@bacnh85/pi-subagent 0.12.4 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 0.13.0 (2026-07-31)
+
+### Subagents inherit parent extensions & tools by default
+
+Subagents can now use the same tools the main agent has — including extension
+ tools like `web_search`, `serena_*`, `munin_*`, `obsidian`, and `notebooklm`.
+ Previously children were restricted to the 7 Pi built-in tools (`read, grep,
+ find, ls, bash, edit, write`) and could not load extensions, which made
+ delegation far less capable than the main agent.
+
+This follows the **Claude Code model**: subagents inherit the parent's tool set,
+ with a small denylist (`subagent` — recursive delegation is always prevented)
+ and per-agent restriction via an explicit `tools:` line.
+
+**Tool resolution:**
+- Agent **omits** `tools:` → inherits **all parent tools** (minus denylist).
+  `worker` and `general-purpose` now do this.
+- Agent **specifies** `tools:` → restricted to that list, validated against
+  built-ins ∪ parent tools.
+- `sandbox: read-only` / `readOnly` → filters the effective set to read-only.
+- Denied tools (`subagent`) are **silently stripped**, never errored — whether
+  explicitly listed or inherited. Inheritance must not crash on a tool the
+  child cannot have (the inherited set always includes `subagent`).
+
+**Smart lean optimization:** extensions are only loaded when the effective tool
+ set contains at least one non-built-in tool. Recon agents with a built-in-only
+ `tools:` line (scout, tester, planner, reviewer) stay cheap — zero extension
+ overhead, same fast cold-start.
+
+**Per-child extension loader.** Children that need extensions get a FRESH
+ `DefaultResourceLoader` each run (extensions only: no skills, prompt templates,
+ AGENTS.md, or themes). The loader must NOT be cached/shared: extensions capture
+ the ExtensionAPI at factory-load time, and its actions delegate to the runtime
+ the factory was given (pi.getAllTools() → runtime.getAllTools()). A shared
+ loader's runtime is never the one any single child binds — children then hit
+ the runtime's throwing "Extension runtime not initialized" stubs on the first
+ provider request (pi-model-tools' before_provider_request calls pi.getAllTools())
+ or stale-ctx errors after the first child's dispose invalidates the shared
+ runtime. A per-child loader keeps every captured `pi` pointing at a runtime the
+ child both binds and owns. reload() per child re-reads extension files +
+ re-runs factories; acceptable for short-lived children.
+
+Extension load errors in children are logged, not fatal. Project-extension trust
+ is inherited from the parent (children never prompt).
+
+### Bundled agent changes
+
+- `worker` and `general-purpose`: removed the explicit `tools:` line so they
+  inherit all parent tools.
+- `scout`, `tester`, `planner`, `reviewer`: unchanged (still lean + restricted).
+
 ## 0.12.4 (2026-07-30)
 
 ### Improvements

package/README.md

@@ -16,13 +16,15 @@ Requires Node.js >= 20.18.
 | --- | --- | --- | --- |
 | `scout` | `zai-coding-cn/glm-5-turbo` → `nvidia/openai/gpt-oss-20b` → `opencode-go/deepseek-v4-flash` | off | read, grep, find, ls |
 | `tester` | `zai-coding-cn/glm-5-turbo` → `nvidia/openai/gpt-oss-20b` → `opencode-go/deepseek-v4-flash` | off | read, bash, grep, find, ls |
-| `worker` | `zai-coding-cn/glm-5.1` → `nvidia/mistralai/mistral-small-4-119b-2603` → `openrouter/nvidia/nemotron-3-super-120b-a12b:free` → `opencode-go/deepseek-v4-flash` | medium | read, bash, edit, write, grep, find, ls |
-| `general-purpose` | `zai-coding-cn/glm-5.1` → `nvidia/mistralai/mistral-small-4-119b-2603` → `openrouter/nvidia/nemotron-3-super-120b-a12b:free` → `opencode-go/deepseek-v4-flash` | medium | read, bash, edit, write, grep, find, ls |
+| `worker` | `zai-coding-cn/glm-5.1` → `nvidia/mistralai/mistral-small-4-119b-2603` → `openrouter/nvidia/nemotron-3-super-120b-a12b:free` → `opencode-go/deepseek-v4-flash` | medium | **inherits all parent tools** |
+| `general-purpose` | `zai-coding-cn/glm-5.1` → `nvidia/mistralai/mistral-small-4-119b-2603` → `openrouter/nvidia/nemotron-3-super-120b-a12b:free` → `opencode-go/deepseek-v4-flash` | medium | **inherits all parent tools** |
 | `planner` | `zai-coding-cn/glm-5.2` → `openrouter/nvidia/nemotron-3-ultra-550b-a55b:free` → `opencode-go/deepseek-v4-pro` | high | read, grep, find, ls |
 | `reviewer` | `zai-coding-cn/glm-5.2` → `openrouter/nvidia/nemotron-3-ultra-550b-a55b:free` → `opencode-go/deepseek-v4-pro` | high | read, grep, find, ls |
 
