{"version":"2.1.227","anchor":"agent-refuses-spawns-whose-tool-restrictions-cannot-be-appli","canonical_anchor":"agent-refuses-spawns-whose-tool-restrictions-cannot-be-appli","heading":"agent() refuses spawns whose tool restrictions cannot be applied","tier":"notice","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227\/e\/agent-refuses-spawns-whose-tool-restrictions-cannot-be-appli","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227","markdown":"### agent() refuses spawns whose tool restrictions cannot be applied\n\nSpawning a sub-agent fails outright if its disallowed-tools list can't actually be applied.\n\n**What**\n\nWhen a workflow spawns a sub-agent, every entry in its `disallowedTools` list is now checked against the tools that agent would actually get. Anything that cannot be matched aborts the spawn with an explanation instead of quietly running the agent with the restriction dropped. Entries that parse fine but match nothing log a \"no-op here\" warning and the spawn continues.\n\n**Details**\n\n- rejected: a stray space before rule parentheses, unbalanced parentheses, an empty server name in an `mcp__` entry, wildcards inside an MCP server or tool name, and `*` used outside an `mcp__` spec\n- also rejected: entries that are not non-empty, non-whitespace-padded strings, and `bashCommandClamp` entries that do not parse as a Bash permission rule with real content\n- case-mismatched or misspelled MCP entries are caught by a new analyser that classifies each entry as a declared server, a server present in the pool, a near-miss with a suggested correct spelling, or unmatched\n\n**Evidence**\n\n`agent() opts.disallowedTools unparseable entry`, `Refusing the spawn rather than running it un-narrowed.`\n\n- Area: Subagents\n- Names: `disallowedTools`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}