Finding / cursor

2026-10-13-cursor-sdk-subagent-inheritance-is-opt-in-in-1-0-34-and-remains-so-in-1-0

SDK subagent inheritance is opt-in in 1.0.34 and remains so in 1.0.37. TypeScript local SDK embedders can opt Task children into the parent’s executor, workspace and tool-limit configuration. Unset does not transmit the parent’s allowlist headers. Custom tools can also receive a child session identifier for host-owned per-child state. Declaration and vendor-note evidence does not prove every child enforces every restriction at runtime.

Channel: tagged-release (npm 1.0.34 through inspected 1.0.37). Half: both. Date: 2026-09-29 (1.0.34); 2026-10-01 (1.0.35 custom-tool context).

Operator consequence: Configure local.subagentInherit explicitly and probe a child and a nested child against a denied tool. Do not assume parent restrictions propagate. Binding tool state to sessionId can replace ad hoc child tracking, but each executor and the actual workspace remain the embedder’s responsibility.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-cursor-sdk-subagent-inheritance-is-opt-in-in-1-0-34-and-remains-so-in-1-0

Profile citations

  • cursor / claim / sdk-child-policy-opt-in

Source links

Primary links, including exact changelog lines when available.