fix(core): make team shutdown a leader-only tool - #9401
Merged
Conversation
send_message carried an optional single-value enum `type: ['shutdown_request']` described as "structured message type for control flow". Models filled it while composing an ordinary report; the call was then rejected leader-only and the report content was discarded, leaving the teammate retrying a report the leader never received. Split control from content at the tool boundary rather than validating the field harder. `type` is removed from send_message entirely, and shutdown becomes request_shutdown, which createToolRegistry skips for subagent-context registries — so a teammate has no declaration for it and cannot emit the call at all, instead of emitting one and being refused. The mailbox wire format is unchanged: sendStructuredMessage still writes `type: 'shutdown_request'` with `from: LEADER_NAME`. Only the tool surface moved. Fixes #9276
yiliang114
requested review from
LaZzyMan,
doudouOUC,
tanzhenxin and
wenshao
as code owners
August 18, 2026 11:03
Collaborator
Collaborator
|
Re-run at @wenshao's request, after his maintainer-local Template: complete now — the PR body was refreshed to the current template, all sections present including Risk & Scope, Linked Issues, and the full Chinese translation. ✓ Problem: real and observed. #9276 is an external report (still open) with a minimal reproduction: a teammate composing an ordinary completion report emits the old Direction: aligned. This unblocks the most basic team operation, a teammate reporting to its leader. Claude Code's CHANGELOG continues to show the SendMessage / teammate surface under heavy active development (cross-session messaging, idle-notification, burst-limit fixes all recent), so getting this tool boundary right remains well-timed. Size: core paths touched ( Approach: still the right one — removing Risk: no elevated risk signals — no changed file matches the revert-correlated path list. Moving on to code review. 🔍 中文说明应 @wenshao 请求重新运行（在其本地 模板：现已完整——PR 正文已按最新模板刷新，各节齐全，包括 Risk & Scope、Linked Issues 与完整中文翻译。✓ 问题：真实且已观测。#9276 为外部用户报告（仍开放），附最小复现：teammate 撰写普通完成报告时带上旧 方向：对齐。此修复解除了最基础的团队操作——teammate 向 leader 汇报。Claude Code 的 CHANGELOG 显示 SendMessage / teammate 领域仍在密集开发（跨会话消息、空闲通知、限流修复均为近期条目），现在把这个工具边界做对仍然是时候。 规模：触及核心路径（ 方案：方案仍然正确——把 风险：无升级风险信号——没有改动文件命中与 revert 相关的路径列表。 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
Code review (head
|
| Check | Conclusion |
|---|---|
Capture web-shell visuals (ubuntu-latest, Node 22.x) |
✅ success |
Classify PR |
✅ success |
Dependency CVE audit |
✅ success |
Desktop Shell (ubuntu-22.04) |
✅ success |
Desktop Shell (windows-2022) |
✅ success |
Post Coverage Comment (ubuntu-latest, 22.x) |
✅ success |
Secret scan (TruffleHog) |
✅ success |
Test (ubuntu-latest, Node 22.x) |
✅ success |
web-shell E2E Smoke (ubuntu-latest, Node 22.x) |
✅ success |
One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。
The behavioural claim — a teammate's ordinary report actually reaching the leader with the discriminator gone — was settled between review passes by @wenshao's maintainer-local /verify-pr run at this exact SHA: MERGE-READY, 17/17 scripted assertions, with an A/B load-bearing proof (base refuses the model-confusable shape and drops the report; head delivers it, the field is absent from the schema, the shutdown wire is byte-identical, and both runtime defense contexts reject non-leaders) plus 598 focused tests, core build, and typecheck in a credential-less container. That is sandboxed evidence, not the author's word — linked in the thread above.
Not covered by anything so far, per that report's own scoping: the live-model trigger (why a model reaches for the old shape — addressed structurally, since the shape no longer exists to emit) and the full multi-round approval/rejection lifecycle — which runs on the unchanged wire and is pinned by unit tests, so it is not gating here. @qwen-code /tmux remains available if a maintainer wants the interactive lifecycle watched live; nothing about the current evidence requires it.
Live TUI testing (Stage 2c) is not run on unattended CI passes — the signals above are the PR's own CI and the sandboxed verification report.
