openclaw/src/agents/subagent-control.test.ts
Vincent Koc 7679eb3752
Subagents: restrict follow-up messaging scope (#46801)
* Subagents: restrict follow-up messaging scope

* Subagents: cover foreign-session follow-up sends

* Update CHANGELOG.md
2026-03-15 09:44:51 -07:00

39 lines
1.3 KiB
TypeScript

import { describe, expect, it } from "vitest";
import type { OpenClawConfig } from "../config/config.js";
import { sendControlledSubagentMessage } from "./subagent-control.js";
describe("sendControlledSubagentMessage", () => {
it("rejects runs controlled by another session", async () => {
const result = await sendControlledSubagentMessage({
cfg: {
channels: { whatsapp: { allowFrom: ["*"] } },
} as OpenClawConfig,
controller: {
controllerSessionKey: "agent:main:subagent:leaf",
callerSessionKey: "agent:main:subagent:leaf",
callerIsSubagent: true,
controlScope: "children",
},
entry: {
runId: "run-foreign",
childSessionKey: "agent:main:subagent:other",
requesterSessionKey: "agent:main:main",
requesterDisplayKey: "main",
controllerSessionKey: "agent:main:subagent:other-parent",
task: "foreign run",
cleanup: "keep",
createdAt: Date.now() - 5_000,
startedAt: Date.now() - 4_000,
endedAt: Date.now() - 1_000,
outcome: { status: "ok" },
},
message: "continue",
});
expect(result).toEqual({
status: "forbidden",
error: "Subagents can only control runs spawned from their own session.",
});
});
});