feat(channels): expose IM channel_user_id to sandbox commands as DEERFLOW_CHANNEL_USER_ID

[fancyboi999]

Problem

Skills running for IM-channel users cannot see who is talking to them. The channel workers already write the sender's raw platform id (channel_user_id: Feishu open_id, Slack Uxxx, ...) into the run's body.context, but the Gateway's merge_run_context_overrides whitelist drops it, and nothing exposes it to sandbox commands. Gap 3 of #3914.

Solution

Two halves, following the design converged on in the issue thread:

1. Gateway passthrough — merge_run_context_overrides forwards channel_user_id into the runtime context only, symmetric with the existing user_id handling: setdefault (a server-stamped value wins over the client-supplied one) and never into configurable, which is checkpointed with the thread.
2. Sandbox exposure — bash_tool prepends a shell-quoted export DEERFLOW_CHANNEL_USER_ID=<id>; to the command string.

Why a command prefix and not execute_command(env=...): the env= channel is reserved for request-scoped secrets (#3861/#3871) and has a hard side effect on AioSandbox — any non-empty env switches execution to the bash.exec API, which (a) 404s on sandbox images older than 1.9.3 (the #3921/#3922 capability gap: every IM bash command would have failed on the default image) and (b) abandons the persistent-shell session semantics. An export prefix keeps the legacy shell path byte-identical for non-IM runs, is fine to have visible in audit logs (an identifier, not a secret), and is per-call correct in group chats, where one thread/sandbox is shared by senders with different platform ids.

Also from the pre-PR verification pass:

• Subagent propagation: task_tool captures the dispatching turn's channel_user_id and the subagent executor forwards it into the subagent's runtime context (mirroring the guardrail-attribution fields), so bash commands delegated via task keep the sender identity.
• Length cap: body.context is client-writable on web requests, so values over 256 chars are ignored rather than bloating every command string.
• Windows local sandbox: injection is skipped (os.name == "nt") because the local sandbox may fall back to PowerShell/cmd.exe, where POSIX export is not valid syntax.

Trust note (documented in AGENTS.md): the var is informational, never authorization-grade — any bash command can overwrite it and web clients can set body.context.channel_user_id. Skills must not treat it as authenticated identity.

Validation

Unit tests (12 new in tests/test_channel_user_id_env.py + 1 each in test_task_tool_core_logic.py / test_subagent_executor.py; all failed on main before the implementation):

$ uv run pytest tests/test_channel_user_id_env.py tests/test_task_tool_core_logic.py \
    tests/test_subagent_executor.py tests/test_gateway_services.py \
    tests/test_sandbox_tools_security.py tests/test_skill_request_scoped_secrets.py -q
350+ passed (all affected suites)
$ make lint
All checks passed!

Full backend suite: 5793 passed; the only 7 failures are pre-existing on clean main (verified by reverting the changed files in-place and re-running: identical failures).

Real-channel evidence — the actual bash_tool driven against a real Local sandbox and a real AIO container (image 1.11.0):

== Local + channel_user_id: identity=[ou_feishu_e2e_001]
== Local + no channel ctx  : identity=[]
== AIO   + channel_user_id: identity=[U_SLACK_E2E_002]
== AIO   + sender B (group): identity=[U_SLACK_E2E_003]   # per-call identity, same sandbox
== AIO   + no channel ctx  : identity=[]                  # no leakage across calls

Independent adversarial verification (fresh reviewer agent, pre-PR) — all contract items passed:

• Identity never rides env=: all identity calls hit the sandbox with env=None; combined identity + active-skill-secrets kept secrets in env (masked in output) and identity in the command string.
• Hostile id (x'; touch /tmp/pwned; ' + backticks + $(id) + newline) against the real container: no canary file created, $(id) not executed, value round-tripped verbatim — shlex.quote held.
• channel_user_id never enters configurable; non-IM commands are byte-for-byte unchanged.
• End-to-end chain traced in code: channels/manager.py → runs.stream/wait(context=...) → merge_run_context_overrides → worker._build_runtime_context → runtime.context → bash_tool.

Not verified (fail-loud): real Windows host behavior (unit-simulated only via the _is_windows seam); a true platform-webhook-to-sandbox IM run (each link verified individually — code-traced up to runtime.context, live from there to the sandbox — but no real Feishu/Slack message was driven end to end); provisioner/K8s sandbox flavor (the change is sandbox-agnostic string prepending).

Part of #3914 (gap 3). Gap 1 (autonomous skill-invocation secrets binding) stays open pending maintainer input on the binding-point question; gap 2 was withdrawn by the issue author.

[Copilot]

Pull request overview

This PR adds end-to-end propagation of IM-channel sender identity (channel_user_id) from incoming IM runs into the runtime context and exposes it to sandbox bash commands via DEERFLOW_CHANNEL_USER_ID, including propagation through task delegation to subagents. This fits the DeerFlow harness/gateway boundary by keeping the identifier in runtime-only context (not checkpointed state) while enabling skills/scripts to read the sender identity inside the sandbox.

Changes:

• Gateway: forward body.context.channel_user_id into config["context"] (runtime context only, setdefault semantics; not written to configurable).
• Sandbox: prepend an identity export prefix for DEERFLOW_CHANNEL_USER_ID to bash commands (with quoting + length cap + Windows-local-sandbox skip).
• Subagents: capture channel_user_id in task_tool and propagate it into the subagent’s runtime context; add unit tests covering the propagation chain.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
backend/app/gateway/services.py	Forwards channel_user_id from body.context into runtime context only.
backend/packages/harness/deerflow/sandbox/tools.py	Exposes channel_user_id to bash commands via DEERFLOW_CHANNEL_USER_ID prefix logic.
backend/packages/harness/deerflow/tools/builtins/task_tool.py	Captures and forwards channel_user_id into subagent executor kwargs.
backend/packages/harness/deerflow/subagents/executor.py	Accepts channel_user_id and propagates it into subagent execution context.
backend/tests/test_channel_user_id_env.py	Adds unit tests for gateway passthrough + bash-tool identity exposure behavior.
backend/tests/test_task_tool_core_logic.py	Adds a test ensuring task_tool forwards channel_user_id to the executor.
backend/tests/test_subagent_executor.py	Adds a test ensuring executor propagates channel_user_id into subagent context.
backend/AGENTS.md	Documents the new propagation and exposure behavior and its trust model.