@lucashca/claudecontrol 0.3.28 → 0.3.30

package/backend/agents/canUseTool.ts

@@ -43,8 +43,13 @@ export function createBypassCanUseTool(agentId: string, workspaceId: string) {
  * Creates canUseTool for default (secure) mode.
  * Shows permission prompt in the frontend and waits for user response.
  */
-export function createCanUseTool(agentId: string, workspaceId: string) {
+export function createCanUseTool(agentId: string, workspaceId: string, isOrchestrator = false) {
   return (toolName: string, input: Record<string, unknown>, options: CanUseToolOptions) => {
+    if (toolName === 'Task' && !isOrchestrator) {
+      const session = agents.get(agentId);
+      if (session) pushLog(session, { type: 'system', text: 'Subagente bloqueado: apenas orquestradores podem iniciar subagentes', timestamp: new Date().toISOString() });
+      return Promise.resolve({ behavior: 'deny' as const, message: 'Apenas orquestradores podem iniciar subagentes' });
+    }
     const requestId = genId();
     const session = agents.get(agentId);
 

package/backend/agents/lifecycle.ts

@@ -43,7 +43,7 @@ function loadCustomContext(cwd: string): string {
   } catch { return ''; }
 }
 
-function getOrchestratorRole(workspaceId: string): string {
+export function getOrchestratorRole(workspaceId: string): string {
   const workspace = getWorkspaceById(workspaceId);
   if (workspace?.orchestratorRole) return workspace.orchestratorRole;
   const cwd = workspace?.cwd;
@@ -252,12 +252,12 @@ export async function sendToAgent(id: string, message: string, attachments?: Att
   }
   broadcast({ type: 'agent_working', agentId: id, workspaceId: session.workspaceId, task: displayText });
 
+  // Only the orchestrator role gets native subagent tools; specialists just execute tasks
+  const isOrchestrator = session.isOrchestrator === true || session.role === getOrchestratorRole(session.workspaceId);
+
   const permissionOpts = session.bypass
     ? { permissionMode: 'bypassPermissions' as const, allowDangerouslySkipPermissions: true, canUseTool: createBypassCanUseTool(id, session.workspaceId) }
-    : { permissionMode: 'default' as const, canUseTool: createCanUseTool(id, session.workspaceId) };
-
-  // Only the orchestrator role gets native subagent tools; specialists just execute tasks
-  const isOrchestrator = session.role === getOrchestratorRole(session.workspaceId);
+    : { permissionMode: 'default' as const, canUseTool: createCanUseTool(id, session.workspaceId, isOrchestrator) };
   const subagents = (isOrchestrator && runtime.enableSubagents) ? buildSubagents(cwd, session.role) : {};
   const hasAttachments = attachments && attachments.length > 0;
 
@@ -389,7 +389,7 @@ export async function runAgentQuery(session: AgentSession, task: string, bypass
     stderr: (text: string) => console.error(`[agent:${session.id}]`, text),
     ...(bypass
       ? { permissionMode: 'bypassPermissions' as const, allowDangerouslySkipPermissions: true, canUseTool: createBypassCanUseTool(session.id, session.workspaceId) }
-      : { permissionMode: 'default' as const, canUseTool: createCanUseTool(session.id, session.workspaceId) }),
+      : { permissionMode: 'default' as const, canUseTool: createCanUseTool(session.id, session.workspaceId, isOrchestrator) }),
   };
 
   try {

package/backend/routes/agents.ts

@@ -8,7 +8,7 @@ import {
   persistAgents, persistLogEntry, addAgentToIndex, pushLog, hideLogEntry,
   delegations, agentQueues,
 } from '../agents/store.js';
-import { sendToAgent, runAgentQuery, delegateTask, compactAgentContext } from '../agents/lifecycle.js';
+import { sendToAgent, runAgentQuery, delegateTask, compactAgentContext, getOrchestratorRole } from '../agents/lifecycle.js';
 import { spawnRequests, createSpawnRequest, resolveSpawnRequest } from '../agents/spawn-requests.js';
 
 export async function handleAgentRoutes(
@@ -206,7 +206,8 @@ export async function handleAgentRoutes(
     const fromAgent = from ? agents.get(from) : null;
     const workspaceId = fromAgent?.workspaceId;
     if (!workspaceId) { jsonError(res, 'from agent not found or has no workspace'); return true; }
-    if (!fromAgent?.isOrchestrator) { jsonError(res, 'Apenas orquestradores podem delegar tarefas', 403); return true; }
+    const isOrch = fromAgent.isOrchestrator === true || fromAgent.role === getOrchestratorRole(workspaceId);
+    if (!isOrch) { jsonError(res, 'Apenas orquestradores podem delegar tarefas', 403); return true; }
 
     try {
       const result = await delegateTask(from, to, task, workspaceId, model, toId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucashca/claudecontrol",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "description": "AI Agent Dashboard — manage multiple Claude Code agents across projects",
   "type": "module",
   "bin": {

package/version.json

@@ -1 +1 @@
-{"version":"0.3.28","build":"2026-04-03T23:25:03.559Z"}
+{"version":"0.3.30","build":"2026-04-03T23:54:10.502Z"}