{"record":{"id":"a6ef248287d784fc","repo":"danny-avila/LibreChat","slug":"you-no-longer-have-access-to-subagent-agentid","errorCode":null,"errorMessage":"You no longer have access to subagent ${agentId}.","messagePattern":"You no longer have access to subagent (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"api/server/services/Endpoints/agents/initialize.js","lineNumber":839,"sourceCode":"      return null;\n    }\n  };\n\n  /**\n   * Resolves the selected descriptor inside the foreground request. The\n   * legacy initializer requires request/response objects for tool and MCP\n   * setup, so this intentionally remains request-scoped until AI-1597 gives\n   * child execution a durable runtime context.\n   */\n  const initializeLazySubagent = async ({ agentId, configId, context, lazyChildren }) => {\n    throwIfAborted(context.signal);\n    const agent = await waitForAbort(db.getAgentWithVersionCount({ id: agentId }), context.signal);\n    throwIfAborted(context.signal);\n    if (!agent || getLazySubagentConfigId(agent) !== configId) {\n      throw new Error(`Subagent ${agentId} changed before it could be initialized.`);\n    }\n    if (!(await hasSubagentViewAccess(agent, agentId, context.signal))) {\n      throw new Error(`You no longer have access to subagent ${agentId}.`);\n    }\n    const validation = await waitForAbort(\n      validateAgentModel({ req, res, agent, modelsConfig, logViolation }),\n      context.signal,\n    );\n    throwIfAborted(context.signal);\n    if (!validation.isValid) {\n      throw new Error(validation.error?.message ?? `Subagent ${agentId} failed model validation.`);\n    }\n    const scopedSkillIds = resolveAgentScopedSkillIds({\n      agent,\n      accessibleSkillIds,\n      skillsCapabilityEnabled,\n      ephemeralSkillsToggle,\n    });\n    const scopedEditableSkillIds = resolveAgentScopedSkillIds({\n      agent,\n      accessibleSkillIds: editableSkillIds,","sourceCodeStart":821,"sourceCodeEnd":857,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/api/server/services/Endpoints/agents/initialize.js#L821-L857","documentation":"Thrown during lazy subagent initialization when hasSubagentViewAccess returns false. The user had access when the graph was planned but lost it before the subagent was initialized (permission/role/ACL change mid-request).","triggerScenarios":"A permission or role change revokes the user's access to the subagent between graph planning and lazy initialization; the subagent was moved to a scope the user cannot view.","commonSituations":"An admin revoked a role or project membership during an in-flight request; the agent's access scope was tightened; sharing revoked concurrently.","solutions":["Verify the user still has view access to the subagent and re-initiate if restored.","Avoid revoking access to agents that have in-flight requests.","Adjust the subagent graph to only reference agents the user durably can access.","Surface the access loss to the end user with a re-auth/re-request prompt."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!(await hasSubagentViewAccess(agent, agentId, signal))) {\n  throw new Error(`Access to subagent ${agentId} revoked`);\n}","typeGuard":null,"tryCatchPattern":"try { await initializeLazySubagent({ agentId, configId, context }); }\ncatch (e) { if (/no longer have access/.test(e.message)) return res.status(403).json({ error: 'Access revoked' }); throw e; }","preventionTips":["Avoid revoking access to agents with in-flight requests.","Restrict graphs to agents the user durably owns/can view.","Re-check access early and surface revocation clearly to the user."],"tags":["agents","subagents","authorization","race-condition"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}