 Each role uses the first authenticated preference available through Pi's model registry, then falls back to the authenticated parent model. Chains are **free-first** to conserve the metered opencode-go budget: **zai-coding-cn** (free GLM, primary) → free **nvidia** NIM and **openrouter** `:free` models → **opencode-go** (paid DeepSeek, last resort — one per role: `deepseek-v4-flash` for fast/strong-coding, `deepseek-v4-pro` for deep reasoning). opencode-go's GLM models cost ~$1.40/$4.40 per M versus zai-coding-cn's free GLM, so GLM stays on zai-coding-cn. Fallback models were live-verified on 2026-07-24; `nvidia/moonshotai/kimi-k2.6` and `nvidia/z-ai/glm-5.2` return 404/timeout on the user's account and were removed — non-rate-limit failures kill the subagent instead of advancing the chain. User/project agent files remain stronger overrides and may set legacy `model`, ordered `models`, and `thinking`.
 
+**Tool inheritance.** Agents without an explicit `tools:` line (worker, general-purpose) inherit every tool the parent session has — including extension tools like `web_search`, `serena_*`, `munin_*`, `obsidian`, and `notebooklm`. Agents with an explicit `tools:` list (scout, tester, planner, reviewer) are restricted to those tools and, when the list contains only built-ins, run in a lean loader with no extension overhead. To force an agent lean even while inheriting, set `tools: read, bash, edit, write, grep, find, ls`. The `subagent` tool itself is always denied to children (no recursive delegation).
+
 ## Agent files
 
 Create `~/.pi/agent/agents/*.md` or `.pi/agents/*.md`:
@@ -45,7 +47,7 @@ Agent definitions are cached with file-signature invalidation; `/subagent reload
 
 ## Context and limits
 
-Children use in-memory SDK sessions with no extensions, skills, prompt templates, or automatic `AGENTS.md` loading. The optional `instructions` argument passes a bounded 16 KB task/repository contract. Only Pi built-in tools are available; Serena, FFF, web, and Munin are not available in lean children.
+Children use in-memory SDK sessions. Agents that inherit parent tools load the parent's extensions (web, Serena, Munin, …) into the child; agents restricted to built-in tools run in a lean loader with no extensions, skills, prompt templates, or automatic `AGENTS.md` loading. The optional `instructions` argument passes a bounded 16 KB task/repository contract.
 
 Threads are session-memory only and are cleared when Pi replaces or reloads the session. Timeout and parent cancellation propagate to child sessions. Subagents cannot recursively invoke `subagent`.
 

package/agents/general-purpose.md

@@ -1,7 +1,6 @@
 ---
 name: general-purpose
 description: General-purpose sub-agent for any delegated task. Use when no specialized agent fits. Good for complex research, multi-step operations, and code modifications.
-tools: read, bash, edit, write, grep, find, ls
 models:
   - zai-coding-cn/glm-5.1
   - nvidia/mistralai/mistral-small-4-119b-2603

package/extensions/index.ts

@@ -43,6 +43,7 @@ import {
   normalizeTimeout,
   resolveSafeCwd,
   validateAgentTools,
+  needsExtensions,
   truncateParallelOutput,
   validateExecutionRequest,
   READ_ONLY_TOOLS,
@@ -170,7 +171,9 @@ export default function (pi: ExtensionAPI) {
           : " (parent fallback)";
         const thinkingInfo = agent.thinking ? `, thinking: ${agent.thinking}` : "";
         const sandboxInfo = agent.sandbox ? `, sandbox: ${agent.sandbox}` : "";
-        return `- **${agent.name}**: ${agent.description}${modelInfo}${thinkingInfo}${sandboxInfo}`;
+        // ponytail: one-line inheritance hint; the model picks agents by description, this just sets expectations.
+        const toolsInfo = agent.tools ? `, tools: ${agent.tools.join(", ")}` : ", tools: inherits all parent tools";
+        return `- **${agent.name}**: ${agent.description}${modelInfo}${thinkingInfo}${sandboxInfo}${toolsInfo}`;
       })
       .join("\n");
     return {
@@ -179,6 +182,8 @@ export default function (pi: ExtensionAPI) {
         `\n\n## Available Subagents\n${catalog}\n\n` +
         "The subagent tool can delegate tasks to these specialized agents with isolated context. " +
         "Use for read-heavy exploration, parallel analysis, or work that would flood the main context.\n" +
+        "Agents marked `inherits all parent tools` can use web, Serena, Munin, and other extensions the main agent has; " +
+        "agents with an explicit tool list are leaner and restricted to those tools.\n" +
         "Prefer **scout** and **tester** for cheap routine work. " +
         "Prefer **worker** or **general-purpose** for normal coding. " +
         "Prefer **planner** and **reviewer** for consequential reasoning. " +
@@ -206,6 +211,7 @@ export default function (pi: ExtensionAPI) {
       timeout: request.timeout,
       instructions: request.instructions,
       signal: request.signal,
+      readOnly: request.readOnly,
       onMessage: (result) => threadStore.updateThread(thread.id, { result }),
       onProgress: (progress) => { threadStore.updateProgress(thread.id, progress); request.onProgress?.(progress); },
     }).then((result) => {
@@ -465,6 +471,12 @@ export default function (pi: ExtensionAPI) {
       const modelRuntime = (modelRegistry as any).runtime;
       const authStorage = (modelRegistry as any).authStorage;
 
+      // Parent session's registered tool names. Agents that omit `tools` inherit
+      // the full set (minus the denylist); agents with an explicit `tools` line
+      // are validated against built-ins ∪ this set.
+      const parentToolNames = pi.getAllTools().map((t) => t.name);
+      const projectTrusted = ctx.isProjectTrusted();
+
       // Helper: resolve a safe child working directory.
       function resolveChildCwd(childCwd: string | undefined): string {
         const safe = resolveSafeCwd({ workspaceRoot, childCwd, allowExternalCwd });
@@ -474,21 +486,22 @@ export default function (pi: ExtensionAPI) {
         return safe.path;
       }
 
-      // Helper: validate and normalise tools for an agent.
-      function resolveChildTools(agentTools: string[] | undefined, sandbox?: string, readOnly?: boolean): string[] {
-        const defaultTools = ["read", "bash", "edit", "write", "grep", "find", "ls"];
-        let rawTools = agentTools ?? defaultTools;
+      // Helper: validate and normalise tools for an agent. Returns the effective
+      // tool list and whether extensions must be loaded (any non-built-in tool).
+      function resolveChildTools(agentTools: string[] | undefined, sandbox?: string, readOnly?: boolean): { tools: string[]; loadExtensions: boolean } {
+        // Omitted tools => inherit all parent tools (Claude Code model).
+        let rawTools = agentTools ?? parentToolNames;
         // sandbox overrides tools: silently strip mutation tools, not an error
         if (sandbox === "read-only") {
           rawTools = rawTools.filter(t => READ_ONLY_TOOLS.includes(t));
           if (rawTools.length === 0) rawTools = [...READ_ONLY_TOOLS];
         }
         const effectiveReadOnly = readOnly || sandbox === "read-only";
-        const result = validateAgentTools({ tools: rawTools, readOnly: effectiveReadOnly });
+        const result = validateAgentTools({ tools: rawTools, readOnly: effectiveReadOnly, availableTools: parentToolNames });
         if (result.errors.length > 0) {
           throw new Error(`Tool validation errors: ${result.errors.join("; ")}`);
         }
-        return result.tools;
+        return { tools: result.tools, loadExtensions: needsExtensions(result.tools) };
       }
 
       // Helper: normalise timeout.
@@ -550,10 +563,13 @@ export default function (pi: ExtensionAPI) {
 
         // Security: validate tools, timeout, and cwd (wrapped in try/catch).
         let tools: string[];
+        let loadExtensions: boolean;
         let effectiveTimeoutMs: number | undefined;
         let safeCwd: string;
         try {
-          tools = resolveChildTools(agent.tools, agent.sandbox, isReadOnly);
+          const resolved = resolveChildTools(agent.tools, agent.sandbox, isReadOnly);
+          tools = resolved.tools;
+          loadExtensions = resolved.loadExtensions;
           effectiveTimeoutMs = resolveChildTimeout(timeoutMs, params.timeout);
           safeCwd = resolveChildCwd(cwd);
         } catch (err: unknown) {
@@ -646,6 +662,8 @@ export default function (pi: ExtensionAPI) {
               thinkingLevel: agent.thinking,
               onMessage: onProgress,
               onProgress: onActivity,
+              loadExtensions,
+              projectTrusted,
             });
 
             if (result.errorMessage && isRateLimitError(result.errorMessage)) {

package/extensions/runner.ts

@@ -19,6 +19,8 @@ import type { AgentMessage } from "@earendil-works/pi-agent-core";
 import {
   createAgentSession,
   createExtensionRuntime,
+  DefaultResourceLoader,
+  getAgentDir,
   type ResourceLoader,
   SessionManager,
   SettingsManager,
@@ -46,6 +48,54 @@ export interface UsageStats {
 export const DEFAULT_INACTIVITY_TIMEOUT_MS = 3 * 60 * 1000;
 export const HARD_TIMEOUT_MS = 20 * 60 * 1000;
 
