Gate enforces delegation depth 1 for native subagents - #7
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2450580032
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # a worktree lock from there is denied outright — no confirmation prefix reopens it, so this | ||
| # check sits before the confirmation bypass below. | ||
| AGENT=$(printf '%s' "$INPUT" | jq -r '.agent_type // empty' 2>/dev/null || true) | ||
| if [ -n "$AGENT" ] && printf '%s' "$CMD" | grep -Eq '(^|[;&|(`[:space:]/])(agent-run[[:space:]]+(run|resume)|agent-wt[[:space:]]+lock)([[:space:]]|$)'; then |
There was a problem hiding this comment.
When a native subagent quotes the executable, such as "agent-run" run ... or "/home/me/bin/agent-wt" lock task, Bash still executes the worker command but this pattern permits it because it requires whitespace immediately after the unquoted agent-run/agent-wt literal. This provides a straightforward, normal shell invocation that bypasses the newly claimed depth-one guarantee; extend the matcher to handle quoted executable names and add regression cases for both commands.
Useful? React with 👍 / 👎.
Все dk-роли имеют Bash, а DELEGATE_KIT_DEPTH получают только дети agent-run: нативный implementer мог сам вызвать `agent-run run` и завести воркера второго уровня. Хуки из settings.json срабатывают внутри субагентов и несут agent_type во входе — gate.sh отклоняет `agent-run run|resume` и `agent-wt lock`, когда это поле есть; префикс подтверждения этого не открывает. Под Codex-родителем нативные роли держат правило инструкцией, сказано в external.md. tests/gate.sh — 24 проверки, включая существующие паттерны gate, которые до сих пор были без тестов; шаг в CI. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
7037109 to
27d518c
Compare
…глубины По ревью PR #7 (Codex P1): "agent-run" run и '/path/agent-wt' lock проходили мимо шаблона, требовавшего пробел сразу за словом. Три регрессионные проверки. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2450580 to
345beb6
Compare
1 participant
Stacked on #6.
Problem
Every
dk-*role has Bash, andDELEGATE_KIT_DEPTHis set only for children ofagent-run. A native implementer could runagent-run runitself and start a second-level worker;external.mdstated "delegation depth is 1" without that caveat.Change
hooks/gate.sh: when the hook input carriesagent_type(Claude Code setsagent_id/agent_typeon tool events fired inside a subagent, and settings hooks do fire there),agent-run run|resumeandagent-wt lockare denied outright, before the confirmation-prefix bypass.status,list,wait,agent-wt diffand ordinary commands pass.external.md,hosts.md: what the gate enforces for a native role, and that under a Codex parent the native roles hold the line by instruction only.tests/gate.sh: 24 checks — the depth rule plus the existing dangerous-command patterns, which had no tests. CI step added.Checks
gate.sh24/24,route.sh48/48,caps.sh43/43,delivery.sh25/25,shellcheck -S warning.🤖 Generated with Claude Code