fix(subagents): restrict delegation to configured profiles

Avoid advertising delegation without callable subagents and prevent skills
or invented profile names from being used as delegation targets.

Author: Motta Kin

internal/cli/repl/tooling/tool_registry.go

@@ -69,5 +69,14 @@ func SetupToolRegistry(
 		GetSkillsCatalog: appState.SkillsCatalog,
 		Activity:         activity,
 	}
-	appState.RegisterTool(tools.NewDelegateTool(runner))
+	profiles := appState.GetSubagents().Profiles
+	agentNames := make([]string, 0, len(profiles))
+	for _, profile := range profiles {
+		if !profile.Hidden {
+			agentNames = append(agentNames, profile.Name)
+		}
+	}
+	if len(agentNames) > 0 {
+		appState.RegisterTool(tools.NewDelegateTool(runner, agentNames))
+	}
 }

internal/cli/repl/tooling/tool_registry_test.go

@@ -0,0 +1,82 @@
+package tooling
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	replappstate "github.com/user/keen-code/internal/cli/repl/appstate"
+	replpermissions "github.com/user/keen-code/internal/cli/repl/permissions"
+	"github.com/user/keen-code/internal/config"
+)
+
+func TestSetupToolRegistryOmitsDelegateToolWithoutProfiles(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	workingDir := t.TempDir()
+	state := replappstate.New(nil, workingDir)
+
+	SetupToolRegistry(
+		workingDir,
+		state,
+		replpermissions.NewAutoApproveRequester(),
+		NewDiffEmitter(),
+		nil,
+		&config.ResolvedConfig{Model: "model"},
+		config.DefaultGlobalConfig(),
+		nil,
+	)
+
+	if _, ok := state.GetToolRegistry().Get("delegate_task"); ok {
+		t.Fatal("delegate_task should not be registered without subagent profiles")
+	}
+}
+
+func TestSetupToolRegistryRegistersDelegateToolForVisibleProfiles(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	workingDir := t.TempDir()
+	agentsDir := filepath.Join(workingDir, ".agents", "agents")
+	if err := os.MkdirAll(agentsDir, 0o755); err != nil {
+		t.Fatalf("create agents directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(agentsDir, "worker.md"), []byte(`---
+name: worker
+description: Handles focused work.
+---
+`), 0o644); err != nil {
+		t.Fatalf("write visible profile: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(agentsDir, "hidden.md"), []byte(`---
+name: hidden
+description: Hidden work.
+hidden: true
+---
+`), 0o644); err != nil {
+		t.Fatalf("write hidden profile: %v", err)
+	}
+
+	state := replappstate.New(nil, workingDir)
+	SetupToolRegistry(
+		workingDir,
+		state,
+		replpermissions.NewAutoApproveRequester(),
+		NewDiffEmitter(),
+		nil,
+		&config.ResolvedConfig{Model: "model"},
+		config.DefaultGlobalConfig(),
+		nil,
+	)
+
+	tool, ok := state.GetToolRegistry().Get("delegate_task")
+	if !ok {
+		t.Fatal("delegate_task should be registered with a visible profile")
+	}
+
+	properties := tool.InputSchema()["properties"].(map[string]any)
+	tasks := properties["tasks"].(map[string]any)
+	items := tasks["items"].(map[string]any)
+	agent := items["properties"].(map[string]any)["agent"].(map[string]any)
+	if !reflect.DeepEqual(agent["enum"], []string{"worker"}) {
+		t.Fatalf("agent enum = %#v, want [worker]", agent["enum"])
+	}
+}

internal/subagents/discover.go

@@ -90,6 +90,7 @@ func Catalog(profiles []Profile) string {
 	var sb strings.Builder
 	sb.WriteString("## Available Subagents\n\n")
 	sb.WriteString("You can delegate up to 10 bounded tasks to named subagents and run them in parallel. ")
+	sb.WriteString("Only the profile names listed below are valid delegate_task agents. Skills are not subagents; do not use a skill name as an agent name. ")
 	sb.WriteString("Use a subagent only when the work can be handed off as a self-contained task with a clear objective. ")
 	sb.WriteString("Choose profiles according to their descriptions and configured capabilities, and pass relevant paths, inputs, constraints, and expected results. ")
 	sb.WriteString("Each delegated task is a one-shot run: you cannot ask the child follow-up questions or resume its context, so include everything needed in the initial task. ")

internal/subagents/discover_test.go

@@ -83,6 +83,8 @@ func TestCatalogSupportsCapableWorkerProfiles(t *testing.T) {
 	}})
 	for _, expected := range []string{
 		"up to 10 bounded tasks",
+		"Only the profile names listed below are valid delegate_task agents",
+		"Skills are not subagents",
 		"descriptions and configured capabilities",
 		"relevant paths, inputs, constraints, and expected results",
 		"one-shot run",

internal/tools/delegate_tool.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
+	"strings"
 	"sync"
 )
 
