fix(routing): self-identify subagent routing block, add opt-out (#967) - #1034
Open
kaovilai wants to merge 1 commit into
Open
fix(routing): self-identify subagent routing block, add opt-out (#967)#1034kaovilai wants to merge 1 commit into
kaovilai wants to merge 1 commit into
Conversation
…lu#967) Auto-mode permission classifiers sometimes read the injected <context_window_protection> block in Agent-tool dispatch prompts as a prompt-injection payload and veto the spawn itself. - Wrap the block in a <provenance> tag identifying it as trusted first-party config from a locally installed plugin, not injected third-party content, when routed into a subagent prompt. - Add CONTEXT_MODE_SUBAGENT_ROUTING opt-out (0/false/off/no) to skip the injection entirely for security-conscious setups. Fixes mksglu#967 Signed-off-by: Tiger Kaovilai <passawit.kaovilai@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / Why / How
Auto-mode permission classifiers sometimes read the injected
<context_window_protection>block in Agent-tool dispatch prompts as a prompt-injection payload and veto the subagent spawn itself (~40% of spawns in the reporter's session).<provenance>tag when routed into a subagent prompt, identifying it as trusted first-party config from a locally installed plugin rather than injected third-party content.CONTEXT_MODE_SUBAGENT_ROUTINGopt-out (0/false/off/no) to skip the injection entirely for security-conscious setups.Fixes #967
Related to #911 / #918 (also about the injected block reading as injection-shaped to classifiers, addressed there via renaming
<priority_instructions>→<usage_hint>and trimming<session_continuity>) — this PR is complementary: it adds explicit provenance/self-identification plus a hard opt-out, rather than softening wording. No overlapping lines once #918 lands; happy to rebase if it merges first.Affected platforms
Test plan
tests/core/routing.test.tsandtests/hooks/core-routing.test.tscovering the<provenance>wrapper and theCONTEXT_MODE_SUBAGENT_ROUTINGopt-out (including truthy/falsy env var variants).Checklist
npm testpassesnpm run typecheckpassesnextbranchNote
Responses generated with Claude