[senamakel]

Summary

Fixes a fail-OPEN sub-agent tool allowlist (prompt-injection privilege escalation). Source issue: tinyhumansai#4452.

The registration predicate in src/openhuman/tinyagents/mod.rs was allowed.is_empty() || allowed.contains(name) — an empty allowlist registered every tool across tool_sets (which includes the parent's shell, file-write, and spawn/delegate tools). A deliberately tool-less sub-agent (tools = [] archetype, a zero-match skill_filter, or a named list of unresolvable names) therefore silently inherited the parent's full surface.

Fix

• Plumb the allowlist as Option<HashSet<String>> end-to-end (subagent_runner/ops/runner.rs → run_subagent_via_graph / AgentTurnRequest → assemble_turn_harness → run_turn_via_tinyagents_shared), so registration distinguishes:
  • None → no filter supplied, register every candidate (parent/channel/chat turns);
  • Some(set) → register only names in set;
  • Some({}) → register nothing (deny-all).
• Sub-agents always resolve to Some(set). ToolScope::Named([]) and zero-match skill_filter produce Some(empty) = deny-all (v0.58.7 parity). Parent channel/chat turns map an empty visibility set to None (all tools), preserving current behavior there.
• Defense in depth: strip spawn/delegate names (is_subagent_spawn_tool + spawn_worker_thread) at registration regardless of the allowlist, so the "sub-agents must never spawn" invariant holds even under a widened/None allowlist.
• Warn-log ([subagent] tool allowlist resolved empty …) when the resolved allowlist is empty.
• The shadow tool-exposure middleware mirrors the same None/Some(set)/Some(empty) semantics.

Acceptance criteria

• tools = [] / zero-match filters register zero tools; the sub-agent still completes text-only turns.
• No sub-agent configuration can implicitly inherit the parent's full tool surface.
• Spawn/delegate tools are never registered to a sub-agent regardless of allowlist content.
• Unit tests over the registration gate for None, Some(empty), Some({named}), named-but-unresolvable, plus spawn-always-stripped; e2e that a Some(empty) sub-agent over a shell-bearing surface has no shell.

Verified

• cargo check --manifest-path Cargo.toml --lib → clean finish (EXIT=0).
• cargo check --manifest-path Cargo.toml --lib --tests → clean finish (EXIT=0), so the new tests compile.
• cargo fmt applied.

Not verified

• Tests were not executed here (cargo test link step is too heavy for this memory-constrained box); relying on PR CI to run them. They are written and compile.
• No changes to vendor/tinyagents (submodule pointer unchanged); the fix lives entirely in the openhuman seam.

https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.