opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(spawn): separate preset validation from agent ID allowlist check

Browse source 
Preset names (scout, analyst, etc.) were being sent through the agent ID
allowlist checker, causing all preset-based spawns to be rejected with
"not allowed to spawn agent". Now presets are validated via IsValidPreset()
and only agent_id goes through the allowlist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
dj-oyu 2026-02-25 15:50:27 +09:00
parent e92ff7d3e6
commit fcaea778cd
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
pkg/tools/spawn.go
View file

@ -80,17 +80,20 @@ func (t *SpawnTool) Execute(ctx context.Context, args map[string]any) *ToolResul
agentID, _ := args["agent_id"].(string) agentID, _ := args["agent_id"].(string)
preset, _ := args["preset"].(string) preset, _ := args["preset"].(string)
// Check allowlist if targeting a specific agent or preset // Check allowlist if targeting a specific agent ID.
checkTarget := agentID // Presets (scout, analyst, etc.) are NOT agent IDs — they are validated
if checkTarget == "" && preset != "" { // separately by IsValidPreset() in the subagent manager.
checkTarget = preset if agentID != "" && t.allowlistCheck != nil {
} if !t.allowlistCheck(agentID) {
if checkTarget != "" && t.allowlistCheck != nil { return ErrorResult(fmt.Sprintf("agent %q is not in the allowed agents list", agentID))
if !t.allowlistCheck(checkTarget) {
return ErrorResult(fmt.Sprintf("preset %q is not allowed. Available presets: scout, analyst, coder, worker, coordinator", preset))
} }
} }
// Validate preset name if provided
if preset != "" && !IsValidPreset(Preset(preset)) {
return ErrorResult(fmt.Sprintf("preset %q is not valid. Available presets: scout, analyst, coder, worker, coordinator", preset))
}
if t.manager == nil { if t.manager == nil {
return ErrorResult("spawn tool is not available in this session (orchestration may be disabled)") return ErrorResult("spawn tool is not available in this session (orchestration may be disabled)")
} }