Expand description
Oxios sub-agent runner — in-process delegation via oxi-sdk 0.54.0+.
Wraps oxi_sdk::SdkSubagentRunner (which wraps an Oxi instance)
and exposes it as an oxi_agent::SubagentRunner for the subagent
tool’s in-process path. Each run_isolated call builds a fresh Agent
with an empty context (full isolation from the parent), runs it, and
returns only the final text + usage.
§Security model
The sub-agent built by SdkSubagentRunner has zero tools — it
calls self.oxi.agent(config).build() with no .tool() / .coding_tools()
/ .kernel_tools() registration. A tool-less agent can only do pure
text generation: no file access, no bash, no network, no side effects.
This makes the sandbox-escape vector from RFC-035 §4.3 currently moot
for this runner.
Defense-in-depth upgrade path: if a future SdkSubagentRunner
version starts honoring the _tools parameter or auto-registers
built-in tools, switch this module to delegate through
AgentLifecycleManager::execute_directive instead (RFC-035 Q2-B),
which inherits allowed_tools/network_access/max_execution_time_secs/
access_manager by construction. The “wrinkle” (ExecutionResult has
no token usage) is resolvable by sourcing usage from AgentEvent::Usage.
§Depth safety
The runner sets the forked agent’s subagent_depth to depth + 1.
The SDK hardcodes the in-process max to 3 (subagent.rs:649), so
recursion is bounded without env vars (concurrent set_var is UB).
Structs§
- Oxios
Subagent Runner - Oxios’s in-process sub-agent runner.