fix: deny Claude subagents by default

[EtanHey]

Summary

• add ~/.claude/projects//subagents/ to the built-in ingest denylist
• keep direct Claude sessions and non-Claude providers allowed by default
• preserve explicit BRAINLAYER_INGEST_DENYLIST overrides, including empty-to-disable
• retain attribution parser/cache coverage while updating the end-to-end watcher policy contract

Test plan

• RED: focused ordinary-subagent policy test failed against the old default
• GREEN: 12 focused denylist tests passed
• watcher bridge integration passed
• full pre-push gate: 3595 passed, 9 skipped, 61 deselected, 1 xfailed
• MCP 3 passed; isolated 40 passed; Bun 1 passed; FTS regression passed

Release note

Follow-up rider for the next patch release; no version metadata is changed here.

---

Note

Medium Risk
Default ingest scope changes for many Claude Code users (subagent transcripts no longer indexed unless overridden); behavior is localized to path policy and well-tested but affects production indexing.

Overview
Claude subagent JSONL under ~/.claude/projects/**/subagents/** are opt-out of ingestion by default via a new entry in DEFAULT_INGEST_DENYLIST, alongside the existing workflow (wf_*) pattern. Direct Claude project sessions and Codex/Cursor/Gemini paths are unchanged unless the user sets BRAINLAYER_INGEST_DENYLIST (including empty string to replace defaults entirely).

Denylist and env override behavior are otherwise unchanged; subagent attribution parsing/cache code stays in place. Several denylist tests now assert _claude_subagent_attribution where policy is path-driven, and the watcher pipeline test expects all Claude subagents (not only brain/workflow workers) to be blocked from indexing.

^{Reviewed by Cursor Bugbot for commit 4bf1039. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Deny Claude subagent transcripts by default in ingest denylist

• Adds ~/.claude/projects/**/subagents/** to DEFAULT_INGEST_DENYLIST in ingest_denylist.py, so Claude subagent transcripts are excluded from ingestion unless explicitly allowed.
• Updates tests to reflect the inverted default: subagent paths are now expected to be denylisted, and attribution discovery is tested directly via _claude_subagent_attribution rather than through denylist policy.
• Behavioral Change: previously, general-purpose and Explore subagent transcripts were ingested by default; they are now blocked unless unknown_subagent_is_denylisted=False is set.

^{Macroscope summarized 4bf1039.}

Summary by CodeRabbit

• New Features

  • Claude subagent transcripts are now excluded from ingestion by default.
  • Direct Claude sessions and transcripts from other providers remain available.
  • Explicitly configured ingestion denylist settings continue to override the default policy.

• Bug Fixes

  • Improved handling of Claude subagent attribution as transcript information becomes available.
  • End-to-end ingestion behavior now consistently prevents denied transcripts from being indexed or searchable.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d5a84835-a938-46cc-b00d-dd9b5298fbea)

[EtanHey]

@codex review

[EtanHey]

@cursor @BugBot review

[EtanHey]

@coderabbitai review

[cursor]

You need to increase your spend limit or enable usage-based billing to run background agents. Go to Cursor

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 09cee928-0617-412b-b46d-4217e8e6a3cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The default ingestion denylist now excludes Claude subagent transcript paths. Denylist attribution tests and watcher bridge integration tests were updated to validate the new policy and attribution behavior.

Changes

Claude subagent denylist

Layer / File(s)	Summary
Denylist policy and rollout plan docs/plans/2026-07-18-default-deny-claude-subagents-design.md, docs/plans/2026-07-18-default-deny-claude-subagents.md, src/brainlayer/ingest_denylist.py	Adds ~/.claude/projects/**/subagents/** to the default denylist while preserving existing override and matching semantics.
Attribution and policy validation tests/test_ingest_denylist.py	Updates default-policy and attribution tests for Claude subagent exclusion, incremental scanning, scan limits, non-object JSON, and cache invalidation.
Watcher pipeline coverage tests/test_watcher_bridge.py	Includes Claude subagent sources in denylisted watcher entries and maps them to the corresponding attribution agent.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• EtanHey/brainlayer#596: Modifies the same denylist constants and Claude subagent attribution decision path.

Poem

A bunny hops through transcript snow,
“Subagents denied by default,” says so.
Attribution blooms when records arrive,
Cache checks keep the facts alive.
The watcher guards each path with care.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: denying Claude subagents by default.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/default-deny-claude-subagents

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".