sandbox-quantum · simonflk-sb · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026
@@ -184,6 +184,12 @@ services:
       MM_DISPLAYSETTINGS_CUSTOMURLSCHEMES: switchdash
       MM_SERVICESETTINGS_ENABLEBOTACCOUNTCREATION: "true"
       MM_SERVICESETTINGS_ENABLEUSERACCESSTOKENS: "true"
+      # Mattermost refuses to call a private address from an integration unless
+      # the host is named here, and a button on a Switch card is delivered by
+      # exactly that path — a POST from this container to switch-core's callback
+      # port on the compose network. Without it a press fails inside Mattermost
+      # and the person sees nothing.
+      MM_SERVICESETTINGS_ALLOWEDUNTRUSTEDINTERNALCONNECTIONS: switch
       MM_TEAMSETTINGS_ENABLEOPENSERVER: "true"
       MM_TEAMSETTINGS_TEAMMATENAMEDISPLAY: "full_name"
       # Neither plugin is usable in a bundled Switch deployment: Copilot has no
@@ -244,6 +250,9 @@ services:
       SWITCH_URL: http://switch:8000
       MATTERMOST_URL: http://mattermost:8065
       MATTERMOST_URL_FOR_SWITCH: http://mattermost:8065
+      # The route back: where the Mattermost container reaches switch-core's
+      # callback port, for the button presses Mattermost delivers by HTTP.
+      MATTERMOST_CALLBACK_BASE_URL: http://switch:8081
       MATTERMOST_ADMIN_USER: ${MATTERMOST_ADMIN_USER}
       MATTERMOST_ADMIN_PASSWORD: ${MATTERMOST_ADMIN_PASSWORD}
       MATTERMOST_TEAM_NAME: ${MATTERMOST_TEAM_NAME}

@@ -569,6 +569,7 @@ describe('ClaudeAdapter approvals', () => {
     expect(opened.requestType).toBe('command_execution_approval');
     expect(opened.turnId).toBe('turn-1');
     expect(opened.title).toBe('Claude wants to run echo hi');
+    expect(opened.detail).toBe('echo hi');
     expect(opened.options.map((option) => option.decision)).toEqual([
       'accept',
       'acceptForSession',
@@ -581,6 +582,98 @@ describe('ClaudeAdapter approvals', () => {
     expect(resolved.decision).toBe('accept');
   });
 
+  it('puts the command in detail and the description in the title', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    void sdk.canUseTool()(
+      'Bash',
+      { command: 'pwd', description: 'Print working directory' },
+      toolOptions(controller.signal)
+    );
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(opened.title).toBe('Print working directory');
+    expect(opened.detail).toBe('pwd');
+  });
+
+  it('names the tool when a command arrives with nothing to describe it', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    void sdk.canUseTool()('Bash', { command: 'pwd' }, toolOptions(controller.signal));
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(opened.title).toBe('Run a Bash command');
+    expect(opened.detail).toBe('pwd');
+  });
+
+  it('keeps the description when the host also supplied a title', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    void sdk.canUseTool()(
+      'Bash',
+      { command: 'npm run deploy' },
+      toolOptions(controller.signal, {
+        title: 'Run deployment',
+        description: 'Uses production credentials.',
+      })
+    );
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(opened.title).toBe('Run deployment — Uses production credentials.');
+    expect(opened.detail).toBe('npm run deploy');
+  });
+
+  it('does not cut the decision context before anything has budgeted it', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    const reason = `${'This runs against the configured workspace. '.repeat(6)}It writes to production.`;
+    void sdk.canUseTool()(
+      'Bash',
+      { command: 'npm run deploy' },
+      toolOptions(controller.signal, { description: reason })
+    );
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(reason.length).toBeGreaterThan(160);
+    expect(opened.title).toBe(reason);
+  });
+
+  it('says a title once when the host sends it as both title and description', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    void sdk.canUseTool()(
+      'Bash',
+      { command: 'pwd' },
+      toolOptions(controller.signal, {
+        title: 'Print working directory',
+        description: 'Print working directory',
+      })
+    );
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(opened.title).toBe('Print working directory');
+  });
+
+  it('leaves a tool that is not a command with its description as the detail', async () => {
+    const { sdk, adapter, recorder } = await startSession();
+    await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });
+    const controller = new AbortController();
+    void sdk.canUseTool()(
+      'Write',
+      { file_path: '/work/notes.md' },
+      toolOptions(controller.signal, { description: 'Create the notes file' })
+    );
+
+    const opened = await recorder.waitFor('request.opened', () => true, 1_000);
+    expect(opened.title).toBe('Write /work/notes.md');
+    expect(opened.detail).toBe('Create the notes file');
+  });
+
   it('rescopes the CLI suggestions to the session on acceptForSession', async () => {
     const { sdk, adapter, recorder } = await startSession();
     await adapter.sendTurn({ sessionId: SESSION, turnId: 'turn-1', text: 'go' });

