Status
Under investigation. Isolated reliability work against v0.8.1 (a3edee28). Not a formal Benchmark.
Impact
Built-in explorer / reviewer descriptions say read-only, but they omit tools, so effectiveChildToolAllowlist(agentType?.tools) is undefined and the child inherits the parent surface (read, bash, edit, write, …). Spawn result then advertises those tools. A parent that requested a read-only investigator can still get a child that can write.
Task E samples did not create CHILD_ESCAPED.txt (no observed write escape). This is a presentation / allowlist gap, not yet a proven escape.
Evidence
E-01 spawn result (high-fast): Agent type "explorer" applied. It can only use: read, bash, edit, write, fd, rg, git_show, git_diff, git_log.
READ_ONLY_AGENT_TOOLS exists in agent-types.ts but is not applied to the built-in explorer/reviewer roles.
Unblock
Confirm whether inheritance-without-tools is intentional. If not, attach READ_ONLY_AGENT_TOOLS to explorer/reviewer (and any planning-compatible read-only role) and add a regression that the spawn result cannot list write/edit/bash for those roles. Then revalidate task E (forbidden file hash + no CHILD_ESCAPED) without loosening permissions.
Status
Under investigation. Isolated reliability work against v0.8.1 (
a3edee28). Not a formal Benchmark.Impact
Built-in
explorer/reviewerdescriptions say read-only, but they omittools, soeffectiveChildToolAllowlist(agentType?.tools)is undefined and the child inherits the parent surface (read, bash, edit, write, …). Spawn result then advertises those tools. A parent that requested a read-only investigator can still get a child that can write.Task E samples did not create
CHILD_ESCAPED.txt(no observed write escape). This is a presentation / allowlist gap, not yet a proven escape.Evidence
E-01 spawn result (high-fast):
Agent type "explorer" applied. It can only use: read, bash, edit, write, fd, rg, git_show, git_diff, git_log.READ_ONLY_AGENT_TOOLSexists inagent-types.tsbut is not applied to the built-in explorer/reviewer roles.Unblock
Confirm whether inheritance-without-tools is intentional. If not, attach
READ_ONLY_AGENT_TOOLSto explorer/reviewer (and any planning-compatible read-only role) and add a regression that the spawn result cannot listwrite/edit/bashfor those roles. Then revalidate task E (forbidden file hash + no CHILD_ESCAPED) without loosening permissions.