{"version":"2.1.227","anchor":"subagents-can-be-locked-to-a-fixed-list-of-bash-commands","canonical_anchor":"subagents-can-be-locked-to-a-fixed-list-of-bash-commands","heading":"Subagents can be locked to a fixed list of Bash commands","tier":"use","area":"Subagents","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227\/e\/subagents-can-be-locked-to-a-fixed-list-of-bash-commands","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227","markdown":"### Subagents can be locked to a fixed list of Bash commands\n\nWorkflow scripts can restrict a spawned agent's shell to a fixed list of allowed commands.\n\n**What**\n\nWorkflow scripts can pass `agent(prompt, {bashCommandClamp: [...]})`, a list of `Bash(<command or prefix>)` rules that the spawned agent's shell use is restricted to. Any Bash call not matching every clamp group is denied with \"bashCommandClamp: no clamp rule matches this command\", and a command whose structure cannot be taken apart (command substitution, control flow) is denied as unverifiable.\n\n**Details**\n\n- The clamp becomes a permission layer of its own, merged into the tool permission context, on top of the usual allow and deny rules.\n- Malformed or inert clamp entries refuse the spawn outright rather than quietly running the agent unclamped.\n- None of this existed in 2.1.226.\n\n**Evidence**\n\n`agent() opts.bashCommandClamp must be an array of non-empty strings`\n\n- Area: Subagents\n- Names: `bashCommandClamp`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}