Repository navigation
Decision: should non-Main tree Bots be allowed to call create_child_bot? (PR #2 review) #16
Description
Context
In the tree plugin, create_child_bot is visible to every tree Bot. AGENTS.md reserves Bot creation for Main Bots. The reviewer asked for an explicit maintainer decision rather than letting this land silently. Still open at 7b806c6. Related to #6.
Original feedback
- @hsliuustc0106 review (permalink), item 17: "Recursive spawning is the plugin's purpose, but AGENTS.md reserves Bot creation for Main Bots. This needs an explicit maintainer decision (restrict to root/Main, or amend the invariant)."
- Codex inline comment, Restrict child creation to Main Bots (permalink),
ds-bot/plugins/tree/src/tools.jsL59 (P1), citing AGENTS.md L16.
Where
plugins/tree/src/tools.js#L56-L59: visibleTo: inTree
Options
A. Restrict create_child_bot to the root or Main Bots, or require owner approval.
B. Amend AGENTS.md so tree Bots may create children under themselves (with maxChildren and depth limits as guardrails).
Acceptance criteria
- A maintainer records the decision here.
- Code or AGENTS.md is updated to match, with a test asserting who can create Bots.
Refs: PR #2 (merged), umbrella #3. Verified against Birfy/FlyBot flybot-plugins tip 7b806c6.
Activity
docs: define team ownership and Chief collaboration boundaries (#59)
feat(identity): persist team members and owner-bound bots (#60)
feat(auth): member sign-in and revocable invitations (#62)
feat(authz): scope bot resources and administration to their owner (#49)
Birfy commentedon Oct 16, 2026
Decision (owner)
Option B.
Tree Bots may create children under themselves. Amend AGENTS.md so this is the documented rule (not Main-only). Keep guardrails:
maxChildrenand depth limits.Additional constraint from the owner’s grant model: a newly created child Bot is usable only by its creator’s owner by default. Sharing it with another person still requires an independent per-Bot grant (default deny). No global publish.
Next: update AGENTS.md (or the tree subsystem doc), tighten
create_child_botvisibility/auth to match, and add a test that asserts who can create and who can use the child.