fix(core): enforce tool restrictions in subagents - #1691
Merged
Conversation
Add filtering to block unauthorized tool calls in subagents. When a model attempts to call a tool not in the allowed tools list, the call is now blocked and an error is returned instead of executing. - Pass toolsList to scheduleToolCalls for filtering - Emit TOOL_CALL and TOOL_RESULT events for blocked calls (for visibility) - Extract recordToolCallStats helper to reduce duplication - Add comprehensive test coverage for tool restriction enforcement Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
tanzhenxin
requested review from
DennisYu07,
LaZzyMan,
Mingholy,
gwinthis and
pomelo-nwu
as code owners
February 2, 2026 08:31
Contributor
📋 Review SummaryThis PR addresses a security vulnerability (issue #1121) where subagents were not properly enforcing tool restrictions, allowing models to execute tools not in the allowed tools list. The fix adds filtering in 🔍 General Feedback
🎯 Specific Feedback🔴 CriticalNo specific critical issues identified in this review. 🟡 HighNo specific high priority issues identified in this review. 🟢 MediumNo specific medium priority issues identified in this review. 🔵 Low
✅ Highlights
|
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
xaelistic
pushed a commit
to xaelistic/qwen-code
that referenced
this pull request
Jun 7, 2026
fix(core): enforce tool restrictions in subagents
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Fixes a security vulnerability in subagents where models could execute tools not in the allowed tools list. This PR adds enforcement to block unauthorized tool calls before execution, returning an error to the model instead.
Dive Deeper
This PR addresses issue #1121 where subagents were not properly enforcing tool restrictions. Previously, if a model attempted to call a tool that wasn't in the allowed tools list, the call would still be executed because there was no filtering layer between the model's function calls and tool execution.
Changes made:
Added tool filtering in
scheduleToolCalls: Before scheduling any tool calls, we now filter against thetoolsList(the allowed tools). Unauthorized calls are blocked and an error is returned.Event emission for blocked calls: Even blocked tool calls emit
TOOL_CALLandTOOL_RESULTevents for visibility and debugging purposes. TheTOOL_RESULTevent includessuccess: falseand an error message.Extracted
recordToolCallStatshelper: Reduced code duplication by extracting stats recording logic into a private method that's used for both successful and blocked tool calls.Comprehensive test coverage: Added a new test suite specifically for tool restriction enforcement, verifying that:
Reviewer Test Plan
git checkout fix/subagent-tool-restrictioncd packages/core && npx vitest run src/subagents/subagent.test.tsnpx vitest run src/subagents/To manually test the fix, you could:
read_file)Testing Matrix
Tested on macOS with
npm run- new tests passLinked issues / bugs
Resolves #1121
🤖 Generated with Qwen Code