mirror of
https://github.com/Kilo-Org/kilocode.git
synced 2026-08-31 01:37:28 +08:00
Matt Van Horn
3a99f36d96
* fix(cli): stop read-only agent bash denies from blocking delegated subagents When a read-only or delegating agent (plan, ask, orchestrator) delegated to a custom subagent via the task tool, the subagent was blocked from running commands its own config explicitly allowed (e.g. `git status`) with errors citing deny rules the user never wrote (`git *`, `*`, shell-operator guards). Those phantom rules are the calling agent's `readOnlyBash` allowlist. Its deny rules exist only to shape that allowlist; `KiloTask.inherited` was extracting them (deny-only) and appending them as subagent ceilings, where last-match-wins resolution made `git * deny` / `* deny` override the subagent's own allows. Drop `bash` from the inherited-ceiling set so the calling agent's own bash policy no longer caps a writable subagent. Edit, notebook, and MCP denials remain hard ceilings, and an explicit session-scoped bash lockdown still reaches the child via `deriveSubagentSessionPermission`, which inherits session denies. Fixes #11523 * fix(cli): keep plan's destructive-command denies as subagent ceilings Removing bash from the inherited ceilings globally made the default Plan->Explore path writable: Plan can delegate to Explore without asking, and the built-in Explore agent declares bash: "allow", so rm -rf and git push both resolved to allow on the merged tree. Re-inherit plan's concrete destructive-command denies (rm -rf *, git push*) as ceilings while leaving the broad allowlist-shaping denies uninherited, so a writable subagent keeps its own bash policy and the read-only boundary holds. * fix: implemented the review fixes Implemented the review fixes. - Built-in Explore now has an enforcement-level read-only bash policy, even if user config sets `bash: allow`. - Plan and orchestrator delegation deny mutations while allowing `git status` and `rg`. - `gh` and raw `find` are denied for delegated Explore. - Custom writable subagents retain their own bash allowlists. - Removed the incomplete Plan-only `rm -rf`/`git push` ceilings. - Added focused regression coverage. ```text --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>