Spores

Coming Soon GitHub

Overview

Spores is a Slack-native AI teammate that turns an @mention into a GitHub-aware agent.

Technologies

Go 1.26
openai-go v3 (chat completions + tool calling)
slack-go (Socket Mode, app-mention events, conversation history)
go-e2b (ephemeral sandboxes for the delegated coding agent)
OpenAI Codex CLI (runs inside the sandbox to actually write code)
GitHub REST API (read-only repository tools)
Docker (deployment)

Features

Slack Socket Mode bot that resolves display names and pulls the last 20 messages of history for context
Two-tier tool system: a family of read-only GitHub tools plus one single write-capable tool for handing work to the coder
One delegation per request, forcing the agent to evaluate the result instead of retrying in a loop
Self-verification: after the sandbox agent returns, Spores rechecks the outcome itself using only read-only tools
Sandboxed execution: every delegated task gets a fresh E2B sandbox with scoped credentials and a hard timeout, destroyed afterward regardless of outcome
CLI fallback: setting a PROMPT environment variable runs one request through the same agent from a terminal, no Slack involved

Development and Challenges

The interesting design problem here wasn’t the Slack plumbing, it was blast radius and cost.

A chat bot with GitHub write access is one bad tool call away from a mess. The fix is structural rather than a prompt instruction: the only tool that can change anything is a hard handoff to a completely different process, running in a sandbox with its own scoped, disposable GitHub token that is gone within minutes.

Flowchart of the Spores architecture: Slack mention, agent decision between read-only GitHub tools and delegate_to_coder, E2B sandbox running Codex CLI via OpenAI Gateway, PR creation, sandbox teardown, and self-verification before replying in Slack. — Spores architecture: a Slack mention branches into read-only GitHub tools or a delegate_to_coder call into an E2B sandbox running Codex CLI via OpenAI Gateway, which opens the PR before the sandbox is destroyed and Spores self-verifies.

Cost

Codex CLI needs OpenAI credentials to run, and the obvious way to give it those is an API key billed per token. Doing that for every delegated task, across every sandbox, adds up fast, especially once a task needs several steps to finish. Rather than pay per-token API rates for agentic coding work, the sandbox is set up with a Codex CLI login credential instead: the file Codex writes to disk when you log in with a ChatGPT subscription. Point the sandbox at that, and the delegated coding runs bill against the subscription instead of API usage.

The catch: a raw login credential is meant for one interactive session on one machine, and its access token needs refreshing periodically. It is not something you can hand to a fleet of disposable sandboxes and expect to keep working. Turning that subscription credential into a stable, OpenAI-compatible endpoint that any sandbox can just point at is a separate problem on its own, and it is exactly what OpenAI Gateway was built to solve. Spores is, in fact, the reason it exists.

Screenshot of a Slack thread where the spore-space workspace's Spores bot is asked to add OpenCode Go subscription billing and a model/gateway dashboard to the OpenAI Gateway repo, and responds by asking for the exact repository before delegating the work. — Spores in Slack: asked to add OpenCode Go subscription support and a models/gateways dashboard to OpenAI Gateway, it asks for the missing repo details before delegating the task to the coder.

Conclusion

Spores is less a chatbot with GitHub tools and more a small pattern: keep a fast, restricted thinking agent in front of the user, and push anything that can actually change state into a separate, disposable, credential-scoped doing agent that gets checked afterward instead of trusted blindly. The cost problem it ran into on day one turned into its own project, OpenAI Gateway, which now makes the same subscription-based inference available to anything else that speaks the OpenAI API.