[pomazanbohdan]

Motivation

• The fresh-subagent PreToolUse hook only trusted the unqualified name spawn_agent, letting canonical host-bridge calls like multi_agent_v1.spawn_agent bypass the rewrite that forces fork_turns = "none", which weakens parent->child context isolation.

Description

• Update the allowlist to accept both the canonical host-bridge spawn operation and the compatibility name by replacing the single-string matcher with a set TRUSTED_SPAWN_AGENT_TOOLS = {"multi_agent_v1.spawn_agent", "spawn_agent"} and check membership accordingly in .codex/hooks/enforce_fresh_subagents.py.
• Ensure validation and the fork_turns = "none" rewrite run for the canonical qualified name as well as the unqualified compatibility name.
• Expand regression tests in .codex/hooks/test_enforce_fresh_subagents.py to cover qualified canonical names, additional look-alike/spoofed names, unknown-field rejection for both trusted names, and the enforced fork_turns rewrite.
• Apply the focused change only to the two hook files; no other runtime contracts were modified.

Testing

• Ran the hook regression suite python3 .codex/hooks/test_enforce_fresh_subagents.py and all tests passed (3 tests, OK).
• Performed Python syntax/compile checks with python3 -m py_compile on both hook files and they succeeded.
• Executed the hook directly with a canonical spawn event fed via STDIN and verified the output contains hookSpecificOutput.permissionDecision: "allow" and updatedInput.fork_turns: "none" as expected.
• Verified behavior for spoofed names returns an empty response ({}) and that unknown tool_input fields produce a deny decision with a clear reason; these cases matched the new tests.
• Attempt to publish a remote pull request from this environment failed due to missing GitHub authentication and an outbound network tunnel 403, so changes are present locally and test-validated but PR creation was blocked by the environment.

---

Codex Task