@@ -14,7 +16,8 @@ type SubagentRunner interface {
 const maxDelegateTasks = 10
 
 type DelegateTool struct {
-	runner SubagentRunner
+	runner      SubagentRunner
+	namedAgents []string
 }
 
 type delegateInput struct {
@@ -32,8 +35,11 @@ type delegateResult struct {
 	Error  string `json:"error,omitempty"`
 }
 
-func NewDelegateTool(runner SubagentRunner) *DelegateTool {
-	return &DelegateTool{runner: runner}
+func NewDelegateTool(runner SubagentRunner, namedAgents []string) *DelegateTool {
+	return &DelegateTool{
+		runner:      runner,
+		namedAgents: normalizedAgentNames(namedAgents),
+	}
 }
 
 func (t *DelegateTool) Name() string {
@@ -60,7 +66,8 @@ func (t *DelegateTool) InputSchema() map[string]any {
 					"properties": map[string]any{
 						"agent": map[string]any{
 							"type":        "string",
-							"description": "Name of the subagent profile to run.",
+							"enum":        append([]string(nil), t.namedAgents...),
+							"description": "Name of the subagent profile to run. Use only one of the listed profile names; skills are not subagents.",
 						},
 						"task": map[string]any{
 							"type":        "string",
@@ -74,8 +81,11 @@ func (t *DelegateTool) InputSchema() map[string]any {
 }
 
 func (t *DelegateTool) ValidateInput(_ context.Context, input any) error {
-	_, err := parseDelegateInput(input)
-	return err
+	parsed, err := parseDelegateInput(input)
+	if err != nil {
+		return err
+	}
+	return t.validateAgents(parsed)
 }
 
 func (t *DelegateTool) Execute(ctx context.Context, input any) (any, error) {
@@ -86,6 +96,9 @@ func (t *DelegateTool) Execute(ctx context.Context, input any) (any, error) {
 	if err != nil {
 		return nil, err
 	}
+	if err := t.validateAgents(parsed); err != nil {
+		return nil, err
+	}
 
 	results := make([]delegateResult, len(parsed.Tasks))
 	counts := make(map[string]int, len(parsed.Tasks))
@@ -127,6 +140,35 @@ func (t *DelegateTool) Execute(ctx context.Context, input any) (any, error) {
 	}, nil
 }
 
+func (t *DelegateTool) validateAgents(parsed delegateBatchInput) error {
+	for i, task := range parsed.Tasks {
+		if !containsAgent(t.namedAgents, task.Agent) {
+			return fmt.Errorf("invalid input: tasks[%d].agent must be one of: %s", i, strings.Join(t.namedAgents, ", "))
+		}
+	}
+	return nil
+}
+
+func normalizedAgentNames(agentNames []string) []string {
+	seen := make(map[string]bool, len(agentNames))
+	result := make([]string, 0, len(agentNames))
+	for _, name := range agentNames {
+		name = strings.TrimSpace(name)
+		if name == "" || seen[name] {
+			continue
+		}
+		seen[name] = true
+		result = append(result, name)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func containsAgent(agentNames []string, agent string) bool {
+	index := sort.SearchStrings(agentNames, agent)
+	return index < len(agentNames) && agentNames[index] == agent
+}
+
 func parseDelegateInput(input any) (delegateBatchInput, error) {
 	var parsed delegateBatchInput
 	params, ok := input.(map[string]any)

internal/tools/delegate_tool_test.go

@@ -52,7 +52,7 @@ func (m *mockSubagentRunner) recordedCalls() []delegateCall {
 }
 
 func TestDelegateTool_Metadata(t *testing.T) {
-	tool := NewDelegateTool(&mockSubagentRunner{})
+	tool := NewDelegateTool(&mockSubagentRunner{}, []string{"explorer", "implementer"})
 
 	if tool.Name() != "delegate_task" {
 		t.Fatalf("Name() = %q, want %q", tool.Name(), "delegate_task")
@@ -63,7 +63,7 @@ func TestDelegateTool_Metadata(t *testing.T) {
 }
 
 func TestDelegateTool_InputSchema(t *testing.T) {
-	tool := NewDelegateTool(&mockSubagentRunner{})
+	tool := NewDelegateTool(&mockSubagentRunner{}, []string{"explorer", "implementer"})
 	schema := tool.InputSchema()
 
