@deepstrike/sdk 0.2.45 → 0.2.46

package/dist/runtime/runner.d.ts

@@ -255,6 +255,13 @@ export interface RuntimeOptions {
      * concurrency stays vehicle-scoped (spec §2.5).
      */
     runGroup?: RunGroup;
+    /**
+     * Set by the SubAgentOrchestrator for host-derived child runs: the child still joins the
+     * `runGroup` (lineage) and settles its actual terminal usage into the group ledger, but reserves
+     * no budget axes — group admission governs peer vehicles only. The child's caps stay local
+     * (kernel `maxTotalTokens` policy + `resourceQuota`). Never set this for a top-level run.
+     */
+    nestedGroupVehicle?: boolean;
     /**
      * Optional long-term memory policy (`set_memory_policy`). Tunes the kernel's memory subsystem
      * (retrieval top-k, stale-warning age, write validation, memory path). Unset leaves the kernel

package/dist/runtime/runner.js

@@ -559,6 +559,7 @@ export class RuntimeRunner {
             spec,
             manifest,
             sessionLog: this.opts.sessionLog,
+            toolAccess: spec.toolAccess,
             ...(this.opts.subAgentHarness ? { harness: this.opts.subAgentHarness } : {}),
         });
         await this.commitKernelApply(runtime, this.pendingObservations, {
@@ -1567,13 +1568,24 @@ export class RuntimeRunner {
                 startPayload.run_spec = agentRunSpecToKernel(spec);
             }
             // Reserve capacity before start_run. The kernel enforces only this vehicle's grant and reports
-            // exact terminal usage against the same opaque reservation identity.
+            // exact terminal usage against the same opaque reservation identity. A nested vehicle joins for
+            // lineage/settlement only: it reserves no budget axes (group admission governs peer vehicles),
+            // so the parent's held reservation cannot squeeze the child's grant to zero.
             if (this.opts.runGroup) {
                 const g = this.opts.runGroup;
-                groupBudgetScope = await GroupBudgetScope.open(g, { sessionId, role: this.opts.agentId, kind: "vehicle" }, this.groupBudgetRequest());
+                groupBudgetScope = await GroupBudgetScope.open(g, { sessionId, role: this.opts.agentId, kind: "vehicle" }, this.opts.nestedGroupVehicle ? { limits: {}, requested: {} } : this.groupBudgetRequest());
                 this.activeGroupBudgetScope = groupBudgetScope;
             }
-            await this.applyKernelPolicies(runtime, groupBudgetScope);
+            try {
+                await this.applyKernelPolicies(runtime, groupBudgetScope);
+            }
+            catch (err) {
+                // Admission failure (e.g. the kernel rejecting a zero-capacity grant): release the
+                // reservation so it cannot linger in the group ledger, then surface the error.
+                await groupBudgetScope?.release();
+                this.activeGroupBudgetScope = undefined;
+                throw err;
+            }
             // Multimodal upload: seed the user's attachments (images/audio) as a history
             // message before start_run pushes the "[TASK STATE]" anchor. init_task does not
             // clear history, so order becomes [attachment user msg, "Proceed…"] — both land

package/dist/runtime/sub-agent-orchestrator.js

@@ -89,6 +89,15 @@ export class SubAgentOrchestrator {
         const inherit = ctx.toolAccess === "inherit";
         const permitted = new Set(ctx.manifest.permitted_capability_ids ?? []);
         const metaTools = inherit ? availableMetaTools(ctx.parentOpts) : deriveMetaTools(permitted, ctx.parentOpts);
+        // A "filtered" spawn with no capability grants and no meta-tools resolves to a deny-all plane —
+        // the child model sees zero tools and reports "no tools available". Warn the host (visible, not
+        // fatal) with the fix, mirroring `maybeWarnFailureShapedChunk`'s tone. Exempt workflow nodes:
+        // `!inherit && workflow-node ⇒ quarantined ⇒ intentional deny-all, not a misconfiguration.
+        if (!inherit && !ctx.isWorkflowNode && permitted.size === 0 && metaTools.size === 0) {
+            console.warn(`[deepstrike] spawned sub-agent "${ctx.spec.identity.agentId}" resolved to zero tools ` +
+                `(deny-all filter). Mount tools as capabilities and grant via spec.capabilityFilter, or pass ` +
+                `spec.toolAccess:'inherit' to run on the parent's plane. If a tool-less child is intentional, ignore this.`);
+        }
         const basePlane = inherit
             ? ctx.parentOpts.executionPlane
             : new FilteredExecutionPlane(ctx.parentOpts.executionPlane, permitted, metaTools);
@@ -126,6 +135,10 @@ export class SubAgentOrchestrator {
             enablePlanTool: metaTools.has("update_plan") ? ctx.parentOpts.enablePlanTool : undefined,
             // M5 v2.1: a workflow node's `start_workflow` flattens to the parent kernel (no nested pivot).
             isWorkflowNode: ctx.isWorkflowNode,
+            // Nested vehicle: the child joins the inherited runGroup for lineage/settlement only — it
+            // must NOT re-reserve budget axes the parent already holds (that double-reserve squeezed the
+            // child's grant to 0 and the kernel stripped its first-turn tools).
+            nestedGroupVehicle: true,
             // The child runs under ITS OWN spec, never the parent's: the spread above would otherwise
             // leak the parent's `runSpec` (identity, capability filter — and a LoopDriver's armed
             // `loopRound`, giving every child a phantom pace tool). A loop-node iteration carries its

package/dist/types/agent.d.ts

@@ -52,6 +52,13 @@ export interface AgentRunSpec {
     /** O3: per-child wall-clock cap in milliseconds (sets the child runner's `timeoutMs`; falls back to
      *  the parent's). A hung child terminates `timeout` instead of stalling the parent indefinitely. */
     maxWallMs?: number;
+    /** Tool surface for a spawned sub-agent. Host-side only (like `modelHint`) — NOT sent to the kernel
+     *  (`agentRunSpecToKernel` maps fields explicitly and omits it). Default `"filtered"` keeps the spawn
+     *  path's deny-all-safe default: the child is filtered to its manifest grants, and a grant-less spawn
+     *  resolves to zero tools. `"inherit"` runs the child on the parent's execution plane with the
+     *  parent's meta-tool availability (same mechanism trusted workflow nodes use) — the child's surface
+     *  is a subset of the parent's, never a privilege escalation. */
+    toolAccess?: "inherit" | "filtered";
 }
 /** Kernel process-table observation (Phase 3 canonical spawn signal). */
 export interface AgentProcessChangedObservation {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.45",
+  "version": "0.2.46",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.45",
+    "@deepstrike/core": "0.2.46",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },