1 00:00:00,220 --> 00:00:00,920 Morning, everyone. 2 00:00:01,700 --> 00:00:06,380 This one's brought to you by Jellypod AI, and it's a good one if you've ever watched 3 00:00:06,440 --> 00:00:11,020 a subagent wander off and start poking at files it had no business touching. 4 00:00:12,040 --> 00:00:17,420 Last time we covered custom model deployment names and subagent compaction settings 5 00:00:17,480 --> 00:00:19,600 in 2.1.312. 6 00:00:20,360 --> 00:00:26,180 Version 2.1.313 keeps going on subagents, but this time it's about what they can 7 00:00:26,260 --> 00:00:27,940 touch and what they can see. 8 00:00:28,763 --> 00:00:28,983 Right. 9 00:00:29,423 --> 00:00:30,103 Two changes. 10 00:00:30,603 --> 00:00:34,503 First, subagent definitions now take an explicit tools list, 11 00:00:34,763 --> 00:00:36,603 plus a disallowedTools list. 12 00:00:37,163 --> 00:00:40,763 That lives in your agent definitions under the claude agents folder, 13 00:00:41,263 --> 00:00:43,223 or in inline agent registrations. 14 00:00:44,063 --> 00:00:47,783 Second, for headless and CI runs, there's a new environment variable, 15 00:00:48,303 --> 00:00:53,563 CLAUDE_CODE_SUBAGENT_ENV_ALLOWLIST, and a matching flag called env passthrough. 16 00:00:54,143 --> 00:00:57,383 That one controls which environment variables reach worker agents. 17 00:00:58,375 --> 00:00:59,775 So here's why that matters. 18 00:01:00,335 --> 00:01:06,195 Before this, subagents inherited the native tools and the MCP tools pretty broadly. 19 00:01:06,875 --> 00:01:11,715 If you wanted a reviewer that only reads code, you were leaning on a system prompt 20 00:01:11,795 --> 00:01:16,435 saying please don't edit anything, or on a pile of manual permission rules. 21 00:01:17,135 --> 00:01:20,035 That's a bit like asking a dog nicely not to get on the couch. 22 00:01:21,255 --> 00:01:22,915 Now you can just take the couch away. 23 00:01:23,737 --> 00:01:25,897 And the example from the release is a good template. 24 00:01:26,397 --> 00:01:29,017 You make a reviewer agent in its own JSON file. 25 00:01:29,577 --> 00:01:32,877 Pick a small, cheap model, a Haiku model works fine for this. 26 00:01:33,537 --> 00:01:36,517 Then set tools to Read, Grep, and Glob. 27 00:01:36,937 --> 00:01:40,217 And set disallowedTools to Bash, Write, and Edit. 28 00:01:40,957 --> 00:01:43,737 That agent can look at your code and search it, and that's it. 29 00:01:44,277 --> 00:01:46,857 It can't run a shell command, and it can't modify a file. 30 00:01:47,313 --> 00:01:49,973 The behavior when it tries is worth knowing. 31 00:01:50,553 --> 00:01:55,493 If that subagent reaches for a disallowed tool, it fails right away with an error 32 00:01:55,633 --> 00:01:56,773 local to that agent. 33 00:01:57,353 --> 00:02:00,353 You don't get a permission prompt popping up in your main terminal. 34 00:02:01,073 --> 00:02:04,853 So when you've got a few subagents running in parallel under an orchestrator, 35 00:02:05,313 --> 00:02:08,132 one of them hitting a wall doesn't stop you mid-flow. 36 00:02:08,860 --> 00:02:10,520 There are two practical wins here. 37 00:02:11,020 --> 00:02:12,540 One is blast radius. 38 00:02:12,940 --> 00:02:16,740 If a worker agent gets confused, or picks up something odd from a file it read, 39 00:02:17,200 --> 00:02:21,720 a read only toolset means it can't run arbitrary Bash or make destructive changes. 40 00:02:22,320 --> 00:02:23,540 The other is tokens. 