How We Taught a Slack Bot to Run Code (Safely-ish)

Gorkie was built by Devarsh. I led the sandbox and runtime work; Devarsh helped throughout with testing and feedback.

Intro

Gorkie started as a Slack assistant: answer questions, summarize threads, help with tasks. That worked until users started asking it to do things: run scripts, convert files, poke at repos. Text responses stopped being enough. The bot needed to actually execute.

That meant sandboxes. This post covers how we got there.

Through every iteration, three things stayed constant:

• Syncing attachments into the sandbox
• Showing tool status so users see progress, not just "thinking..."
• Streaming updates back to Slack instead of one giant final blob

We also use Slack's AI implementation for the chat surface and interaction model, which lets us render interactive UI directly via Block Kit.

Sandbox Providers

const live = await reconnect(ctxId);
if (live) {
  return live;
}

const restored = await restoreFromSnapshot(ctxId);
const instance =
  restored ??
  (await Sandbox.create({
    runtime: config.runtime,
    timeout: config.timeoutMs,
  }));

await redis.set(redisKeys.sandbox(ctxId), instance.sandboxId);
await redis.expire(redisKeys.sandbox(ctxId), config.sandboxTtlSeconds);

const snap = await instance.snapshot().catch((error: unknown) => {
  logger.warn({ sandboxId, error, ctxId }, 'Snapshot failed');
  return null;
});

if (snap) {
  await redis.set(redisKeys.snapshot(ctxId), snap.snapshotId);
  await redis.expire(redisKeys.snapshot(ctxId), config.snapshotTtlSeconds);
}

export const sandboxSessions = pgTable('sandbox_sessions', {
  threadId: text('thread_id').primaryKey(),
  sandboxId: text('sandbox_id').notNull(),
  status: text('status').notNull().default('creating'),
  pausedAt: timestamp('paused_at', { withTimezone: true }),
  resumedAt: timestamp('resumed_at', { withTimezone: true }),
  destroyedAt: timestamp('destroyed_at', { withTimezone: true }),
});

const sandbox = await daytona.create({
  autoStopInterval: config.timeouts.stopMinutes,
  autoArchiveInterval: config.timeouts.archiveMinutes,
  autoDeleteInterval: config.timeouts.deleteMinutes,
  snapshot: SANDBOX_SNAPSHOT,
});

await upsert({
  threadId,
  sandboxId: sandbox.id,
  sessionId: session.id,
  status: 'active',
});

With the sandbox stable, the next question was what should run inside it.

The Orchestration Trap

We tried Sandbox Agent by Rivet with OpenCode behind it. Sandbox Agent runs inside the sandbox, exposes an HTTP interface, and communicates over ACP. We had to boot, health-check, and restart it when needed.

It offloaded orchestration, but added too many failure points: an HTTP server inside the sandbox, more moving parts. OpenCode was also over-engineered for our use case and used more tokens than we wanted.

We next tried Pi with Sandbox Agent. Pi gave us skills, MCPs, and easy extensibility, but the core shape was still an HTTP server inside the sandbox. Crashes still happened. We wanted boring infrastructure.

Pi over RPC

The cleanest setup turned out to be Pi in RPC mode: no daemon, no internal HTTP listener, just a process. Gorkie attaches to the thread's Daytona sandbox, starts Pi in RPC mode inside a PTY, and sends it a prompt. Pi runs commands and edits files; events stream back as newline-delimited JSON and get forwarded to Slack as they arrive.

const piCmd = sessionId
  ? `pi --mode rpc --session ${sessionId}`
  : 'pi --mode rpc';

await pty.sendInput(`stty -echo; exec ${piCmd}\n`);
await client.waitUntilReady();

One less server, one less failure point.

Pi also made tool integration cleaner. Before, with Sandbox Agent and OpenCode, we had to define a custom MCP server, run it in the sandbox, connect it to the coding agent, intercept the tool call, and route it. With Pi, we register handlers directly:

pi.registerTool({
  name: 'showFile',
  label: 'showFile',
  description:
    'Signal the host to upload a sandbox file to Slack once it is ready.',
  parameters: showFileParams,
  execute: (_toolCallId, params) => {
    const { path, title } = params as Static<typeof showFileParams>;
    if (!nodePath.isAbsolute(path)) {
      throw new Error('showFile.path must be absolute');
    }
    return Promise.resolve({
      content: [{ type: 'text' as const, text: `Queued upload for ${path}` }],
      details: { path, title: title ?? null },
    });
  },
});

Current Architecture

Demo

Vercel recently launched a Chat SDK that supports multiple runtimes. We might rewrite Gorkie on top of it.

Code