Features · Agents
Delegation only works if the default is no.
An agent is a session you named and narrowed.
The definition is a file
A markdown file with frontmatter: a name, a description of when to use it, an optional model, and the tools it may or may not call. Start a session on one with --agent.
Subagents run beside you
The task tool spawns a subagent on its own thread. It reports as running, completed, failed, or cancelled, and hands back its output with the files it modified.
Hooks on the session lifecycle
Handlers fire on session start, on prompt submit, before and after a tool call, on a permission request, and on stop.
Where a setting could have gone either way, it shipped closed.
Delegation is only as good as what happens when nobody is watching the screen. These are the values the code picks when you have not picked one.
- ApprovalThe overlay opens with the cursor parked on No, held there by an assertion the build checks.
- Your answerYes allows one call. Allow Session lasts until you quit. Always Allow writes to disk and /permissions reset clears it.
- SandboxCommand execution asks the OS for a sandbox: Seatbelt on macOS, bubblewrap on Linux. Missing either, the run fails and names the install command, and --no-sandbox is the only way past it.
- NetworkA sandboxed command has no outbound network unless granted it explicitly.
- SubagentsA subagent inherits the parent's model, permission mode, and tool filters, and a named definition can only narrow that set further.
The session will tell you what it is allowed to touch.
Typing /sandbox prints the permission mode the session is running under, whether permissions are being skipped, and every extra workspace root registered for it. The permission modes are default, plan, accept edits, bypass permissions, and dont ask. Which route a session’s tokens travel on is a separate boundary, covered on the Local page.
Write one agent file and hand it a task.
Agent definitions, parallel subagents, lifecycle hooks, the approval overlay, and the OS sandbox are all in the agi CLI source today.