Subagent Delegation

源码版本v2026.7.20

Responsibility

delegate_tool lets the main agent delegate a subtask to an isolated subagent: the subagent has its own conversation, its own terminal, its own toolset, and on completion hands only the final result back to the parent. This realizes a "zero context cost" pipeline — the parent's context is not polluted by the subtask's process details. The subagent runs inside a ThreadPoolExecutor worker; dangerous commands are auto-denied by default (configurable to auto-approve).

Key Files

• def delegate_task:2426 — delegation entry
• class DelegateEvent:625 — delegation event enum
• auto-deny / auto-approve callbacks:61-103 — _subagent_auto_deny (safe default) / _subagent_auto_approve (opt-in YOLO)
• _get_subagent_approval_callback:102-160 — picks a callback based on delegation.subagent_auto_approve config
• DaemonThreadPoolExecutor:1978-1990 — resident thread pool for subagents
• with DaemonThreadPoolExecutor:2651-2660 — delegation execution context
• tools/daemon_pool.py — DaemonThreadPoolExecutor implementation
• multi-backend terminal:5-15 — the subagent's terminal executes on one of 6 sandbox backends (see Sandbox)

Data Flow

1. The main loop's provider returns tool_call: delegate.
2. delegate_task:2426 is invoked with the subtask description and optional toolsets.
3. A worker is started in DaemonThreadPoolExecutor:2651:
   • the worker initializer installs an approval callback (tools/delegate_tool.py:102), auto-denying dangerous commands by default
   • the subagent builds its own conversation context and calls run_conversation:588 to run the loop
   • the subagent's tool calls go through registry:765 (toolsets can be restricted by the parent)
4. When the subagent finishes, only the final text is handed back; delegate_task wraps it via tool_result:798 and backfills it to the parent.
5. The parent's context grows by only one tool result, not by process noise.

Summary

Subagent delegation = context isolation + dangerous-command control. The parent sees only the result, not the process, so long pipelines aren't blown up by process noise. Safe default is auto-deny; cron/batch scenarios can opt into auto-approve. Terminal execution lands on the sandbox backends.