中文说明
代码审查（head 5915428e）
上一轮在 6571a019 上审查通过，仅剩两个外观小项。此后新增两个提交，本轮验证增量并在当前 head 端到端复查整个机制。
增量提交 4435c9c5（已核实）：ca.js 一行——身份值 'RequestShutdown' 改为 "Sol·licita l'aturada"，关闭最后一个未决小项；四个 CLI locale 现均有实际值，web-shell 保留 TOOL_DISPLAY_NAMES 条目与 zh 徽标。
增量提交 5915428e（合并最新 main，已核实与 PR 代码互不重叠）：三个 PR 自有文件在合并窗口内也被 main 修改，但 main 侧代码块均避开 PR 区域——agent-core.ts 增加的是 #9436 的工具调用指纹重放工作（imports 与推理循环，两个排除集仍在第 193/259 行保留 REQUEST_SHUTDOWN）；config.ts 变化在扩展网络策略与服务器配置附近，距团队工具注册块约 4600 行，注册块的 forSubAgent 跳过（第 8785 行）完好；config.test.ts 仅新增 safe-mode 与服务器配置测试。现已与 main 无差距。
机制在本 head 复查：注册层（forSubAgent 跳过，注释引用 #9276）、运行时守卫（isSubagentLikeExecutionContext() fail closed，未知收件人以工具错误返回而非抛异常）、声明过滤（两个排除集均含 REQUEST_SHUTDOWN，teammate 集合保留 SEND_MESSAGE 与任务工具）。独立核查：SendMessageParams 无残留 discriminator（send-message.ts 中 type 仅指 ToolErrorType 错误标签）；邮箱线格式未动；两处提示词均教新格式；工具声明 schema 仅 to（必填、additionalProperties: false），描述本身引导模型用 send_message 发普通文本。无阻断或建议级发现，此前两个小项已解决。
测试（本运行不执行任何 PR 代码）
当前 head 的 CI 已全部完成且全绿。核心行为声明——teammate 普通报告在 discriminator 移除后确实送达 leader——已由 @wenshao 在两轮审查之间以维护者本地 /verify-pr 在本 SHA 上验证：MERGE-READY，17/17 脚本断言，含 A/B 承重证明（base 拒绝并丢弃误形报告，head 正常送达、schema 无该字段、shutdown 线格式逐字节一致、两个运行时防御上下文均拒绝非 leader），另有 598 个聚焦测试与 core build/typecheck 在无凭据容器中通过。这是沙箱证据而非作者自述，报告见上方线程。按其自身范围说明，尚未覆盖：真实模型触发路径（已以结构化方式解决——该形状已不存在）与完整多轮批准/拒绝生命周期（运行于未变更的线上，有单测钉住，不构成合并门槛）；如需实时观察交互流程可用 /tmux。
— Qwen Code · qwen3.8-max
Reviewed at 5915428e2a624a6dde71f9804ce7b8e91f5da3d7 · re-run with @qwen-code /triage
Collaborator
|
Confidence: 5/5 — clean across every stage, behaviourally verified at this exact head, and the one gap CI could not settle has been closed by sandboxed evidence; would merge without hesitation. Stepping back: the problem was observed in the wild (#9276, external reporter, minimal repro, still open), and the fix attacks the representation instead of the symptom — my independent proposal before ever reading this diff was the same split, and this PR executes it more thoroughly than the minimal version: three enforcement layers (registration skip, declaration filtering, fail-closed runtime guard), each pinned by tests, wire format untouched, and a tool declaration whose own description steers the model away from the original confusion. The two commits since the last pass are exactly what they claim to be: the Catalan translation that closed the last cosmetic nit, and a merge of The one thing earlier passes could not settle from the diff — a live teammate report reaching the leader — is no longer open: @wenshao's maintainer-local CI is settled on this commit (no pending workflow runs), so approval is posted now rather than deferred, pinned to the reviewed commit below. — Qwen Code · qwen3.8-max Reviewed at |
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
yiliang114
marked this pull request as draft
August 18, 2026 11:38
qwen-code-ci-bot
requested changes
Aug 18, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not reviewed: reverse audit — its prompt was built, but no agent was launched with it — the pass that hunts what the rest of the review missed ran, if at all, without the method its brief carries, and cannot be certified.
Test Plan (not a blocker): 6 passed — this review observed 20508, 1578, 21372, 1597, 494, 3746, 529 passed; 21 passed — this review observed 20508, 1578, 21372, 1597, 494, 3746, 529 passed; 802 passed — this review observed 20508, 1578, 21372, 1597, 494, 3746, 529 passed.
— qwen3.8-max via Qwen Code /review (v0.21.13)
The new leader-only request_shutdown tool landed without entries in the drift-guarded display surfaces, breaking CI: - web-shell TOOL_DISPLAY_NAMES (toolFormatting.drift.test.ts) and the zh badge label in client/i18n.tsx (toolFormatting.test.ts parity) - cli toolDisplayName locale entries enforced by i18n/index.test.ts and check-i18n key parity (en identity / zh / zh-TW)
Collaborator
Author
|
Pushed b25b14f to fix the two CI failures, both caused by the new
Verified locally: |
Collaborator
🖼️ web-shell visual previewRendered against a mock daemon (no real backend): the PR base vs this PR head Screenshots · before / afterFull-resolution recordings (.webm) are attached to the workflow run. — Qwen Code · web-shell visuals |
yiliang114
marked this pull request as ready for review
August 19, 2026 01:25
…the display name Three criticals from review, all real. The leader-only guarantee did not hold. "Enforced by absence" covers a registry that was *built* with forSubAgent, but runSingleDispatch's workflow fast path hands a subagent the parent leader's registry untouched — and that one does contain request_shutdown. So a workflow subagent could request a shutdown as the leader. The runtime guard now uses isSubagentLikeExecutionContext rather than isTeammate, which covers every subagent-like context instead of only a teammate identity. RequestShutdown had no toolDisplayName locale entry, failing the CLI i18n guard, and no entry in web-shell's manually synced TOOL_DISPLAY_NAMES, failing that package's drift guard. Both added, matching the locales that carry SendMessage. And the suggestions: a config test asserting the tool is present in a leader registry and absent from a forSubAgent one — the property everything rests on, which nothing checked; the deliberate 'ask' permission default pinned; the empty and whitespace recipient guard covered, since the schema admits both; and the dead requestShutdown mock left in send-message.test.ts's helper type removed. Verified: 534 config tests, 30 across request-shutdown and send-message.
Collaborator
Author
|
Review findings addressed in
534 config tests and 30 across @qwen-code /review |
Collaborator
Author
|
@qwen-code /triage |
Collaborator
|
Sandboxed verification: The verification job did not complete (checkout, runner, or setup error) and produced no report. See the workflow run for details. 中文 — 判定：
|
Collaborator
|
Triage re-run completed without a new review.
The stage comments above were updated with the latest result. View workflow run. 上方各阶段评论已更新为最新结果。查看工作流运行。 |
qwen-code-ci-bot
previously approved these changes
Aug 19, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship — CI landed green after the review. ✅
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
— qwen3.8-max via Qwen Code /review (v0.21.13)
Collaborator
Author
|
@qwen-code /triage |
Collaborator
|
Sandboxed verification: The verification job did not complete (checkout, runner, or setup error) and produced no report. See the workflow run for details. 中文 — 判定：
|
yiliang114
enabled auto-merge
August 19, 2026 07:34
Collaborator
|
Triage re-run completed without a new review.
The stage comments above were updated with the latest result. View workflow run. 上方各阶段评论已更新为最新结果。查看工作流运行。 |
qwen-code-ci-bot
previously approved these changes
Aug 19, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship — CI landed green after the review. ✅
doudouOUC
reviewed
Aug 19, 2026
doudouOUC
left a comment
doudouOUC
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not explored to full depth (tool budget reached): "agent 6a": 无 — 未因预算上限而中断任何检查。; "agent 5": NO Budget gap: line — no check was cut short by the budget ceiling.; "agent 1b": NO; "agent 3a": NO Budget gap: line..
Not reviewed: reverse audit — no auditor was launched with a prompt this skill builds — the pass that hunts what the rest of the review missed ran, if at all, without the method its brief carries.
— qwen3.8-max via Qwen Code /review (v0.21.13)
doudouOUC
reviewed
Aug 19, 2026
doudouOUC
left a comment
doudouOUC
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not explored to full depth (tool budget reached): "agent 6a": 无 — 未因预算上限而中断任何检查。; "agent 5": NO Budget gap: line — no check was cut short by the budget ceiling.; "agent 1b": NO; "agent 3a": NO Budget gap: line..
Not reviewed: reverse audit — no auditor was launched with a prompt this skill builds — the pass that hunts what the rest of the review missed ran, if at all, without the method its brief carries.
— qwen3.8-max via Qwen Code /review (v0.21.13)
doudouOUC
reviewed
Aug 19, 2026
doudouOUC
left a comment
doudouOUC
left a comment
Collaborator
There was a problem hiding this comment.
Review complete: pr-9401 — COMMENT posted (0 Critical, 5 Suggestions)
Posted: #9401 (review)
Summary
Full review of PR #9401 (fix(core): make team shutdown a leader-only tool) — 17 files, +418/-80, 3 review chunks. All 14 agents ran (Issue Fidelity, Line-by-line correctness, Security, Reuse, Altitude, Consistency, Performance, Test coverage, 3 adversarial personas, Removed-behavior audit, Cross-file tracer, Build & Test).
Previous blockers (3 Criticals) — all confirmed fixed:
- Leader impersonation via workflow fast path — ✅
REQUEST_SHUTDOWNin both exclusion sets + runtimeisSubagentLikeExecutionContextcheck - Web-shell display names — ✅
TOOL_DISPLAY_NAMES+i18n.tsxentry - Locale entries — ✅ All four locale files (zh, zh-TW, ca, en)
5 new findings posted (all Suggestions/Nice-to-have):
- Missing test for plan-required teammate guard —
isPlanRequiredTeammateAwaitingApprovalis the first code path inexecute()but untested toAutoClassifierInput()override untested — classifier input override not coveredtoAutoClassifierInputreturns untrimmedto— classifier sees' bob 'while execution targets'bob'getDescription()uses untrimmedto— display string inconsistencygetDescription()untested — cosmetic only
Build & Test: Pre-existing environment issue (packages/audio-capture requires Python for node-gyp); no failures in files the PR touched.
The entry was left as raw English while every sibling team tool is translated.
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed.
1 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- workflow-level discoverability of request_shutdown (WORKFLOW_SUBAGENT_DISALLOWED_TOOLS + leader-only discovery predicate) — already reported as R2-1 (comment 3809920960); author deferred as follow-up
Not explored to full depth (tool budget reached): "agent 1c": none — all planned checks completed (~22 tool calls, under the ceiling)..
Test Plan (not a blocker): 6 passed — this review observed 21921, 20551, 3784, 1590, 1598, 494, 540 passed; 21 passed — this review observed 21921, 20551, 3784, 1590, 1598, 494, 540 passed; 802 passed — this review observed 21921, 20551, 3784, 1590, 1598, 494, 540 passed.
Deferred under the convergence posture (round 3, not a blocker) — recorded, not requested in this round:
packages/core/src/tools/request-shutdown.ts:74 — [probe] plan-required pre-approval branch untested — two surviving mutants proven
— qwen3.8-max via Qwen Code /review (v0.21.14)
Collaborator
Author
|
Closeout summary for exact head
中文摘要PR body 已按最新模板和当前实现校正并补齐中文；旧 Web-shell Visuals 在安装 Chromium 时取消、未执行截图，因此普通合并 latest |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
4 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- leader-only discovery predicate (isLeaderOnlyToolUnavailableInSubagent) unaware of request_shutdown — already reported as R2-1 (comment 3809920960); author deferred as follow-up
- REQUEST_SHUTDOWN missing from WORKFLOW_SUBAGENT_DISALLOWED_TOOLS — already reported as R2-1 (comment 3809920960); author deferred as follow-up
- plan-required pre-approval branch untested (request-shutdown.ts:74) — posted in round 2 and deferred under the convergence posture in round 3 (two surviving mutants proven)
- toAutoClassifierInput override untested (request-shutdown.ts:164) — posted in round 2 (comment 3809920968); author deferred as out of scope
Not reviewed: reverse audit — an auditor ran and opened its brief, but no agent was launched with the prompt the CLI built — the launch was written by hand, and what the agent was actually asked is not what this skill certifies.
Test Plan (not a blocker): 6 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed; 21 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed; 802 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed.
Deferred under the convergence posture (round 4, not a blocker) — recorded, not requested in this round:
packages/core/src/agents/runtime/agent-core.ts:259 — [probe] EXCLUDED_TOOLS_FOR_TEAMMATES entry for request_shutdown untested — surviving mutant proven
中文说明
仅完成部分审查，审查缺口已披露。
本轮确认的 4 条建议级发现已在 PR 上报告过，不再重复发布（列表见上方英文部分）。
未审查：反向审计——有审计 agent 运行并打开了自己的 brief，但没有 agent 是用 CLI 构建的 prompt 启动的——启动 prompt 是手写的，agent 实际被要求做的并不是本 skill 所认证的内容。
Test Plan（非阻断）：6 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed; 21 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed; 802 passed — this review observed 20647, 3799, 1590, 1612, 494, 542 passed。
收敛姿态下延后（第 4 轮，非阻断）——已记录，本轮不要求修改：共 1 条（原文未翻译，列表见上方英文部分）。
— qwen3.8-max via Qwen Code /review (v0.21.14)
This was referenced Aug 19, 2026
Closed
Collaborator
|
✅ MERGE-READY — 17/17 scripted behavioral assertions passed at 中文摘要结论：可以合并。 本地无凭据 Docker 环境中的同场景 A/B 证明核心修复是 load-bearing：base 会让 teammate 的普通完成汇报因旧 没有发现新的阻断或建议级问题。聚焦的 598 个测试、core build 与 core typecheck 均通过。未覆盖：真实模型为何选择旧 discriminator 的端到端触发、完整多轮 Central claimSeparating shutdown control from Load-bearing A/BThe same TypeScript harness loaded the real tool and
Targeted gates
FindingsNone. The earlier review's deferred mutation/coverage notes remain coverage suggestions rather than reproduced behavioral defects. This round independently exercised the central absent-field property, both runtime defense contexts, the leader permission default, and the real mailbox wire. Not covered
MethodologyMetadata was resolved with — maintainer-local |
wenshao
approved these changes
Aug 24, 2026
wenshao
approved these changes
Aug 24, 2026
Collaborator
|
@qwen-code /triage |
Collaborator
|
Sandboxed verification: ✅ passed — merge-ready (agent verdict) - workflow run Ran the PR in an isolated, token-free container: A/B against the base build, mock-free harness assertions, targeted gates. Advisory evidence for human reviewers — not a review, an approval, or a CI check. Scripted assertions: 712 passed · 0 failed · 712 total Flakiness gate: ✅ 4 changed test file(s) x 5 identical rounds, no divergence 中文 — 判定：✅ 通过 · 可合入（agent 判定）沙箱验证在隔离、无凭证的容器中执行了该 PR 的代码（与 base 构建 A/B 对照、无 mock harness 断言、定向门禁）。仅作为评审证据，不构成评审、批准或 CI 检查。 脚本断言：712 通过 · 0 失败 · 712 总计 抖动门：✅ 4 changed test file(s) x 5 identical rounds, no divergence Verification reportPR #9401 Deep Verification — fix(core): make team shutdown a leader-only toolVerdict: 中文摘要结论：merge-ready（可合并），全部 712 条脚本化断言通过，无阻塞性发现。
Central claim + A/BCentral claim: a teammate's ordinary report is always deliverable, and team shutdown exists only as a leader-only tool — enforced structurally (absence from subagent registries, exclusion from inherited declarations) with a runtime guard as defense in depth — while the mailbox wire format stays unchanged. Environment per cell: compiled
Harness totals: base 16/16, head 22/22 — every base-arm "red" (bug reproduces, hole exists) is expectation-encoded, so The load-bearing proof is the B1/P1 pair: identical harness, identical scenario, outcome flips exactly where the PR says it does — base discards the report and leaks the declaration to subagents; head delivers the report and strips the declaration, with the control sink (B4) unchanged. CorrectionsNone — no prior verification round or bot claims about this code exist in this context ( FindingsNo blocking findings. Two informational notes:
Sibling sweeps performed and closed:
Mutation matrix (vacuity + guard pinning)Each mutant was applied byte-exact (
Adjudications: 8/8 as predicted. Witnesses: Targeted gates (head)
Typecheck/build evidence: Not covered
MethodologyRan in the CI verify container ( The A/B harness ( Flakiness gate logEvidence images
Harness scripts and raw logs are in the workflow run artifacts (7-day retention). — Qwen Code · sandboxed verification |
qwen-code-ci-bot
approved these changes
Aug 24, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship. ✅
Collaborator
|
Released in v0.22.2. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Makes team shutdown its own leader-only tool,
request_shutdown, and removes thetypeparameter fromsend_messageentirely.send_messagecarried an optional single-value enumtype: ['shutdown_request'], described to the model as "Structured message type for control flow. When set, routes through the mailbox instead of plain text delivery." A teammate composing what it understood to be a structured report would set it; the call was then refused with "Only the team leader can request shutdowns" and the report content was dropped, so the teammate kept retrying a report the leader never received.The fix separates control from content at the tool boundary instead of validating the field more strictly. Subagent registries omit
request_shutdownthrough the existingforSubAgentfilter, inherited tool declarations filter it for subagent-like execution contexts, and the runtimeisSubagentLikeExecutionContext()refusal remains as defense in depth for paths that reuse a leader registry.This deliberately does not reword the field description or silently downgrade a teammate's
shutdown_requestto a normal message. Both leave the illegal state representable.The mailbox wire format is untouched:
sendStructuredMessagestill writestype: 'shutdown_request'withfrom: LEADER_NAME, andTeamManager.requestShutdownis unchanged. Only the tool surface moved. The two prompt sites that taught the old shape—theteam_createworkflow text and the bundledcoordinateskill—now namerequest_shutdown.Why it's needed
This blocks the only currently supported multi-agent path. A teammate cannot deliver an ordinary completion or status report to its leader, the most basic operation in the Agent Team workflow. Reported in #9276 against both enforced read-only and full-tool teammate profiles, so it is not caused by the
read_onlydispatch setting.Reviewer Test Plan
Reviewers should confirm ordinary teammate messages remain deliverable, shutdown control is exposed only to the leader, and the existing shutdown mailbox protocol is unchanged.