+// ---------------------------------------------------------------------------
+// Extension resource loader
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a FRESH lean DefaultResourceLoader for this child — no skills, prompt
+ * templates, context files (AGENTS.md), or themes. Extensions are loaded per
+ * child so their factories run against a runtime that THIS child's session will
+ * bind.
+ *
+ * Do NOT cache/share this loader. Extensions capture the ExtensionAPI (`pi`)
+ * at factory load time, and its actions delegate to the runtime passed to the
+ * factory (see createExtensionAPI: pi.getAllTools() → runtime.getAllTools()).
+ * If extensions were loaded once against a shared/cached runtime, that runtime
+ * is never the one any single child binds: a session binds the runtime its own
+ * getExtensions() returned (AgentSession constructor), while the factory-captured
+ * pi still points at the shared runtime. A child then hits the runtime's throwing
+ * "Extension runtime not initialized" stubs on the first provider request
+ * (pi-model-tools' before_provider_request calls pi.getAllTools()), or stale-ctx
+ * errors when the shared runtime is invalidated by the first child's dispose.
+ * A per-child loader keeps every captured `pi` pointing at a runtime this child
+ * both binds and owns.
+ *
+ * Project-extension trust is resolved from the parent (`projectTrusted`) so a
+ * child never prompts for trust (it has no UI). reload() per child re-reads
+ * extension files + re-runs factories; acceptable for short-lived children.
+ */
+async function getExtensionLoader(cwd: string, projectTrusted: boolean): Promise<ResourceLoader> {
+  const loader = new DefaultResourceLoader({
+    cwd,
+    agentDir: getAgentDir(),
+    noSkills: true,
+    noPromptTemplates: true,
+    noContextFiles: true,
+    noThemes: true,
+  });
+  await loader.reload({ resolveProjectTrust: async () => projectTrusted });
+  // Log (don't throw on) extension load errors — a misbehaving extension must
+  // not crash the child; the agent simply won't have that tool.
+  const loadErrors = loader.getExtensions().errors;
+  if (loadErrors.length > 0) {
+    process.stderr.write(
+      `[pi-subagent] extension load warnings in child loader: ${loadErrors.map((e) => `${e.path}: ${e.error}`).join("; ")}\n`,
+    );
+  }
+  return loader;
+}
+
 export interface SubAgentProgress {
   label: string;
   at: number;
@@ -97,25 +147,40 @@ export async function runSubAgent(options: {
   onProgress?: (progress: SubAgentProgress) => void;
   timeoutMs?: number;
   hardTimeoutMs?: number;
+  /**
+   * When true, build a DefaultResourceLoader so the child inherits the parent's
+   * extensions (and thus extension tools: web, serena, munin, …). When false or
+   * unset, the lean empty-loader stub is used (no extensions).
+   */
+  loadExtensions?: boolean;
+  /**
+   * Whether the parent session trusts the project. Forwarded to the loader's
+   * resolveProjectTrust so children inherit the parent's trust decision and
+   * never prompt for project-extension trust (children have no UI). Defaults true.
+   */
+  projectTrusted?: boolean;
 }): Promise<SubAgentResult> {
   const {
     cwd, systemPrompt, task, tools, model, modelRuntime, authStorage, modelRegistry, signal,
     agentName = "subagent", thinkingLevel = "off", onMessage, onProgress,
     timeoutMs = DEFAULT_INACTIVITY_TIMEOUT_MS, hardTimeoutMs = HARD_TIMEOUT_MS,
+    loadExtensions = false, projectTrusted = true,
   } = options;
   const result: SubAgentResult = {
     agent: agentName, task, exitCode: 0, messages: [], stderr: "",
     usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0, turns: 0 },
     model: `${model.provider}/${model.id}`, status: undefined,
   };
-  const resourceLoader: ResourceLoader = {
-    getExtensions: () => ({ extensions: [], errors: [], runtime: createExtensionRuntime() }),
-    getSkills: () => ({ skills: [], diagnostics: [] }), getPrompts: () => ({ prompts: [], diagnostics: [] }),
-    getThemes: () => ({ themes: [], diagnostics: [] }), getAgentsFiles: () => ({ agentsFiles: [] }),
-    getSystemPrompt: () => systemPrompt, getSystemPromptSource: () => undefined,
-    getAppendSystemPrompt: () => [], getAppendSystemPromptSources: () => [],
-    extendResources: () => {}, reload: async () => {},
-  };
+  const resourceLoader: ResourceLoader = loadExtensions
+    ? await getExtensionLoader(cwd, projectTrusted)
+    : {
+        getExtensions: () => ({ extensions: [], errors: [], runtime: createExtensionRuntime() }),
+        getSkills: () => ({ skills: [], diagnostics: [] }), getPrompts: () => ({ prompts: [], diagnostics: [] }),
+        getThemes: () => ({ themes: [], diagnostics: [] }), getAgentsFiles: () => ({ agentsFiles: [] }),
+        getSystemPrompt: () => systemPrompt, getSystemPromptSource: () => undefined,
+        getAppendSystemPrompt: () => [], getAppendSystemPromptSources: () => [],
+        extendResources: () => {}, reload: async () => {},
+      };
   const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false }, retry: { enabled: true, maxRetries: 1 } });
   const startedAt = Date.now();
   let inactivityDeadline = startedAt + timeoutMs;

package/extensions/security.ts

@@ -12,8 +12,12 @@ import * as path from "node:path";
 // Constants
 // ---------------------------------------------------------------------------
 
