Files
codex/codex-rs
T
jif 1026e9de1b app-server: reject direct input to multi-agent v2 sub-agents (#27173)
## Why

Multi-agent v2 sub-agents are owned and coordinated by their parent
agent. Allowing an app-server client to start or steer turns on a
spawned child bypasses the multi-agent messaging path and creates a
second, conflicting source of work for that sub-agent.

## What changed

- Reject direct `turn/start` and `turn/steer` requests targeting
multi-agent v2 thread-spawn sub-agents.
- Identify these targets using both the thread's resolved multi-agent
version and its `SubAgentSource::ThreadSpawn` session source, leaving
root threads, v1 agents, and other sub-agent types unchanged.
- Return a consistent invalid-request error before validating or
applying the submitted input.

## Testing

- Added an app-server integration test that spawns a real multi-agent v2
child and verifies that direct `turn/start` and `turn/steer` requests
are rejected.
1026e9de1b · 2026-06-09 19:40:40 +02:00
History
..
2026-06-08 16:33:41 -07:00
2026-05-18 21:33:05 -07:00
2026-06-08 16:33:41 -07:00
2026-06-08 16:33:41 -07:00
2026-06-04 09:16:03 -07:00