fix(security): enforce sandbox inheritance for sessions_spawn

2026-03-02 01:10:39 +00:00
parent 6a1eedf10b
commit b9aa2d436b
6 changed files with 57 additions and 0 deletions
--- a/docs/tools/subagents.md
+++ b/docs/tools/subagents.md
@@ -124,6 +124,7 @@ See [Configuration Reference](/gateway/configuration-reference) and [Slash comma
 Allowlist:

 - `agents.list[].subagents.allowAgents`: list of agent ids that can be targeted via `agentId` (`["*"]` to allow any). Default: only the requester agent.
+- Sandbox inheritance guard: if the requester session is sandboxed, `sessions_spawn` rejects targets that would run unsandboxed.

 Discovery: