CedarCopilot wants to merge 0 commits into staging from feat/chat-only-access
Live on prod, no production signal yet
Strict CloudWatch fallback found 1 prod failure log lines for [bufferSlackMessageEvent] Error buffering message (Failed query: \n SELECT cu.user_id, c.display_name AS channel_name\n FROM channel_container_users cu\n JOIN channel_containers c ON c.id = cu.container_id\n JOIN.
Strict CloudWatch fallback found 1 prod failure log lines for [MEETING_NOTES_WEBHOOK] Error processing webhook (AskElephant webhook payload must contain at least one attendee with a valid email address), but this domain-wide failure family is not tied to this intent.
Libra has verdicts on 0 of 2 tracked behaviors on prod; 2 are still being checked. Libra has 1 low-confidence degraded verdict it is still confirming. Libra checks hourly for 3 days after each deploy.
Adds chatAccessEnabled , an internal, admin-only entitlement that opens the Cedar chat agent for a user without enabling agent execution. Because every background/execution surface gates on agentExecutionEnabled alone, a user granted chat-only access can chat while all execution stays off ("everything off except chat").
Mirrors agentExecutionEnabled but is not surfaced in end-user settings.
A shared helper isChatAccessAllowed(userId) = chatAccessEnabled || agentExecutionEnabled, read from the authoritative agent_settings jsonb column (same source as the per-event execution gates). Wired into every surface that runs the chat agent:
executeChatAgentStreaming (single choke point for both the REST and container paths)runChatAgenthandleImessageBotInteraction (also covers tapback dispatch)handleSmsBotInteractionDenied users get a short "chat isn't enabled" reply on headless surfaces and a stream error+done in-app.
in-app scope already stripped from external callers).chatAccessEnabled added to the settings schema, agent_settings categorization (settings.ts), and defaultUserSettings.admin.toggleChatAccess mutation (dual-writes the authoritative agent_settings column, mirroring toggleAgentExecution).agentAccess.ts) now grants chat on either flag; +3 unit tests.Previously the headless bots (Slack/iMessage/SMS/WhatsApp) ran for any linked Cedar user, ungated. They now require chatAccessEnabled || agentExecutionEnabled. Users with agent execution on are unaffected; only users with both flags off are newly blocked.
pnpm --filter @zero/server run types Ā· @zero/mail run types , clean on all touched filespnpm deps:check , no dependency violations (service helper imports only db/env/drizzle)agentAccess jest suite , 10/10 passš¤ Generated with Claude Code
Adds an internal chat-only entitlement, persists it alongside agent settings, and applies the resulting access gate to the in-app and headless chat-agent entry points.
chatAccessEnabled to settings schemas, defaults, admin controls, and the in-app composer gate.The PR is not safe to merge until the entitlement mutation is restricted to Cedar admins and the Slack operation-driven chat-agent paths enforce the same access gate.
Regular authenticated users can currently assign the new internal entitlement to arbitrary accounts, and denied Slack users can bypass the new runChatAgent check through direct agent_prompt operation dispatch.
Files Needing Attention: apps/server/src/trpc/routes/admin.ts, apps/server/src/mastra/routeHandlers/slack/slack-bot-chat.ts, apps/server/src/mastra/operations/operation-registry.ts
The new entitlement mutation is exposed through authentication-only privateProcedure while accepting an arbitrary target user, allowing regular authenticated users to assign an intended Cedar-admin-only entitlement. How this was verified: The mutation was traced from caller-controlled userId through privateProcedure to the authoritative agent_settings write, while `cedarAd
Libra has not measured any production surfaces for this change yet.