V2 subagent tool does not enforce per-target subagent permissions #35238

Summary

In V2, the subagent tool only has coarse whole-tool visibility filtering. Per-target rules such as allowing only one subagent are not reflected in the model-facing tool definition and are not enforced when the tool executes.

Current behavior

• ToolRegistry.materialize(...) can hide the entire subagent tool when the active agent has a whole-tool deny such as subagent:*.
• packages/core/src/tool/subagent.ts checks that the requested target agent exists and is not mode: "primary".
• It does not call PermissionV2.assert({ action: "subagent", resources: [input.agent], ... }) before spawning the child session.
• The subagent tool schema/description does not expose a filtered list of subagents allowed by the active agent.

Expected behavior

If an agent is configured to only invoke a subset of subagents, for example only explore, V2 should either:

• expose only those allowed target subagents to the model, and
• reject execution for disallowed targets with a clear permission error,

or otherwise document a different explicit policy. The current behavior makes per-target subagent permission rules ineffective as a runtime boundary.

Why this matters

An agent configured with narrow subagent permissions can still call another configured non-primary agent if it knows or guesses the name. This is different from the intended permission model and makes V2 subagent delegation harder to reason about.

Related V1 issues

• task tool advertises subagents outside active agent permission.task allow-list #33334
• Subagent permission rules are ignored, hence deny rules never applied #33223
• Task permission patterns substring-match agent names (general blocks general-small) #33276

Code pointers

• packages/core/src/tool/subagent.ts
• packages/core/src/tool/registry.ts
• packages/core/src/permission.ts