fix(helm): fail-fast on empty allowedChannels at deploy time

- configmap.yaml: fail template render if allowedChannels is empty (both adapters)
- values.yaml: update Slack comment to reflect deny-all default
- tests: add validation tests + fix existing Slack tests for new check

Author: chaodu-agent

charts/openab/templates/configmap.yaml

@@ -11,6 +11,9 @@ metadata:
 data:
   config.toml: |
     {{- if ($cfg.discord).enabled }}
+    {{- if not $cfg.discord.allowedChannels }}
+    {{- fail (printf "agents.%s.discord.allowedChannels is required — empty means the bot will not respond to any messages. Add at least one channel ID." $name) }}
+    {{- end }}
     [discord]
     bot_token = "${DISCORD_BOT_TOKEN}"
     {{- range $cfg.discord.allowedChannels }}
@@ -52,6 +55,9 @@ data:
     {{- end }}
 
     {{- if and ($cfg.slack).enabled }}
+    {{- if not (($cfg.slack).allowedChannels) }}
+    {{- fail (printf "agents.%s.slack.allowedChannels is required — empty means the bot will not respond to any messages. Add at least one channel ID." $name) }}
+    {{- end }}
     [slack]
     bot_token = "${SLACK_BOT_TOKEN}"
     app_token = "${SLACK_APP_TOKEN}"

charts/openab/tests/adapter-enablement_test.yaml

@@ -33,6 +33,8 @@ tests:
   - it: renders [slack] when enabled=true
     set:
       agents.kiro.slack.enabled: true
+      agents.kiro.slack.allowedChannels:
+        - "C0123456789"
     asserts:
       - matchRegex:
           path: data["config.toml"]
@@ -49,6 +51,8 @@ tests:
   - it: renders [slack] with placeholder tokens when enabled=true
     set:
       agents.kiro.slack.enabled: true
+      agents.kiro.slack.allowedChannels:
+        - "C0123456789"
     asserts:
       - matchRegex:
           path: data["config.toml"]
@@ -61,6 +65,8 @@ tests:
     set:
       agents.kiro.discord.enabled: true
       agents.kiro.slack.enabled: true
+      agents.kiro.slack.allowedChannels:
+        - "C0123456789"
     asserts:
       - matchRegex:
           path: data["config.toml"]

charts/openab/tests/configmap_test.yaml

@@ -92,8 +92,27 @@ tests:
   - it: renders slack allow_user_messages = "multibot-mentions"
     set:
       agents.kiro.slack.enabled: true
+      agents.kiro.slack.allowedChannels:
+        - "C0123456789"
       agents.kiro.slack.allowUserMessages: multibot-mentions
     asserts:
       - matchRegex:
           path: data["config.toml"]
           pattern: 'allow_user_messages = "multibot-mentions"'
+
+  - it: rejects empty discord allowedChannels
+    set:
+      agents.kiro.discord.enabled: true
+      agents.kiro.discord.allowedChannels: []
+    asserts:
+      - failedTemplate:
+          errorPattern: "discord.allowedChannels is required"
+
+  - it: rejects empty slack allowedChannels
+    set:
+      agents.kiro.discord.enabled: false
+      agents.kiro.slack.enabled: true
+      agents.kiro.slack.allowedChannels: []
+    asserts:
+      - failedTemplate:
+          errorPattern: "slack.allowedChannels is required"

charts/openab/values.yaml

@@ -135,7 +135,7 @@ agents:
       enabled: false
       botToken: ""       # Bot User OAuth Token (xoxb-...)
       appToken: ""       # App-Level Token (xapp-...) for Socket Mode
-      allowedChannels: []  # empty = allow all channels
+      allowedChannels: []  # required — empty = deny all channels (secure by default)
       allowedUsers: []     # empty = allow all users
       # allowBotMessages: "off" (default) | "mentions" | "all"
       allowBotMessages: "off"