Greptile Summary

This PR fixes a security boundary gap where /focus could bind conversations to sessions outside a leaf subagent's allowed control scope. It adds a resolveCommandSubagentController call at the top of handleSubagentsFocusAction to reject callers with controlScope !== "children", and threads a requesterKey into resolveFocusTargetSession so the gateway sessions.resolve fallback is filtered via spawnedBy for subagent callers.

The previously flagged concern about the runs-based resolution path bypassing the new spawnedBy filter is mitigated: ctx.runs is populated by listControlledSubagentRuns(requesterKey), which already filters to direct children of the requester, so entries in that list cannot refer to non-child sessions. No P0/P1 issues found.

Confidence Score: 5/5

Safe to merge — the fix correctly enforces the subagent control-scope boundary on /focus, matching the enforcement already present on other subagent-control commands.

No P0 or P1 findings. The runs-based path that was flagged in a prior review is already scoped by listControlledSubagentRuns, which filters to direct children. The gateway fallback is now correctly guarded by spawnedBy. All existing and new tests pass.

No files require special attention.

_{Reviews (2): Last reviewed commit: "docs: add changelog for focus scope fix" | Re-trigger Greptile}

Codex review: needs maintainer review before merge.

What this changes:

The PR branch adds a /focus subagent controller-scope check, threads requester scope into focus target resolution for spawnedBy-filtered gateway fallback, and adds focused tests plus a changelog entry.

Maintainer follow-up before merge:

This is an open security-hardening implementation PR with a protected label and pending/relevant review context, so the next action is maintainer/security review rather than an automated replacement or cleanup close.

Best possible solution:

Land a reviewed fix that applies the same subagent control-scope boundary to /focus, confirms both local-runs and gateway fallback resolution paths cannot target non-child sessions, keeps focused regression coverage, and retains the user-facing changelog entry if the behavior change ships.

Acceptance criteria:

• pnpm test src/auto-reply/reply/commands-subagents-focus.test.ts src/auto-reply/reply/commands-subagents-shared-focus.test.ts
• pnpm check:changed in Testbox before merge if the PR remains code/test/changelog only and the changed lane stays appropriate

What I checked:

• Protected label: The provided GitHub context shows this open PR carries the maintainer label, which is protected by the cleanup policy and requires explicit maintainer handling.
• Current main focus handler lacks the new scope check: On current main, handleSubagentsFocusAction resolves the binding context and binding service before target resolution, and calls resolveFocusTargetSession({ runs, token }) without resolveCommandSubagentController or a requester key. (src/auto-reply/reply/commands-subagents/action-focus.ts:74, b92d14525262)
• Current main target resolver fallback is unscoped: resolveFocusTargetSession on current main accepts only runs and token; its gateway fallback calls sessions.resolve with the raw attempt params and no spawnedBy visibility filter. (src/auto-reply/reply/commands-subagents/shared.ts:307, b92d14525262)
• Existing control boundary pattern: Other subagent-control commands already resolve a controller and delegate to control helpers that reject non-children control scope with Leaf subagents cannot control other sessions.. (src/auto-reply/reply/commands-subagents/action-send.ts:37, b92d14525262)
• Runs path context: Current main builds command ctx.runs from listControlledSubagentRuns(requesterKey), and that helper filters latest runs by controller session key, which is relevant to the Greptile review question about the runs-based path. (src/auto-reply/reply/commands-subagents.ts:125, b92d14525262)
• Gateway spawnedBy contract exists: sessions.resolve already supports spawnedBy visibility filtering for key, sessionId, and label resolution, with tests covering key-based visibility filtering. (src/gateway/sessions-resolve.ts:55, b92d14525262)

Likely related people:

• steipete: Local current-main blame attributes the affected subagent command/control files to Peter Steinberger's compact import commit, and recent adjacent subagent registry maintenance is also by Peter. The local history is compact, so this is routing evidence rather than root-cause attribution. (role: current-main maintainer / likely follow-up owner; confidence: medium; commits: 7a69069bfca1, b7db63751b99; files: src/auto-reply/reply/commands-subagents/action-focus.ts, src/auto-reply/reply/commands-subagents/shared.ts, src/agents/subagent-control.ts)
• samzong: Recent shipped work surfaced spawnedBy in gateway chat/agent event metadata, which is adjacent to the visibility and routing metadata used by this PR, though not the /focus handler itself. (role: adjacent spawnedBy metadata contributor; confidence: low; commits: 443ca4865d61; files: src/gateway/protocol/schema/agent.ts, src/gateway/protocol/schema/logs-chat.ts, src/gateway/server-chat.ts)

Remaining risk / open question:

• Protected maintainer labeling and security-hardening scope require explicit maintainer/security judgment before merge or cleanup closure.
• Aisle's security review was still in progress in the provided comments, and Greptile's runs-based resolution question should be answered explicitly before landing.
• This read-only review did not execute tests; validation remains part of PR review.

Codex review notes: model gpt-5.5, reasoning high; reviewed against b92d14525262.

@greptile review
@codex review

To use Codex here, create a Codex account and connect to github.