scope

Run the scope wizard for an interactive setup, or use the enable subcommand with the channel and mode, such as enabling whatsapp in shadow or enforce mode. Scope writes go through Bash because the config tool refuses scope keys, so you approve each change via a permission prompt.

Shadow mode collects statistics on what would be filtered without actually blocking anything, which is recommended for the first week. Enforce mode actively filters denied chunks so non-owner queries cannot see restricted channel content.

Owner unlock requires two factors: the identity setting in config plus an out-of-band per-workspace trust file created via Bash. Config alone never unlocks, which prevents a prompt-injected agent from declaring itself owner by writing config.

No. Scope filtering applies only at the MCP tool level for memory and messaging tools. Native Read, Grep, and direct SQLite access bypass scope by design; hard isolation requires OS-level filesystem permissions.

Use the test subcommand with a chat ID to run a dry-run probe against the scope adapter. It reports whether the chat would be visible under the current mode without changing any config or memory state.

The execGate blocks destructive tools like Bash, Write, Edit, and agent_config when a turn was triggered by a non-owner inbound message. It supports denylist or allowlist policies, and a separate per-workspace exec trust file can unlock it.