Merge branch 'feat/tower-worker-subagent-denial-subagent01'

Author: konghuanjun

packages/agent-core-v2/src/features/tower/towerService.ts

@@ -299,37 +299,6 @@ export class AgentTowerService extends Disposable implements IAgentTowerService
         );
       }),
     );
-    this._register(
-      toolExecutor.onBeforeExecuteTool(async (event) => {
-        if (event.toolCall.name !== 'Agent') return;
-        const args = event.args;
-        if (typeof args !== 'object' || args === null) return;
-        const resume = (args as { readonly resume?: unknown }).resume;
-        if (typeof resume !== 'string') return;
-        const resumeId = resume.trim();
-        if (resumeId.length === 0) return;
-        const mainCheckout = resolveTowerRepoRoot(this.sessionCtx.cwd);
-        if (!(await towerWorkspaceOwned(join(mainCheckout, STATE_FILE)))) return;
-        const store = new TowerStore(mainCheckout);
-        const forbidden = await store.load().then(
-          (state) => {
-            const caller = store.resolveAgent(state, this.agentCtx.agentId);
-            if (caller?.kind !== 'reviewer') return undefined;
-            if (resumeId === 'main') return 'main';
-            return store.resolveAgent(state, resumeId)?.name;
-          },
-          () => undefined,
-        );
-        if (forbidden === undefined) return;
-        event.veto(
-          denyToolExecution(
-            this.toolApproval.formatDenyMessage(
-              `Reviewer agents cannot resume "${forbidden}" — main and every roster agent are orchestration identities; reviewers finish with TowerReview instead. Non-roster explore/plan subagents are still allowed.`,
-            ),
-          ),
-        );
-      }),
-    );
     this._register(
       toolExecutor.onBeforeExecuteTool(async (event) => {
         if (!this.flags.enabled(TOWER_FLAG_ID)) return;

packages/agent-core-v2/src/features/tower/workerProfile.ts

@@ -12,7 +12,6 @@ import { TOWER_WORKER_PROFILE } from './tower';
 import TOWER_WORKER_ROLE_OVERLAY from './tower-worker-overlay.md?raw';
 
 const TOWER_WORKER_TOOLS = [
-  'Agent',
   'Bash',
   'TowerComplete',
   'TowerFinding',
@@ -61,7 +60,6 @@ export const TOWER_WORKER_PROFILE_DEF: AgentProfile = normalizeAgentProfile({
   whenToUse:
     'Use this agent for non-trivial software engineering work that may require reading files, editing code, running commands, and returning a compact but technically complete summary to the parent agent.',
   tools: TOWER_WORKER_TOOLS,
-  subagents: ['explore', 'plan'],
   renderSystemPrompt: (context) =>
     renderSystemPromptResult(TOWER_WORKER_ROLE, context, {
       skillActive: skillActiveFor(TOWER_WORKER_TOOLS),

packages/agent-core-v2/test/features/tower/towerService.test.ts

@@ -3733,82 +3733,6 @@ describe('AgentTowerService', () => {
       expect(permissionGateRan).toBe(true);
       expect(formatDenyMessage).not.toHaveBeenCalled();
     });
-
-    async function useReviewer(): Promise<void> {
-      const store = new TowerStore(repo);
-      await store.registerAgent({
-        name: 'r1',
-        kind: 'reviewer',
-        agentId: 'agent-r1',
-        sessionId: 'session-main',
-        reviewTarget: 'feat/leased',
-        reviewMissionId: 'M1',
-        spawnedAt: new Date().toISOString(),
-      });
-      ix.stub(
-        IAgentScopeContext,
-        makeAgentScopeContext({
-          agentId: 'agent-r1',
-          agentScope: testWireScope('wire', 'tower-test'),
-          generation: 0,
-        }),
-      );
-      ix.get(IAgentTowerService);
-    }
-
-    it.each([
-      ['main', false],
-      ['main', true],
-      ['agent-w1', false],
-      ['agent-w1', true],
-    ])('vetoes reviewer resume of %s with run_in_background=%s', async (resumeId, background) => {
-      await useReviewer();
-
-      const decision = await fire(
-        agentHookContext({
-          resume: resumeId,
-          run_in_background: background,
-          prompt: 'review again',
-          description: 'forbidden reviewer resume',
-        }),
-      );
-
-      expect(decision?.veto?.isError).toBe(true);
-      expect(decision?.veto?.output).toContain('Reviewer agents cannot resume');
-      expect(decision?.veto?.output).toContain('Non-roster explore/plan subagents are still allowed');
-      expect(permissionGateRan).toBe(false);
-    });
-
-    it('allows a reviewer to resume a non-roster agent', async () => {
-      await useReviewer();
-
-      const decision = await fire(
-        agentHookContext({
-          resume: 'agent-stranger',
-          run_in_background: true,
-          prompt: 'keep exploring',
-          description: 'non-roster resume',
-        }),
-      );
-
-      expect(decision).toBeUndefined();
-      expect(permissionGateRan).toBe(true);
-    });
-
-    it.each(['explore', 'plan'])('allows a fresh non-roster %s subagent for a reviewer', async (type) => {
-      await useReviewer();
-
-      const decision = await fire(
-        agentHookContext({
-          subagent_type: type,
-          prompt: 'inspect the branch',
-          description: 'fresh analysis',
-        }),
-      );
-
-      expect(decision).toBeUndefined();
-      expect(permissionGateRan).toBe(true);
-    });
   });
   describe('bash destructive guard', () => {
     let repo: string;

packages/agent-core-v2/test/features/tower/workerProfile.test.ts

@@ -11,16 +11,16 @@ function builtinProfile(name: string) {
 }
 
 describe('tower-worker profile', () => {
-  it('gives tower-worker the coder tools (minus AgentSwarm) plus the seven shared tower tools', () => {
+  it('gives tower-worker the coder tools (minus Agent and AgentSwarm) plus the seven shared tower tools', () => {
     const coder = builtinProfile('coder');
     const tools = TOWER_WORKER_PROFILE_DEF.tools ?? [];
 
     for (const name of coder.tools ?? []) {
-      if (name === 'AgentSwarm') continue;
+      if (name === 'Agent' || name === 'AgentSwarm') continue;
       expect(tools).toContain(name);
     }
+    expect(tools).not.toContain('Agent');
     expect(tools).not.toContain('AgentSwarm');
-    expect(TOWER_WORKER_PROFILE_DEF.subagents).toEqual(['explore', 'plan']);
     for (const name of [
       'TowerComplete',
       'TowerSend',