Skip to content

docs + feat: sub-agent tool scoping plan and Phase 1 implementation (#4042)#4096

Closed
JayBeest wants to merge 2 commits into
Hmbown:mainfrom
JayBeest:wip/sub-agent-tool-restrictions
Closed

docs + feat: sub-agent tool scoping plan and Phase 1 implementation (#4042)#4096
JayBeest wants to merge 2 commits into
Hmbown:mainfrom
JayBeest:wip/sub-agent-tool-restrictions

Conversation

@JayBeest

@JayBeest JayBeest commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Adds three documentation files and implements Phase 1 of the sub-agent tool
scoping plan for issue #4042:

  1. SUBAGENT_TOOL_SCOPING_PANL.md — Phased implementation plan with evidence
  2. SUBAGENT_TOOL_SCOPING_CODEBASE_GUIDE.md — Onboarding guide for developers
  3. SUBAGENT_TOOL_SCOPING_PHASE1_STATE.md — Implementation state and test coverage summary

Phase 1 Implementation

Implements parent --disallowed-tools inheritance into sub‑agents:

  • SpawnRequest + disallowed_tools / inherit_disallowed_tools
  • WorkerRuntimeProfile + denied_tools with derive_child() union
  • SubAgentToolRegistry deny filtering in is_tool_allowed(), tools_for_model(), execute()
  • Wildcard matching: exact, prefix *, case‑insensitive

23 new tests – inheritance, wildcards, opt‑out, catalog filtering, execution gates.

All tests pass. Lint passes. CI should be green.

This is Phase 1 of the three‑phase plan. Later phases will build on this foundation.

Scope

  • In this PR: Documentation (PANL + Guide + State) + Phase 1 implementation
  • Not in this PR: Phase 2 (per-sub-agent tool scoping), Phase 3 (MCP server assignment)

Builds on

Related Issues

Validation

  • 23 new tests passing
  • cargo fmt and cargo clippy clean
  • Existing test suite: 321/322 pass (1 pre‑existing macOS issue)

⚠️ Manual testing note: I have not yet dogfooded this in a live CodeWhale session with real models. The test coverage is thorough, but a manual verification pass would be valuable before merging.

Feedback Welcome

I'm learning the workflow and the codebase—happy to adjust based on maintainer feedback.
This is the first of three phases; later phases will build on this foundation.

All Fine. 🐋

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown

Thanks @JayBeest for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

@JayBeest

JayBeest commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Quick note on dependencies:

Plan: Phase 1 → watch #3969 → Phase 2 → watch MCP → Phase 3 → 🐋.

@Hmbown Hmbown mentioned this pull request Jul 8, 2026
Closed
83 tasks
jcorneli added 2 commits July 8, 2026 15:39
docs: add sub-agent tool scoping review + implementation PANL
9024d66
feat: inherit parent disallowed_tools in sub-agents (Hmbown#4042)
95872b9 
Implements Phase 1 of the sub-agent tool scoping plan:
- SpawnRequest gains disallowed_tools and inherit_disallowed_tools fields
- parse_spawn_request reads them from JSON
- SubAgentRuntime carries denied_tools via WorkerRuntimeProfile
- SubAgentToolRegistry filters deny list in is_tool_allowed(), tools_for_model(), execute()
- 23 new tests covering inheritance, wildcards, opt‑out, and execution gates

Closes Hmbown#4042 (environment‑level tool sandboxing) – Phase 1 only.
@JayBeest JayBeest force-pushed the wip/sub-agent-tool-restrictions branch from ec2b44d to 95872b9 Compare July 8, 2026 13:48
@JayBeest JayBeest changed the title docs: add sub-agent tool scoping review + implementation PANL docs + feat: sub-agent tool scoping plan and Phase 1 implementation (#4042) Jul 8, 2026
@JayBeest JayBeest mentioned this pull request Jul 8, 2026
Open
@Hmbown

Hmbown commented Jul 8, 2026

Copy link
Copy Markdown
Owner

v0.8.68 triage note

Thanks @JayBeest for the Phase 1 write-up and implementation work here. This is still draft and DIRTY against current main, so it is not mergeable as-is for the v0.8.68 closeout.

The useful slice is the Phase 1 idea: parent --disallowed-tools inheritance into sub-agents and model-visible catalog filtering. Before landing, it needs to be rebased onto current main and reconciled with the active Fleet/AgentProfile lane:

Not merging this branch whole. Next step is either a narrow fresh PR for Phase 1 only against current main, or harvest the tests/logic after the Fleet profile surface settles. The large design docs and Phase 2/3 MCP assignment material should stay separate from the runtime enforcement patch.

@Hmbown Hmbown mentioned this pull request Jul 9, 2026
Merged
Hmbown added a commit that referenced this pull request Jul 9, 2026
@Hmbown @JayBeest
feat(tools): sub-agent tool restriction inheritance (#4042)
f1d13a4 
Implement parent --disallowed-tools inheritance into sub-agents:

- SpawnRequest carries disallowed_tools + inherit_disallowed_tools (default true)
- WorkerRuntimeProfile gains denied_tools with derive_child() union semantics
- SubAgentToolRegistry applies deny filtering in is_tool_allowed(),
  tools_for_model(), and execute() — restricted tools never reach the model
- Wildcard matching: exact, prefix *, case-insensitive
- Fleet worker_runtime threads disallowed_tools into WorkerRuntimeProfile

22 new tests: inheritance flows down, opt-out works, two-generation
inheritance, wildcards, case-insensitive, deny-wins-over-allow, catalog
filtering, execution gates, background runtime propagation.

Harvested from PR #4096 by @JayBeest (rebased onto current main; the
original PR was dirty against main after #4262 landed).

Refs #4042

Signed-off-by: Hunter B <hmbown@gmail.com>
Co-authored-by: JayBeest <67948678+JayBeest@users.noreply.github.com>
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

Thanks @JayBeest — your contribution landed in f1d13a4102dc on main:

feat(tools): sub-agent tool restriction inheritance (#4042)

Closing this PR now that the code is on main. Credit lives in the commit message and (where applicable) the CHANGELOG.md entry for the next release. Apologies for not closing this at the time of the merge — the auto-close workflow is new in v0.8.31.

If you want to land more work and would prefer your future PRs merge cleanly without a harvest step, the CONTRIBUTING.md doc has a short note on what makes a contribution mergeable as-is.

@github-actions github-actions Bot closed this Jul 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Hmbown Hmbown Awaiting requested review from Hmbown Hmbown will be requested when the pull request is marked ready for review Hmbown is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat: Environment-level tool sandboxing for sub-agents (enforce tool_restrictions)

2 participants

@JayBeest @Hmbown