash command" to "only skill-defined functions." Claude Code does this with their Explore agent — bash simply isn't registered, not permission-blocked.

Legacy skills that shell out via bash should be gradually wrapped.

2. Abort safe points for non-idempotent tools

AbortController currently fires at any moment. For non-idempotent operations (send message, create resource), aborting mid-execution can leave dirty state — action happened but result wasn't recorded.

Only respond to abort at two safe points:

• Before tool execution starts (nothing happened yet)
• After execution completes but before result is persisted (can discard result)

During execution of non-idempotent tools, buffer the signal.

3. Message dedup at IM ingress

IM webhooks can deliver duplicate messages on network flicker. Without dedup, same message triggers two agent runs. For non-idempotent actions, this produces dirty data.

Dedup key: channel_id + message_id + content_hash. Drop the second if all three match.