[zimeg]

Summary

This pull request replaces the starter agent template contents with a coding agent sample built on the OpenAI Agents SDK, ported from bolt-python-coding-agent#5 to Bolt for JavaScript.

• Mentions and direct messages get an answer in place, or a code channel when the work takes more than one message. A small routing agent decides with a create_code_channel tool, reading the thread or direct message the request came from.
• In a code channel the agent clones the repo and writes its plan to a Plan tab people can comment on. It edits files, runs commands, publishes a diff to the code tab, and registers slash commands for the channel. When done, it archives the channel with a summary. A new channel's first turn gets the conversation it was started from.
• File edits stay inside the clone and never ask. Read-only commands and local git changes like git commit run right away. Running the repo's code, or using paths outside the clone, posts Approve / Deny buttons. Commands run with spawn and no shell, so && and | reach the program as plain text, and they run without the app's secrets in their environment.
• The same 16 tools, prompts, and approval rules as the Python sample. splitCommand in agent/workspace.js splits a command the way Python's shlex.split does, so the approval check and the run see the same arguments.
• Listeners import only from agent/index.js, and the OpenAI Agents SDK stays in agent/agent.js, agent/guardrails.js, and agent/tools/, so other frameworks can follow the same structure. The root AGENTS.md lists what implementations keep the same.
• A tool that throws reaches the model with its error text, through each tool's errorFunction, instead of the SDK's default message.
• Uses client.agents.conversations.* and client.agents.sessions.* from @slack/web-api 8.2.0, now a direct dependency.
• Removes the claude-agent-sdk/ starter, .claude/ with the Bolt vendoring commands, and the maintainers guide. The Claude Agent SDK coding agent follows in a stacked pull request.
• Narrows the lint and tests matrices and dependabot to openai-agents-sdk/, and pins workflow actions with read-only permissions. Dependencies are checked daily, with a 7-day cooldown outside of Slack packages.

Windows can't start .cmd programs like npm without a shell, so those commands fail there. The README notes it.

Testing

• Copy openai-agents-sdk/.env.sample to .env, set OPENAI_API_KEY, and start the app with slack run from openai-agents-sdk/.
• Open the agent's Messages tab and confirm the suggested prompts appear. Ask a question and confirm it replies in the direct message, then ask for a change to a throwaway repo and confirm it links a new code channel.
• In a thread, mention the agent with a question about the thread and confirm it answers from the thread without creating a channel.
• In a thread, mention it with a task on a throwaway repo and confirm a code channel is created with a pointer in your thread, and that the first turn knows the thread's context.
• In the code channel, confirm the agent edits files and commits without asking. Then approve its test or build command and confirm the diff appears in the code tab. Deny a later command and confirm the agent carries on without running it.
• Run one of the agent's slash commands, like /run-tests, and confirm it starts a turn. Repeat over HTTP with app-oauth.js after setting the ngrok domain in manifest.json and SLACK_STATE_SECRET in .env.
• Send two messages quickly while the agent works and confirm they're answered together in its next turn.
• Press stop mid-turn and confirm the agent says it stopped, posts nothing more from that turn, and picks back up on your next message.
• Say the work is done and confirm the summary is shared back to your original message, the session closes, and the channel is archived.

🤖 Generated with Claude Code

[zimeg]

🌠 Comments with testing so far good before merge

[zimeg]

🧪 note: Coverage is decent so we'll continue with this for now but seek to align cases and patterns in follow up changes.

[zimeg]

🤓 note: Will review this with adjacent landings later!

[zimeg]

🏁 Now is an alright time to merge this for later follow up and adjacent provider with iteration I think