feat(subagents): propagate approval mode to sub-agents#3066
Open
tanzhenxin wants to merge 2 commits intomainfrom
Open
feat(subagents): propagate approval mode to sub-agents#3066tanzhenxin wants to merge 2 commits intomainfrom
tanzhenxin wants to merge 2 commits intomainfrom
Conversation
Replace hardcoded PermissionMode.Default with resolution logic: - Permissive parent modes (yolo, auto-edit) always win - Plan-mode parents keep sub-agents in plan mode - Agent definitions can declare approvalMode in frontmatter - Default fallback is auto-edit in trusted folders - Untrusted folders block privileged mode escalation Also maps Claude permission aliases (acceptEdits, bypassPermissions, dontAsk) to qwen-code approval modes in the converter.
Collaborator
Author
E2E Test ReportBinary:
All 8 tests PASS. Full test plan: |
Contributor
📋 Review SummaryThis PR implements approval mode propagation for sub-agents, replacing the previous hardcoded 🔍 General Feedback
🎯 Specific Feedback🟡 High
🟢 Medium
🔵 Low
✅ Highlights
|
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
…ion tests Map Claude's `dontAsk` to `default` instead of `auto-edit` — `dontAsk` denies prompts (restrictive) so `default` is a closer semantic match. Add 9 unit tests covering the full `resolveSubagentApprovalMode` decision matrix: permissive parent override, agent-declared modes, trusted/untrusted folder blocking, and plan-mode fallback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Sub-agents now run with the correct approval mode instead of always using "default." The mode is resolved automatically based on the parent session and the agent definition, with safety guardrails for plan mode and untrusted folders.
Screenshots / Video Demo
N/A — no user-facing UI change. This adds a new optional field to agent frontmatter and changes how sub-agent permission modes are resolved:
Dive Deeper
Previously: Every sub-agent was hardcoded to
PermissionMode.Defaultregardless of the parent session's approval mode. Hooks and external tooling couldn't tell what mode a sub-agent was actually operating in.Now: The approval mode follows clear rules:
approvalMode→ respected when parent isn't in a permissive mode; trusted-folder check applies for privileged modesThe resolved mode is both passed to hook events (SubagentStart/SubagentStop) and applied to the subagent's runtime config via prototype delegation.
Claude converter: Maps Claude permission aliases (
acceptEdits→auto-edit,bypassPermissions→yolo,dontAsk→auto-edit) so imported extensions work correctly.Reviewer Test Plan
approvalMode: planloads and runs in plan modeapprovalMode: invalid_modeis rejected at load timeFull E2E test plan:
./e2e-tests/pr2-permission-mode-propagation.mdTesting Matrix
Linked issues / bugs
Follow-up to #3064 (disallowedTools). Together they address sub-agent MCP tool access and permission scoping.