41 00:02:23,960 --> 00:02:28,520 Filtering out tool schemas a subagent never uses cuts the system prompt overhead for 42 00:02:28,560 --> 00:02:29,280 that subagent. 43 00:02:29,800 --> 00:02:32,000 The notes say by thousands of tokens per turn. 44 00:02:32,440 --> 00:02:36,000 That should mean faster subagent startup and a lower API bill, 45 00:02:36,240 --> 00:02:38,540 especially if you've got a lot of MCP servers connected. 46 00:02:39,428 --> 00:02:43,288 Now the headless side, because this one's a quiet security fix. 47 00:02:43,928 --> 00:02:49,828 In CI, parent secrets and dev server tokens were leaking indiscriminately into 48 00:02:49,888 --> 00:02:51,408 worker agent environments. 49 00:02:52,128 --> 00:02:53,928 Now you say exactly what comes through. 50 00:02:54,568 --> 00:02:58,708 The example is claude, with the permission mode flag set to auto, 51 00:02:59,288 --> 00:03:06,288 then env passthrough with NPM_TOKEN and GITHUB_TOKEN separated by a comma, 52 00:03:06,928 --> 00:03:10,528 then the print flag with the prompt, Run static checks. 53 00:03:11,348 --> 00:03:12,808 Those two tokens go through. 54 00:03:13,248 --> 00:03:16,288 Anything else in the parent environment stays out of the workers. 55 00:03:16,850 --> 00:03:22,750 If you'd rather set it once, that's what CLAUDE_CODE_SUBAGENT_ENV_ALLOWLIST is for. 56 00:03:23,290 --> 00:03:27,110 Put it in your CI config and every headless run follows the same rule, 57 00:03:27,290 --> 00:03:28,930 so nobody has to remember the flag. 58 00:03:29,470 --> 00:03:32,910 Practical tip: start with an empty list, run your pipeline, 59 00:03:33,030 --> 00:03:34,910 and add only what actually fails. 60 00:03:35,390 --> 00:03:38,190 That's the least privilege version, and it's easy to audit later. 61 00:03:38,868 --> 00:03:39,428 Two gotchas. 62 00:03:39,848 --> 00:03:43,728 First, if an agent asks for a tool that's not on the allowlist, 63 00:03:44,208 --> 00:03:46,008 it gets an immediate error turn. 64 00:03:46,648 --> 00:03:50,228 If your system prompt doesn't tell it what to do next, it can loop, 65 00:03:50,548 --> 00:03:52,748 trying near variants of the same tool. 66 00:03:53,328 --> 00:03:57,708 So add a line like: if a tool is unavailable, report that and stop. 67 00:03:58,568 --> 00:04:04,228 Second, disallowedTools wins over approvals in your global settings dot json 68 00:04:04,268 --> 00:04:04,748 permissions. 69 00:04:05,348 --> 00:04:09,108 So if you've approved Bash globally and denied it on one agent, 70 00:04:09,508 --> 00:04:11,208 the agent's denial holds. 71 00:04:12,107 --> 00:04:15,127 A few smaller fixes in 2.1.313 too. 72 00:04:15,607 --> 00:04:19,387 Nested Git worktrees now inherit the parent directory's claudeignore file, 73 00:04:19,847 --> 00:04:21,606 so ignored paths stay ignored. 74 00:04:22,087 --> 00:04:25,967 The status bar now shows active subagent tool counts and how long they've been 75 00:04:26,007 --> 00:04:28,907 running, which is handy for checking your filters actually applied. 76 00:04:29,507 --> 00:04:33,407 And ANSI escape sequences in subagent error output are sanitized, 77 00:04:33,567 --> 00:04:35,887 which stops terminal corruption in Windows PowerShell. 78 00:04:36,670 --> 00:04:42,090 So, your homework: pick one subagent you already use, strip it down to the tools it 79 00:04:42,170 --> 00:04:45,270 really needs, and check the status bar for the tool count. 80 00:04:45,870 --> 00:04:48,270 Then lock down your CI environment list. 81 00:04:49,110 --> 00:04:49,730 Catch you tomorrow.