 	if schema["type"] != "object" {
@@ -95,11 +95,15 @@ func TestDelegateTool_InputSchema(t *testing.T) {
 	if _, ok := itemProperties["timeout_seconds"]; ok {
 		t.Fatal("item properties should not include timeout_seconds")
 	}
+	agent := itemProperties["agent"].(map[string]any)
+	if !reflect.DeepEqual(agent["enum"], []string{"explorer", "implementer"}) {
+		t.Fatalf("agent enum = %#v, want [explorer implementer]", agent["enum"])
+	}
 }
 
 func TestDelegateTool_ExecutePassesTasksToRunner(t *testing.T) {
 	runner := &mockSubagentRunner{result: map[string]any{"status": "completed"}}
-	tool := NewDelegateTool(runner)
+	tool := NewDelegateTool(runner, []string{"explorer", "implementer"})
 
 	result, err := tool.Execute(context.Background(), delegateTasks(
 		map[string]any{"agent": "explorer", "task": "Inspect internal/tools."},
@@ -133,7 +137,7 @@ func TestDelegateTool_ExecutePassesTasksToRunner(t *testing.T) {
 
 func TestDelegateTool_AssignsPerAgentInstancePositions(t *testing.T) {
 	runner := &mockSubagentRunner{}
-	tool := NewDelegateTool(runner)
+	tool := NewDelegateTool(runner, []string{"explorer", "implementer"})
 	_, err := tool.Execute(context.Background(), delegateTasks(
 		map[string]any{"agent": "explorer", "task": "inspect"},
 		map[string]any{"agent": "implementer", "task": "one"},
@@ -168,7 +172,7 @@ func TestDelegateTool_ExecuteRunsTasksInParallel(t *testing.T) {
 		started: make(chan struct{}, taskCount),
 		release: make(chan struct{}),
 	}
-	tool := NewDelegateTool(runner)
+	tool := NewDelegateTool(runner, []string{"explorer", "implementer"})
 	done := make(chan error, 1)
 
 	go func() {
@@ -199,7 +203,7 @@ func TestDelegateTool_ExecuteReturnsPerTaskErrors(t *testing.T) {
 		result: map[string]any{"status": "error"},
 		err:    wantErr,
 	}
-	tool := NewDelegateTool(runner)
+	tool := NewDelegateTool(runner, []string{"explorer", "implementer"})
 
 	result, err := tool.Execute(context.Background(), delegateTasks(
 		map[string]any{"agent": "explorer", "task": "Inspect docs."},
@@ -241,12 +245,13 @@ func TestDelegateTool_ValidateInputRejectsInvalidInput(t *testing.T) {
 		{name: "too many tasks", input: map[string]any{"tasks": tooMany}, wantErr: "at most 10 tasks"},
 		{name: "missing agent", input: delegateTasks(map[string]any{"task": "Inspect docs."}), wantErr: "tasks[0].agent"},
 		{name: "missing task", input: delegateTasks(map[string]any{"agent": "explorer"}), wantErr: "tasks[0].task"},
+		{name: "unknown agent", input: delegateTasks(map[string]any{"agent": "reviewer", "task": "Review changes."}), wantErr: "must be one of: explorer, implementer"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			runner := &mockSubagentRunner{}
-			tool := NewDelegateTool(runner)
+			tool := NewDelegateTool(runner, []string{"explorer", "implementer"})
 
 			err := tool.ValidateInput(context.Background(), tt.input)
 			if err == nil {
@@ -262,8 +267,23 @@ func TestDelegateTool_ValidateInputRejectsInvalidInput(t *testing.T) {
 	}
 }
 
+func TestDelegateTool_ExecuteRejectsUnknownAgent(t *testing.T) {
+	runner := &mockSubagentRunner{}
+	tool := NewDelegateTool(runner, []string{"explorer"})
+
+	_, err := tool.Execute(context.Background(), delegateTasks(
+		map[string]any{"agent": "reviewer", "task": "Review changes."},
+	))
+	if err == nil || !strings.Contains(err.Error(), "must be one of: explorer") {
+		t.Fatalf("Execute() error = %v, want unknown-agent validation error", err)
+	}
+	if len(runner.recordedCalls()) != 0 {
+		t.Fatal("runner should not be called for an unknown agent")
+	}
+}
+
 func TestDelegateTool_ExecuteRejectsMissingRunner(t *testing.T) {
-	tool := NewDelegateTool(nil)
+	tool := NewDelegateTool(nil, []string{"explorer"})
 
 	_, err := tool.Execute(context.Background(), delegateTasks(
 		map[string]any{"agent": "explorer", "task": "Inspect docs."},