From 6b1c6678ce7f85498cbbbeb62faeca5648323303 Mon Sep 17 00:00:00 2001
From: Simon KP <simon@techops.services>
Date: Mon, 26 Jan 2026 23:33:48 +1100
Subject: [PATCH] feat(deploy): add restricted checkin-bot agent for DMs

- Add checkin-bot agent as default with tools.deny: ["*"]
- Add binding to route admin DM to main agent with full access
- Change dm.policy to "open" so anyone can DM
- Regular users get checkin-bot (no tools), admin gets main agent
---
 deploy/prod/clawdbot.json | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/deploy/prod/clawdbot.json b/deploy/prod/clawdbot.json
index 50f957b90..fb27f7b45 100644
--- a/deploy/prod/clawdbot.json
+++ b/deploy/prod/clawdbot.json
@@ -4,6 +4,17 @@
   },
   "agents": {
     "list": [
+      {
+        "id": "checkin-bot",
+        "default": true,
+        "identity": {
+          "name": "tobais",
+          "emoji": "🤖"
+        },
+        "tools": {
+          "deny": ["*"]
+        }
+      },
       {
         "id": "main",
         "identity": {
@@ -21,14 +32,26 @@
       "maxConcurrent": 2
     }
   },
+  "bindings": [
+    {
+      "agentId": "main",
+      "match": {
+        "channel": "discord",
+        "peer": {
+          "kind": "dm",
+          "id": "213199879525105664"
+        }
+      }
+    }
+  ],
   "channels": {
     "discord": {
       "enabled": true,
       "groupPolicy": "allowlist",
       "dm": {
         "enabled": true,
-        "policy": "allowlist",
-        "allowFrom": ["213199879525105664"]
+        "policy": "open",
+        "allowFrom": ["*"]
       },
       "guilds": {
         "884603707658997780": {