spawn 的 list/wait/cancel 缺少 session 隔离，存在跨会话泄露和误杀

[fanchen777]

问题

全局唯一 SubagentManager（cmd/gateway.go:307）的内存 map 混放所有 agent/用户/会话的子任务，list/wait 只按父 agent key 过滤，不看 session。且 cancel id="all"（subagent_control.go:49）遍历整个 map，跨 agent 全杀。而 OriginSessionKey 在 spawn 时已记录（subagent_spawn.go:89），却没被用于过滤。

风险

chat B 的 list 能看到 chat A 的任务（含任务文本前 60 字符）；wait 会被 A 的任务阻塞
cancel id="all" 误杀全进程所有运行中的子任务
open agent 一个 agent 服务多用户：用户 B 可读到用户 A 的任务文本，跨用户信息泄露

修复建议

list/wait/cancel 按 OriginSessionKey 过滤（字段已存在，改动仅涉及 subagent_control.go 和 subagent_spawn_tool_actions.go）。

[clark-cant]

Maintainer triagennVerdict: confirmed security/isolation bug (high value).nnThe current in-memory task authorization scope checks tenant + root agent identity, but not the originating session. OriginSessionKey is already captured at spawn time, yet it is not included in TaskScope or taskMatchesScope. As a result, two sessions using the same root agent can enumerate each other’s retained task summaries, wait on each other’s active work, and cancel id=all can cancel the other session’s active tasks.nnEvidence checkedn- internal/tools/subagent_spawn.go: stores OriginSessionKey from the caller context.n- internal/tools/context_keys.go: creates TaskScope with tenant/root-agent identity only.n- internal/tools/subagent_control.go: GetTask, ListTasks, CancelTask, and WaitForChildren all use that scope; the all path iterates every active task matching it.n- Existing tests reject another root tree, but do not cover two sessions of the same root agent.nnRecommended narrow fixn1. Carry the caller session key into the task-control scope and require it in task matching for interactive spawn operations.n2. Add regression coverage with two sessions under the same tenant/root agent: list/get/wait/cancel (including all) must not observe or control the other session’s task.n3. Preserve any intentionally cross-session manager/lifecycle cleanup paths by using an explicit administrative scope, rather than weakening interactive controls.nnThis is an authorization-boundary issue: task text is exposed in list output, so session isolation needs a blocking regression test before merge.

[clark-cant]

🔄 github-maintain follow-up (cron-safe)

This P1-high security issue has been confirmed and triaged since 2026-08-24 but remains unassigned with no fix PR after 13 days.

Current status:

• Severity: P1-high (cross-session data leak + unintended task cancellation)
• Fix scope: Narrow — add OriginSessionKey to TaskScope and filter in list/wait/cancel
• Risk: Any multi-user or multi-chat deployment is affected

Requesting: Assignment to a maintainer or volunteer. The fix is well-scoped (per the recommended narrow fix in the triage comment) and should include a regression test.

Posted by github-maintain automation — 2026-09-06T13:57Z

[clark-cant]

Security follow-up (cron-safe)nnRe-validated against current dev after merging the related delegate-list recovery work in #1546: the delegate path now uses an origin-chat-scoped SQL query, but this report concerns the separate interactive spawn controls and remains open.nnStatus: confirmed P1 security/isolation bug; no open fix PR found. The exposure remains an authorization-boundary issue because spawn task list output can disclose task summaries, while wait and cancel id=all can act across sessions sharing a root agent.nnRequired fix scope: carry a caller conversation boundary into the interactive spawn control scope and enforce it consistently for list, wait, and cancel (including all), with an explicit administrative path only where cross-session lifecycle management is intentional. Add regression tests for two sessions under one tenant/root agent covering non-enumeration, non-waiting, and non-cancellation across the boundary.nnThis remains unassigned; requesting an owner before the next release.nnPosted by github-maintain cron-safe automation