Pacenote

News › Release

Releasev0.1.0 · Oct 9, 2026

Pacenote v0.1.0

The first release of Verda: a Slack bot that answers public channel mentions with your local claude or codex CLI, running each answer in a disposable Docker sandbox, and a macOS desktop app that runs the bot and shows its status, logs and run history.

Install

brew tap ashon/tap brew install --cask verda

macOS 12 or later, Apple silicon or Intel. The app is signed with a Developer ID and notarized, and it carries the bot, so nothing else from this repository is needed.

Before the first mention:

  • Docker (Docker Desktop, OrbStack or colima) for the reasoner sandbox
  • a logged-in claude or codex CLI
  • a Slack app made from slack-app-manifest.yaml (Socket Mode, no public endpoint)
  • in Verda: enter the Slack tokens in Settings, then run "Build sandbox images" and "Restart proxy" in the Sandbox tab

Config, run history and the egress allowlist live in ~/.verda and survive upgrades and uninstall. Running from source (pnpm desktop, pnpm dev) is described in the README.

What it does

  • Answers mentions in public channels with the thread as context, from allowed users only, with a concurrency limit and a queue; requests in flight resume once after a restart.
  • Reads attachments: images, text files and Slack snippets, and PDF text extracted in a network-less container.
  • Renders mermaid, graphviz, vega-lite and svg blocks to PNG in a network-less container, and posts images generated by codex.
  • Runs every answer in a fresh container: read-only root, no capabilities, an internal network whose only way out is an allowlist proxy, and only the credentials the CLI needs.
  • Optional ops tools through the ops-broker (MCP), which alone holds the credentials: SSH host checks, read-only k8s lookups, reading a work directory, code changes as draft PRs on verda/* branches, GitHub lookups, and Jira search, issues and comments in allowed projects.
  • The desktop app supervises the bot, edits ~/.verda/.env with the same validation the bot uses, checks and applies sandbox changes, and browses runs step by step: tool calls, answers, outputs.

Security notes

  • Ops tool searches can no longer be steered into secret files with a glob, and their results are filtered with the same deny rules as file reads.
  • Jira JQL cannot break out of the allowed project scope.
  • Mentions, @channel and other Slack control sequences in a model's answer are posted as text.
  • Tools run by the broker get only PATH and HOME, not its tokens.