fix(subagents): enforce explicit spawn allowlists

This commit is contained in:
Peter Steinberger
2026-04-27 14:53:10 +01:00
parent 58a4ca4423
commit 2e99c1d227
11 changed files with 327 additions and 71 deletions

View File

@@ -244,7 +244,7 @@ See [Configuration reference](/gateway/configuration-reference) and
### Allowlist
<ParamField path="agents.list[].subagents.allowAgents" type="string[]">
List of agent ids that can be targeted via `agentId` (`["*"]` allows any). Default: only the requester agent.
List of agent ids that can be targeted via explicit `agentId` (`["*"]` allows any). Default: only the requester agent. If you set a list and still want the requester to spawn itself with `agentId`, include the requester id in the list.
</ParamField>
<ParamField path="agents.defaults.subagents.allowAgents" type="string[]">
Default target-agent allowlist used when the requester agent does not set its own `subagents.allowAgents`.