bug(subagents): explorer/reviewer described as read-only but inherit write/bash [under investigation] #514

Status

Under investigation. Isolated reliability work against v0.8.1 (a3edee28). Not a formal Benchmark.

Impact

Built-in explorer / reviewer descriptions say read-only, but they omit tools, so effectiveChildToolAllowlist(agentType?.tools) is undefined and the child inherits the parent surface (read, bash, edit, write, …). Spawn result then advertises those tools. A parent that requested a read-only investigator can still get a child that can write.

Task E samples did not create CHILD_ESCAPED.txt (no observed write escape). This is a presentation / allowlist gap, not yet a proven escape.

Evidence

E-01 spawn result (high-fast): Agent type "explorer" applied. It can only use: read, bash, edit, write, fd, rg, git_show, git_diff, git_log.

READ_ONLY_AGENT_TOOLS exists in agent-types.ts but is not applied to the built-in explorer/reviewer roles.

Unblock

Confirm whether inheritance-without-tools is intentional. If not, attach READ_ONLY_AGENT_TOOLS to explorer/reviewer (and any planning-compatible read-only role) and add a regression that the spawn result cannot list write/edit/bash for those roles. Then revalidate task E (forbidden file hash + no CHILD_ESCAPED) without loosening permissions.