rhan-oai b6333bb1bb
Enforce subagent ownership across app-server inputs ( #40464 ) ...
## Why
Parent-owned Multi-Agent V2 subagents must remain controlled by their parent,
but several app-server endpoints could still mutate them directly.
## What changed
- Centralize the direct-input ownership check and apply it to turn injection,
MCP calls, reviews, compaction, rollback and revert, shell and Guardian
actions, realtime requests, and goal mutations.
- Enforce the same policy for goal mutations on unloaded threads while keeping
goal reads and turn interruption available.
- Document the affected endpoint behavior and continue exposing
`canAcceptDirectInput: false` for parent-owned subagents.
## Testing
- Cover direct-input rejection for both legacy and paginated thread history.
- Cover goal mutation ownership checks for unloaded V2 subagents, V1
subagents, and non-subagent V2 threads.
GitOrigin-RevId: 791b7af98490aed5eab4e672b90661acad11ec23
2026-08-24 19:44:14 +00:00
2026-07-29 13:53:15 +00:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-24 17:07:21 +00:00
2026-07-29 13:53:15 +00:00
2026-08-24 19:44:14 +00:00
2026-08-18 23:05:52 +00:00
2026-07-21 08:50:21 +00:00
2026-08-24 17:07:21 +00:00
2026-07-30 19:47:30 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-20 08:10:08 +00:00
2026-08-20 08:10:08 +00:00
2026-06-11 18:16:39 -07:00
2026-08-21 20:57:17 +00:00
2026-08-20 19:28:32 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-24 15:48:51 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 19:35:22 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-08-21 14:14:00 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-21 16:50:34 +00:00
2026-08-21 06:41:28 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 23:13:37 +00:00
2026-06-15 20:10:53 -07:00
2026-08-22 05:54:43 +00:00
2026-08-04 22:58:02 +00:00
2026-08-21 21:41:55 +00:00
2026-08-07 00:23:38 +00:00
2026-08-23 18:53:15 +00:00
2026-08-24 18:22:13 +00:00
2026-08-22 00:42:19 +00:00
2026-08-24 14:37:48 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-23 00:27:02 +00:00
2026-08-24 18:09:47 +00:00
2026-08-24 10:15:42 +00:00
2026-08-17 04:37:50 +00:00
2026-08-24 16:41:55 +00:00
2026-08-20 08:24:18 +00:00
2026-08-24 18:22:13 +00:00
2026-08-18 21:46:18 +00:00
2026-07-31 21:37:56 +00:00
2026-08-20 17:16:52 +00:00
2026-08-20 08:10:08 +00:00
2026-08-18 12:37:41 +00:00
2026-08-21 21:45:26 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-06-12 19:52:49 +00:00
2026-08-24 00:52:52 +00:00
2026-07-22 04:17:34 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 17:46:05 +00:00
2026-08-24 18:22:13 +00:00
2026-07-17 20:52:42 +00:00
2026-08-21 20:57:17 +00:00
2026-08-21 19:04:32 +00:00
2026-08-20 18:29:35 +00:00
2026-08-21 17:29:41 +00:00
2026-07-30 04:26:36 +00:00
2026-08-20 19:09:04 +00:00
2026-08-21 21:01:59 +00:00
2026-08-23 23:38:12 +00:00
2026-08-24 18:22:13 +00:00
2026-08-15 01:34:33 +00:00
2026-08-21 16:45:05 +00:00
2026-08-24 06:43:07 +00:00
2026-08-24 17:07:21 +00:00
2026-08-24 17:07:21 +00:00
2026-08-21 17:16:51 +00:00
2026-08-10 15:43:10 +00:00
2026-08-20 17:39:06 +00:00
2026-08-08 16:58:26 +00:00
2026-08-20 06:10:03 +00:00
2026-08-20 05:16:59 +00:00
2026-08-04 03:49:53 +00:00
2026-08-20 18:29:35 +00:00
2026-08-20 21:50:51 +00:00
2026-08-24 11:02:14 +00:00
2026-08-24 17:07:21 +00:00
2026-08-24 19:25:32 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-08-20 14:55:08 +00:00
2026-08-24 17:29:21 +00:00
2026-08-15 14:31:04 +00:00
2026-07-09 17:31:44 -07:00
2026-08-24 01:50:53 +00:00
2026-08-21 19:04:32 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 22:00:25 +00:00
rhan-oai
b6333bb1bb