jif 1a6e07a4fe Restrict agent roles to bounded configuration overrides (#39299) ...

## Why

Agent roles should customize a child agent without expanding the authority or changing the provider configuration inherited from its parent session.

## What changed

- Apply only supported role overrides for model behavior, developer instructions, personality, service tier, and capability reductions.
- Preserve parent-owned permissions, model providers, endpoints, MCP servers, notifications, and other unrestricted configuration.
- Keep managed feature requirements effective when a role disables capabilities, and reject symlinked user role files.
- Use the same bounded role application path for both multi-agent implementations and resumed agents.

## Testing

Add coverage for authority preservation, managed feature requirements, symlink rejection, provider inheritance, and provider routing after resume.

GitOrigin-RevId: c528d615b691f9c02bfbc21154d514ea07743010

2026-08-18 22:20:32 +00:00

..

common

Read plugin authentication state from AuthManager (#39087)

2026-08-17 22:26:27 +00:00

remote_env_windows

Carry environment config in turn selections (#38521)

2026-08-14 07:52:38 +00:00

suite

Restrict agent roles to bounded configuration overrides (#39299)

2026-08-18 22:20:32 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Include sandbox mode in response metadata (#37507)

2026-08-07 22:41:20 +00:00