fix(subagent): apply trust-level filtering in filter_skills - #6715
Merged
Conversation
zeph_subagent::filter_skills applied only glob include/exclude patterns, returning Quarantined and Blocked skills identically to Trusted ones. filtered_skills_for injects those bodies directly and unconditionally into a freshly-spawned sub-agent's system prompt, with no catalog/ annotation surface to fall back on. filter_skills now drops Quarantined/Blocked skills (mirroring the main agent's D1 activation filter), logging a warning per exclusion. A skill absent from the trust map still falls back to Trusted. filtered_skills_for now resolves the trust map fresh on every call instead of reading a cache that is never populated on the slash-command/ @mention spawn path, where the fix would otherwise have been inert. Closes #6713
bug-ops
enabled auto-merge (squash)
July 28, 2026 21:21
github-actions
Bot
added
bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
zeph_subagent::filter_skillsapplied only glob include/exclude patterns —QuarantinedandBlockedskills were returned identically toTrusted/Verifiedones.filtered_skills_forinjects those bodies directly and unconditionally into a freshly-spawned sub-agent's system prompt, with no catalog/annotation surface to fall back on (unlike the main agent's<other_skills>catalog).filter_skillsnow takes a&HashMap<String, zeph_common::SkillTrustLevel>and drops any skill whose resolved trust isQuarantined/Blocked, logging a warning per exclusion — mirroring the main agent's D1 activation filter (filter_active_skills_by_trust, Proactively-matched Quarantined skill locks the whole turn (and every spawned subagent) out of bash/write/MCP tools #6701). A skill absent from the trust map still falls back toTrusted.filtered_skills_foris nowasyncand resolves the trust map fresh viabuild_skill_trust_mapon every call instead of reading atrust_snapshotcache that is never populated on the slash-command/@mentionspawn path — the initial fix was otherwise inert there (caught by impl-critic review, see commit history / review discussion).filter_skills(apubcrate-root re-export ofzeph-subagent) gained a required third parameter.Closes #6713
Test plan
cargo +nightly fmt --checkcargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warningscargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins— 15320 passed, 0 failedRUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler")cargo test --doc -p zeph-subagent— 32 passedfilter.rs, end-to-end body-injection test insubagent_commands.rsvia a real DB-backed trust row[Unreleased]/Fixed).local/testing/playbooks/subagent-skill-trust-filter.md)