From fcaea778cd23115eca5c151a05a20f7c3885c3d2 Mon Sep 17 00:00:00 2001 From: dj-oyu <68707227+dj-oyu@users.noreply.github.com> Date: Wed, 25 Feb 2026 15:50:27 +0900 Subject: [PATCH] fix(spawn): separate preset validation from agent ID allowlist check Preset names (scout, analyst, etc.) were being sent through the agent ID allowlist checker, causing all preset-based spawns to be rejected with "not allowed to spawn agent". Now presets are validated via IsValidPreset() and only agent_id goes through the allowlist. Co-Authored-By: Claude Opus 4.6 --- pkg/tools/spawn.go | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/pkg/tools/spawn.go b/pkg/tools/spawn.go index fe6f53c35..bbb5ffdf9 100644 --- a/pkg/tools/spawn.go +++ b/pkg/tools/spawn.go @@ -80,17 +80,20 @@ func (t *SpawnTool) Execute(ctx context.Context, args map[string]any) *ToolResul agentID, _ := args["agent_id"].(string) preset, _ := args["preset"].(string) - // Check allowlist if targeting a specific agent or preset - checkTarget := agentID - if checkTarget == "" && preset != "" { - checkTarget = preset - } - if checkTarget != "" && t.allowlistCheck != nil { - if !t.allowlistCheck(checkTarget) { - return ErrorResult(fmt.Sprintf("preset %q is not allowed. Available presets: scout, analyst, coder, worker, coordinator", preset)) + // Check allowlist if targeting a specific agent ID. + // Presets (scout, analyst, etc.) are NOT agent IDs — they are validated + // separately by IsValidPreset() in the subagent manager. + if agentID != "" && t.allowlistCheck != nil { + if !t.allowlistCheck(agentID) { + return ErrorResult(fmt.Sprintf("agent %q is not in the allowed agents list", agentID)) } } + // Validate preset name if provided + if preset != "" && !IsValidPreset(Preset(preset)) { + return ErrorResult(fmt.Sprintf("preset %q is not valid. Available presets: scout, analyst, coder, worker, coordinator", preset)) + } + if t.manager == nil { return ErrorResult("spawn tool is not available in this session (orchestration may be disabled)") }