-/** Tools that child agents may use. The subagent tool is never included. */
-export const ALLOWED_CHILD_TOOLS = [
+/**
+ * Pi's built-in tools. Agents whose effective tool set is a subset of these
+ * run in the cheap lean loader (no extensions loaded). Any other tool name
+ * (web_search, serena_*, munin_*, …) requires loading the parent's extensions.
+ */
+export const BUILTIN_TOOLS = [
   "read",
   "grep",
   "find",
@@ -23,6 +27,16 @@ export const ALLOWED_CHILD_TOOLS = [
   "write",
 ] as const;
 
+/** Backwards-compatible alias. */
+export const ALLOWED_CHILD_TOOLS = BUILTIN_TOOLS;
+
+/**
+ * Tools never available to child agents, regardless of inheritance.
+ * `subagent` is the only delegation primitive today; if another extension ever
+ * adds a delegation/spawn tool, it must be added here too (recursion guard).
+ */
+export const DENIED_CHILD_TOOLS = new Set(["subagent"]);
+
 export const READ_ONLY_TOOLS: readonly string[] = ["read", "grep", "find", "ls"];
 export const MUTATION_TOOLS: readonly string[] = ["edit", "write"];
 export const EXECUTION_TOOLS: readonly string[] = ["bash"];
@@ -208,6 +222,14 @@ export interface ValidateToolsOptions {
   tools: string[];
   /** When true, only read-only tools are permitted. Mutation/execution tools are rejected. */
   readOnly?: boolean;
+  /**
+   * Parent session's registered tool names. When provided, a tool is accepted if
+   * it is a built-in OR in this set (and not in DENIED_CHILD_TOOLS) — this is
+   * how children inherit extension tools (web, serena, munin, …). When omitted,
+   * only BUILTIN_TOOLS are accepted (lean/legacy mode).
+   * Callers must pass a stable snapshot and not mutate it afterwards.
+   */
+  availableTools?: readonly string[];
 }
 
 export interface ValidateToolsResult {
@@ -224,8 +246,20 @@ export interface ValidateToolsResult {
  * Deduplicates tool names.
  * When `readOnly` is true, only READ_ONLY_TOOLS are permitted.
  */
+/**
+ * Whether a tool set contains any extension tool (non-built-in). When true the
+ * runner loads the parent's extensions into the child; when false it uses the
+ * lean empty-loader stub, saving system-prompt tokens. Recon agents with an
+ * explicit built-in-only `tools` line stay cheap automatically.
+ */
+export function needsExtensions(tools: readonly string[]): boolean {
+  const builtins = new Set<string>(BUILTIN_TOOLS);
+  return tools.some((t) => !builtins.has(t));
+}
+
 export function validateAgentTools(options: ValidateToolsOptions): ValidateToolsResult {
-  const { readOnly = false } = options;
+  const { readOnly = false, availableTools } = options;
+  const extensionTools = availableTools ? new Set(availableTools) : undefined;
   const seen = new Set<string>();
   const tools: string[] = [];
   const errors: string[] = [];
@@ -234,16 +268,23 @@ export function validateAgentTools(options: ValidateToolsOptions): ValidateTools
     const tool = raw.trim();
     if (!tool) continue;
 
-    // Reject subagent regardless of casing (Pi tool names are case-sensitive
-    // but "subagent" should never pass through).
-    if (tool.toLowerCase() === "subagent") {
-      errors.push(`Tool "subagent" is not allowed in child agents (recursive delegation is prevented).`);
+    // Silently strip denied tools (e.g. "subagent") regardless of casing. They
+    // are never available to children — whether explicitly listed in an agent's
+    // `tools:` line or inherited via parentToolNames. This matches Claude Code,
+    // which removes denied tools from subagents "even when listed in the tools
+    // field". No error: inheritance must not crash on a tool the child can't have.
+    if (DENIED_CHILD_TOOLS.has(tool.toLowerCase())) {
       continue;
     }
 
-    // Check against allowlist
-    if (!ALLOWED_CHILD_TOOLS.includes(tool as any)) {
-      errors.push(`Unknown tool "${tool}". Allowed tools: ${ALLOWED_CHILD_TOOLS.join(", ")}.`);
+    // Check against allowlist: built-ins, plus inherited extension tools when availableTools given.
+    const isBuiltin = BUILTIN_TOOLS.includes(tool as any);
+    const isExtension = extensionTools?.has(tool) ?? false;
+    if (!isBuiltin && !isExtension) {
+      const allowed = extensionTools
+        ? "parent tools"
+        : BUILTIN_TOOLS.join(", ");
+      errors.push(`Unknown tool "${tool}". Allowed tools: ${allowed}.`);
       continue;
     }
 

package/extensions/service.ts

@@ -5,6 +5,7 @@ import { resolveModel } from "./model.ts";
 import {
   isRateLimitError,
   validateAgentTools,
+  needsExtensions,
   normalizeTimeout,
   resolveSafeCwd,
   MAX_INSTRUCTIONS_LENGTH,
@@ -39,6 +40,8 @@ export async function runNamedAgent(options: {
   timeout?: number;
   instructions?: string;
   signal?: AbortSignal;
+  /** When true, only read-only tools are permitted regardless of agent.sandbox. */
+  readOnly?: boolean;
   onMessage?: (result: SubAgentResult) => void;
   onProgress?: (progress: SubAgentProgress) => void;
 }): Promise<SubAgentResult> {
@@ -52,17 +55,25 @@ export async function runNamedAgent(options: {
   // Security: validate and normalise timeout.
   const effectiveTimeoutMs = normalizeTimeout({ requested: options.timeout }).timeoutMs;
 
-  // Security: validate tools against allowlist.
-  let rawTools = options.agent.tools ?? ["read", "bash", "edit", "write", "grep", "find", "ls"];
+  // Parent tool names — agents without an explicit `tools` line inherit them.
+  const parentToolNames = (options.ctx as any).getAllTools?.()?.map((t: { name: string }) => t.name) as string[] | undefined;
+
+  // Security: validate tools against allowlist (built-ins ∪ inherited parent tools).
+  // readOnly from the caller (e.g. pi-review) is enforced even when agent.sandbox
+  // is unset — never trust a caller-supplied tool list without the read-only filter.
+  const effectiveReadOnly = options.readOnly === true || options.agent.sandbox === "read-only";
+  let rawTools = options.agent.tools ?? parentToolNames ?? ["read", "bash", "edit", "write", "grep", "find", "ls"];
   // Enforce read-only sandbox: strip mutating and execution tools
-  if (options.agent.sandbox === "read-only") {
+  if (effectiveReadOnly) {
     rawTools = rawTools.filter(t => READ_ONLY_TOOLS.includes(t));
     if (rawTools.length === 0) rawTools = [...READ_ONLY_TOOLS];
   }
-  const toolValidation = validateAgentTools({ tools: rawTools, readOnly: options.agent.sandbox === "read-only" });
+  const toolValidation = validateAgentTools({ tools: rawTools, readOnly: effectiveReadOnly, availableTools: parentToolNames });
   if (toolValidation.errors.length > 0) {
     throw new Error(`Tool validation errors for agent "${options.agent.name}": ${toolValidation.errors.join("; ")}`);
   }
+  const loadExtensions = needsExtensions(toolValidation.tools);
+  const projectTrusted = options.ctx.isProjectTrusted();
 
   // Security: validate cwd (service caller must provide valid cwd).
   // The service path uses the same policy as the tool path.
@@ -119,6 +130,8 @@ export async function runNamedAgent(options: {
       thinkingLevel: options.agent.thinking,
       onMessage: options.onMessage,
       onProgress: options.onProgress,
+      loadExtensions,
+      projectTrusted,
     });
 
     if (result.errorMessage && isRateLimitError(result.errorMessage)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-subagent",
-  "version": "0.12.4",
+  "version": "0.13.0",
   "description": "In-process subagents for Pi with isolated SDK sessions, parallel and chained delegation, and inspectable threads.",
   "type": "module",
   "license": "MIT",