Done

Webhook triggers: isolation/tool allowlist, per-trigger secrets, native replay protection

From asantosDone 3 weeks ago

Context: We run an automated PR reviewer from a generic webhook trigger fired by CI. The payload is produced by pull-request code, so it is untrusted by construction. The agent posts review comments with a Forgejo token.

1. Isolated execution or an enforced per-trigger tool allowlist. The spawned agent runs on the user's workstation with the full shell, files and every MCP tool. Today its limits are prompt text only, which a prompt injection in the payload can override. We need either an isolated environment or a per-trigger allowlist of tools and commands that the platform enforces.

2. Per-trigger secret scoping. Secrets reach an agent only through saved-agent, project or provider environment variables. A trigger spawns its own agent spec, so a token meant for one trigger must be exposed to the whole project. We need an environment/secrets field on the trigger itself.

3. Native replay protection. The generic source signs only the body (X-AgentsRoom-Signature) and sends X-AgentsRoom-Delivery. We need a signed timestamp header with a configurable acceptance window, plus native dedupe on the delivery id. Today the agent checks this in its prompt, which the platform does not enforce.

AgentsRoom diagnostics

App version: 1.192.0
OS: linux 7.2.6-1-cachyos (x64)
Agent CLI: claude
App language: system

Problem to solve

Webhook-triggered agents act on untrusted payloads, but their only guardrails are prompt text: no enforced tool limits, secrets cannot be scoped to one trigger, and replay/dedupe is not enforced by the platform.

Proposed behavior

(1) Isolated execution or an enforced per-trigger tool/command allowlist. (2) An env/secrets field on the trigger. (3) A signed timestamp header with a configurable window, plus native dedupe on X-AgentsRoom-Delivery.

Who benefits

Teams running agents from CI/webhook triggers that act under a user's identity (e.g. automated PR review posting with a user token).

Acceptance criteria

Webhook agents can safely hold scoped credentials and act without relying on prompt-only controls.

Replies

The team3 weeks ago

Thanks: your idea is implemented and ships in the next release. We built it the way we pictured it, so if the result is not what you had in mind, tell us and we will adjust it.