How to verify
send_message. Confirm it is delivered, and that the teammate's declaration forsend_messagehas notypeproperty.request_shutdowndoes not appear in a teammate's available tools, and does appear for the leader.request_shutdownwithtoset to a teammate name. Confirm the teammate receives the shutdown mailbox entry as before, repliesshutdown_approved/shutdown_rejectedoversend_message, and is excluded from automatic task assignment while pending.request_shutdownagainst an unknown teammate surfaces "not found" as a tool error rather than throwing.Local focused results already recorded on the PR head:
request-shutdown.test.tssend-message.test.tssrc/agents/team+team-create+configEvidence (Before & After)
Before, a teammate reporting completion emitted the following call and was refused:
{ "type": "shutdown_request", "to": "leader", "message": "Task completed and verified" }After,
typedoes not exist onsend_message, so that call cannot be formed; the message is delivered as ordinary text.request_shutdownis absent from the teammate's tool list entirely.Tested on
Environment (optional)
Not applicable.
Risk & Scope
The change is limited to the team messaging tool surface and its bundled instructions. It preserves the mailbox wire format and runtime authorization guard. The latest
mainwas merged only to recover a cancelled visual workflow; post-merge CI is pending.Linked Issues
Fixes #9276.
中文说明
本 PR 做了什么
将团队关闭请求拆成仅 leader 可用的独立工具
request_shutdown，并从send_message中彻底移除type参数。此前 teammate 可能把普通汇报误写成shutdown_request，调用随后被权限检查拒绝，消息内容也不会送达 leader。现在普通消息与控制操作在工具边界分离：subagent registry 通过现有forSubAgent过滤器移除request_shutdown，继承的工具声明也会为 subagent-like 执行上下文过滤它，运行时isSubagentLikeExecutionContext()拒绝仍作为复用 leader registry 路径的纵深保护。不会通过改写字段描述或把非法关闭请求静默降级为普通消息来修复，因为那仍会让非法状态可表达。邮箱协议保持不变，
sendStructuredMessage与TeamManager.requestShutdown的行为不变；仅调整工具表面，并同步更新team_create与 bundledcoordinateskill 的提示。为什么需要
该问题会阻断 Agent Team 最基本的 teammate→leader 完成或状态汇报。#9276 在 read-only 与 full-tool teammate profile 中都能复现，因此不是
read_only配置导致。Reviewer 测试计划
Reviewer 应确认：普通 teammate 消息仍能送达；关闭控制只对 leader 暴露；既有 shutdown mailbox 协议不变。
如何验证
send_message汇报完成；确认消息送达且 schema 中没有type。request_shutdown，leader 列表中存在。request_shutdown，确认仍收到 shutdown mailbox 事件、仍通过send_message回复批准或拒绝，并在等待期间不参与自动任务分配。已记录的聚焦结果：
request-shutdown.test.ts6 例通过，send-message.test.ts21 例通过，agent team、team-create 与 config 共 802 例通过。前后证据
修复前，普通汇报可能携带
type: "shutdown_request"并被拒绝；修复后send_message无法表达该字段，普通消息正常送达，teammate 的工具列表也不包含request_shutdown。测试平台
Linux 已由上述聚焦套件验证；macOS 与 Windows 尚未验证。
风险与范围
变更仅涉及团队消息工具表面及其 bundled 指引，保留 mailbox 协议与运行时授权保护。为恢复被取消的 visual workflow 已合并 latest
main，合并后的 CI 正在等待验证。关联 Issue
修复 #9276。