What
Workflow scripts can pass agent(prompt, {bashCommandClamp: [...]}), a list of Bash(<command or prefix>) rules that the spawned agent's shell use is restricted to. Any Bash call not matching every clamp group is denied with "bashCommandClamp: no clamp rule matches this command", and a command whose structure cannot be taken apart (command substitution, control flow) is denied as unverifiable.
Details
- The clamp becomes a permission layer of its own, merged into the tool permission context, on top of the usual allow and deny rules.
- Malformed or inert clamp entries refuse the spawn outright rather than quietly running the agent unclamped.
- None of this existed in 2.1.226.
Evidence
agent() opts.bashCommandClamp must be an array of non-empty strings
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlebashCommandClamp