@lucashca/claudecontrol 0.3.29 → 0.3.30

package/backend/agents/canUseTool.ts

@@ -43,8 +43,13 @@ export function createBypassCanUseTool(agentId: string, workspaceId: string) {
  * Creates canUseTool for default (secure) mode.
  * Shows permission prompt in the frontend and waits for user response.
  */
-export function createCanUseTool(agentId: string, workspaceId: string) {
+export function createCanUseTool(agentId: string, workspaceId: string, isOrchestrator = false) {
   return (toolName: string, input: Record<string, unknown>, options: CanUseToolOptions) => {
+    if (toolName === 'Task' && !isOrchestrator) {
+      const session = agents.get(agentId);
+      if (session) pushLog(session, { type: 'system', text: 'Subagente bloqueado: apenas orquestradores podem iniciar subagentes', timestamp: new Date().toISOString() });
+      return Promise.resolve({ behavior: 'deny' as const, message: 'Apenas orquestradores podem iniciar subagentes' });
+    }
     const requestId = genId();
     const session = agents.get(agentId);
 

package/backend/agents/lifecycle.ts

@@ -252,12 +252,12 @@ export async function sendToAgent(id: string, message: string, attachments?: Att
   }
   broadcast({ type: 'agent_working', agentId: id, workspaceId: session.workspaceId, task: displayText });
 
+  // Only the orchestrator role gets native subagent tools; specialists just execute tasks
+  const isOrchestrator = session.isOrchestrator === true || session.role === getOrchestratorRole(session.workspaceId);
+
   const permissionOpts = session.bypass
     ? { permissionMode: 'bypassPermissions' as const, allowDangerouslySkipPermissions: true, canUseTool: createBypassCanUseTool(id, session.workspaceId) }
-    : { permissionMode: 'default' as const, canUseTool: createCanUseTool(id, session.workspaceId) };
-
-  // Only the orchestrator role gets native subagent tools; specialists just execute tasks
-  const isOrchestrator = session.role === getOrchestratorRole(session.workspaceId);
+    : { permissionMode: 'default' as const, canUseTool: createCanUseTool(id, session.workspaceId, isOrchestrator) };
   const subagents = (isOrchestrator && runtime.enableSubagents) ? buildSubagents(cwd, session.role) : {};
   const hasAttachments = attachments && attachments.length > 0;
 
@@ -389,7 +389,7 @@ export async function runAgentQuery(session: AgentSession, task: string, bypass
     stderr: (text: string) => console.error(`[agent:${session.id}]`, text),
     ...(bypass
       ? { permissionMode: 'bypassPermissions' as const, allowDangerouslySkipPermissions: true, canUseTool: createBypassCanUseTool(session.id, session.workspaceId) }
-      : { permissionMode: 'default' as const, canUseTool: createCanUseTool(session.id, session.workspaceId) }),
+      : { permissionMode: 'default' as const, canUseTool: createCanUseTool(session.id, session.workspaceId, isOrchestrator) }),
   };
 
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucashca/claudecontrol",
-  "version": "0.3.29",
+  "version": "0.3.30",
   "description": "AI Agent Dashboard — manage multiple Claude Code agents across projects",
   "type": "module",
   "bin": {

package/version.json

@@ -1 +1 @@
-{"version":"0.3.29","build":"2026-04-03T23:43:47.390Z"}
+{"version":"0.3.30","build":"2026-04-03T23:54:10.502Z"}