fix: protect global agent config defaults

pgondhi987 · pgondhi987 · commit 92286108b12c · 2026-06-04T03:30:00.000Z
diff --git a/docs/gateway/security/index.md b/docs/gateway/security/index.md
@@ -512,9 +512,10 @@ The agent-facing `gateway` runtime tool still refuses to rewrite
 `tools.exec.ask` or `tools.exec.security`; legacy `tools.bash.*` aliases are
 normalized to the same protected exec paths before the write.
 Agent-driven `gateway config.apply` and `gateway config.patch` edits are
-fail-closed by default: only a narrow set of prompt, model, and mention-gating
-paths are agent-tunable. New sensitive config trees are therefore protected
-unless they are deliberately added to the allowlist.
+fail-closed by default: only a narrow set of low-risk runtime tuning,
+mention-gating, and visible-reply paths are agent-tunable. Global model defaults
+and prompt overlays stay operator-controlled. New sensitive config trees are
+therefore protected unless they are deliberately added to the allowlist.
 
 For any agent/surface that handles untrusted content, deny these by default:
 
diff --git a/src/agents/tools/gateway-tool-guard-coverage.test.ts b/src/agents/tools/gateway-tool-guard-coverage.test.ts
@@ -58,8 +58,8 @@ function expectAllowedApply(
 
 describe("gateway config mutation guard coverage", () => {
   it("keeps a narrow allowlist of agent-tunable config paths", () => {
-    expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).toContain("agents.defaults.promptOverlays");
-    expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).toContain("agents.defaults.model");
+    expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).not.toContain("agents.defaults.promptOverlays");
+    expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).not.toContain("agents.defaults.model");
     expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).toContain("agents.defaults.subagents.thinking");
     expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).toContain("agents.list[].id");
     expect(ALLOWED_GATEWAY_CONFIG_PATHS_FOR_TEST).toContain("agents.list[].model");
@@ -72,6 +72,20 @@ describe("gateway config mutation guard coverage", () => {
     );
   });
 
+  it("blocks global prompt overlay edits via config.patch", () => {
+    expectBlocked(
+      { agents: { defaults: { promptOverlays: { gpt5: { personality: "off" } } } } },
+      { agents: { defaults: { promptOverlays: { gpt5: { personality: "best" } } } } },
+    );
+  });
+
+  it("blocks global default model edits via config.patch", () => {
+    expectBlocked(
+      { agents: { defaults: { model: { primary: "openai/gpt-5.4" } } } },
+      { agents: { defaults: { model: { primary: "openai/gpt-5.5" } } } },
+    );
+  });
+
   it("allows documented subagent thinking default edits via config.patch", () => {
     expectAllowed(
       {},
@@ -546,6 +560,29 @@ describe("gateway config mutation guard coverage", () => {
     );
   });
 
+  it("blocks config.apply replacing global prompt and model defaults", () => {
+    expectBlockedApply(
+      {
+        agents: {
+          defaults: {
+            model: { primary: "openai/gpt-5.4" },
+            promptOverlays: { gpt5: { personality: "off" } },
+            reasoningDefault: "low",
+          },
+        },
+      },
+      {
+        agents: {
+          defaults: {
+            model: { primary: "openai/gpt-5.5" },
+            promptOverlays: { gpt5: { personality: "best" } },
+            reasoningDefault: "medium",
+          },
+        },
+      },
+    );
+  });
+
   it("blocks config.apply duplicate-id protected rewrites", () => {
     expectBlockedApply(
       {
diff --git a/src/agents/tools/gateway-tool.ts b/src/agents/tools/gateway-tool.ts
@@ -40,9 +40,7 @@ const CONFIG_SCHEMA_PATH_NOT_FOUND_MESSAGE = "config schema path not found";
 // trust-boundary control on `config.apply`/`config.patch`, so the runtime tool
 // must fail closed and allow only a narrow set of agent-tunable paths.
 const ALLOWED_GATEWAY_CONFIG_PATHS = [
-  // Agent prompt/model tuning.
-  "agents.defaults.promptOverlays",
-  "agents.defaults.model",
+  // Low-risk agent runtime tuning.
   "agents.defaults.thinkingDefault",
   "agents.defaults.subagents.thinking",
   "agents.defaults.reasoningDefault",