@@ -37,6 +37,7 @@ import type {
   UserInputQuestion,
 } from '../events';
 import {
+  approvalContent,
   isRecord,
   itemTypeForTool,
   outcomeForResult,
@@ -977,8 +978,7 @@ export class ClaudeAdapter implements ProviderAdapter {
         turnId,
         requestId,
         requestType: requestTypeForTool(toolName),
-        title: options.title ?? toolTitle(toolName, toolInput),
-        ...(options.description ? { detail: options.description } : {}),
+        ...approvalContent(toolName, toolInput, options.title, options.description),
         options: APPROVAL_OPTIONS,
         raw: { source: 'claude', payload: { toolName, toolInput } },
       });

@@ -75,6 +75,43 @@ export function toolTitle(toolName: string, input: Record<string, unknown>): str
   return toolName;
 }
 
+/**
+ * Which part of a permission request is the command and which is the prose.
+ *
+ * A reader sees `detail` set apart — a code span where the surface has one — so
+ * it has to be the literal thing being approved, not a second sentence about
+ * it. For a command tool the command is in the input and the summary is the
+ * prose, which is the opposite of how they read on an activity item.
+ *
+ * Both halves of the prose are kept when the host sends both: a title says what
+ * the command is for and a description often says what it will cost, and
+ * someone deciding needs the second one most. Nothing is cut here — a consumer
+ * that cuts also records that it did, and answers for whether what survived is
+ * still enough to decide on. Cutting first hides that judgement from it.
+ */
+export function approvalContent(
+  toolName: string,
+  input: Record<string, unknown>,
+  title: string | undefined,
+  description: string | undefined
+): { title: string; detail?: string } {
+  if (COMMAND_TOOLS.has(toolName)) {
+    const command = stringField(input, 'command');
+    if (command) {
+      const summary = description ?? stringField(input, 'description');
+      const prose = [...new Set([title, summary].filter((part) => part !== undefined))];
+      return {
+        title: prose.length > 0 ? prose.join(' — ') : `Run a ${toolName} command`,
+        detail: command,
+      };
+    }
+  }
+  return {
+    title: title ?? toolTitle(toolName, input),
+    ...(description ? { detail: description } : {}),
+  };
+}
+
 /**
  * The CLI stamps a user abort on the result: `aborted_streaming` when the
  * interrupt landed mid-stream, `aborted_tools` when it landed in a tool call.

@@ -386,6 +386,58 @@ describe('CodexAdapter', () => {
     expect(eventsOf(events, 'request.resolved')[0]).toMatchObject({ decision: 'decline' });
   });
 
+  it('puts the command in detail and the reason for asking in the title', async () => {
+    const { adapter, server, events } = await start('approval-required');
+    server.replyAlways('turn/start', () => ({ turn: { id: 'native-a', status: 'inProgress' } }));
+    await adapter.sendTurn({ sessionId: 'session-1', turnId: 'caller-1', text: 'run it' });
+    server.notify('turn/started', turnNotification('native-a', 'inProgress'));
+
+    server.send({
+      id: 92,
+      method: 'item/commandExecution/requestApproval',
+      params: {
+        threadId: THREAD,
+        turnId: 'native-a',
+        itemId: 'exec-1',
+        command: 'rm -rf build',
+        cwd: '/work',
+        reason: 'Clearing stale build output',
+        availableDecisions: ['accept'],
+      },
+    });
+    await vi.waitFor(() => expect(eventsOf(events, 'request.opened')).toHaveLength(1));
+    expect(eventsOf(events, 'request.opened')[0]).toMatchObject({
+      title: 'Clearing stale build output',
+      detail: 'rm -rf build',
+    });
+  });
+
+  it('keeps the working directory visible when codex gives no reason', async () => {
+    const { adapter, server, events } = await start('approval-required');
+    server.replyAlways('turn/start', () => ({ turn: { id: 'native-a', status: 'inProgress' } }));
+    await adapter.sendTurn({ sessionId: 'session-1', turnId: 'caller-1', text: 'run it' });
+    server.notify('turn/started', turnNotification('native-a', 'inProgress'));
+
+    server.send({
+      id: 93,
+      method: 'item/commandExecution/requestApproval',
+      params: {
+        threadId: THREAD,
+        turnId: 'native-a',
+        itemId: 'exec-1',
+        command: 'echo hi',
+        cwd: '/work',
+        reason: null,
+        availableDecisions: ['accept'],
+      },
+    });
+    await vi.waitFor(() => expect(eventsOf(events, 'request.opened')).toHaveLength(1));
+    expect(eventsOf(events, 'request.opened')[0]).toMatchObject({
+      title: 'Run a command in /work',
+      detail: 'echo hi',
+    });
+  });
+
   it('surfaces a question and answers it with the codex answer shape', async () => {
     const { adapter, server, events } = await start();
     server.replyAlways('turn/start', () => ({ turn: { id: 'native-a', status: 'inProgress' } }));

@@ -168,6 +168,22 @@ function advertisedDecisions(raw: CodexCommandExecutionApprovalParams): Approval
   return decisions;
 }
 
+/**
+ * Which part of a command approval is the command and which is the prose.
+ *
+ * A reader sees `detail` set apart — a code span where the surface has one — so
+ * the command belongs there and Codex's reason for asking belongs in the title.
+ * With no command there is nothing to set apart and the prose carries the card.
+ */
+function commandApprovalContent(payload: CodexCommandExecutionApprovalParams): {
+  title: string;
+  detail?: string;
+} {
+  const where = payload.cwd ? `Run a command in ${payload.cwd}` : 'Run a command';
+  if (!payload.command) return { title: payload.reason ?? where };
+  return { title: payload.reason ?? where, detail: payload.command };
+}
+
 function toCodexInput(
   text: string,
   attachments: ProviderSendTurnInput['attachments']
@@ -674,8 +690,7 @@ export class CodexAdapter implements ProviderAdapter {
       return this.openApproval(state, {
         turnId: payload.turnId,
         requestType: 'command_execution_approval',
-        title: payload.command ?? 'Run a command',
-        detail: payload.reason ?? payload.cwd ?? undefined,
+        ...commandApprovalContent(payload),
         options: approvalOptions(advertisedDecisions(payload)),
         respond: (decision) => ({ decision }),
       });

@@ -102,7 +102,13 @@ export type ProviderRuntimeEvent = EventBase &
         turnId: string;
         requestId: string;
         requestType: RequestType;
+        /** Prose: what is being asked, in a sentence a reader can skim. */
         title: string;
+        /**
+         * The literal thing being approved — a command, a path — and nothing
+         * else. Consumers set it apart from the prose, in a code span where the
+         * surface has one, so a sentence here reads as something to type.
+         */
         detail?: string;
         options: ApprovalOption[];
       }

@@ -1501,24 +1501,15 @@ async def set_runtime_state(
         """Record and broadcast an agent's runtime state in a room.
 
         Persists the latest state (so it is queryable via `!status`) and emits
-        a `com.switch.agent.runtime_state` room event the collaboration bridge
-        picks up to surface the state on the bridged channel. Reported by the
-        Switch Console connector as its managed session transitions.
-
-        `thread_id` (the triggering message's thread, when it was in one) rides
-        the event so the bridge can surface the state in that thread. It is
-        transient routing only — it is never persisted as part of the state.
-
-        `detail` is a short activity line for the running turn (e.g. "Editing
-        foo.py"); like `thread_id` it is transient and rides the event only —
-        the bridge surfaces it in place on the live working message.
-
-        `anchor_event_id` is the latest message the reporting connector has
-        actually handed to the agent's session. The bridge repositions the
-        indicator when it changes, so position follows what the agent has
-        genuinely been given rather than what merely arrived in the room. Also
-        transient routing — reported on every refresh, and only a change moves
-        anything.
+        a `com.switch.agent.runtime_state` room event for protocol clients that
+        watch it. Reported by the Switch Console connector as its managed
+        session transitions.
+
+        What a bridged channel shows of a running turn is the SDK session
+        publication, not this: no collaboration adapter renders the event any
+        more. `thread_id`, `detail` and `anchor_event_id` still ride it as
+        transient routing — never persisted as part of the state — and describe
+        where the turn is happening for a client that wants to draw it.
 
         The `switchdash://` deeplink is rewritten to a gateway HTTP redirect for
         platforms that linkify only http(s) (Discord, Telegram), so the "Open in