@deepstrike/wasm 0.2.45 → 0.2.46

package/dist/runtime/runner.js

@@ -1234,6 +1234,7 @@ export class RuntimeRunner {
             spec,
             manifest,
             sessionLog: this.opts.sessionLog,
+            toolAccess: spec.toolAccess,
         });
         kernelApply(runtime, this.pendingObservations, {
             kind: "sub_agent_completed",

package/dist/runtime/sub-agent-orchestrator.d.ts

@@ -24,6 +24,16 @@ export interface SubAgentRunContext {
 /** M1/G3 intelligence routing: resolve the provider for a sub-agent from its spec's `modelHint`.
  *  Falls back to the parent provider when there is no hint or no `providerFor` hook resolves it. */
 export declare function resolveProvider(opts: RuntimeOptions, modelHint?: string): RuntimeOptions["provider"];
+/** Resolve a child's execution plane + meta-tool set from its spawn context.
+ *
+ * W-N1: `"inherit"` runs the child on the parent's plane with availability-derived meta-tools
+ * (trusted workflow nodes); `"filtered"` (default) filters to the manifest grants, empty ⇒ deny-all
+ * (spawn path, quarantined nodes). Extracted as a pure seam (mirrors the Python
+ * `_resolve_tool_grants`) so the zero-tool warning is unit-testable without spinning a child loop. */
+export declare function resolveToolGrants(ctx: SubAgentRunContext): {
+    plane: RuntimeOptions["executionPlane"];
+    metaTools: Set<string>;
+};
 /** Host-side driver for kernel-isolated sub-agent runs. */
 export declare class SubAgentOrchestrator {
     run(ctx: SubAgentRunContext): Promise<SubAgentResult>;

package/dist/runtime/sub-agent-orchestrator.js

@@ -63,18 +63,34 @@ function availableMetaTools(opts) {
         metaTools.add("update_plan");
     return metaTools;
 }
+/** Resolve a child's execution plane + meta-tool set from its spawn context.
+ *
+ * W-N1: `"inherit"` runs the child on the parent's plane with availability-derived meta-tools
+ * (trusted workflow nodes); `"filtered"` (default) filters to the manifest grants, empty ⇒ deny-all
+ * (spawn path, quarantined nodes). Extracted as a pure seam (mirrors the Python
+ * `_resolve_tool_grants`) so the zero-tool warning is unit-testable without spinning a child loop. */
+export function resolveToolGrants(ctx) {
+    const inherit = ctx.toolAccess === "inherit";
+    const permitted = new Set(ctx.manifest.permitted_capability_ids ?? []);
+    const metaTools = inherit ? availableMetaTools(ctx.parentOpts) : deriveMetaTools(permitted, ctx.parentOpts);
+    // A "filtered" spawn with no capability grants and no meta-tools resolves to a deny-all plane —
+    // the child model sees zero tools and reports "no tools available". Warn the host (visible, not
+    // fatal) with the fix. Exempt workflow nodes: not-inherit + workflow-node ⇒ quarantined ⇒
+    // intentional deny-all, not a misconfiguration.
+    if (!inherit && !ctx.isWorkflowNode && permitted.size === 0 && metaTools.size === 0) {
+        console.warn(`[deepstrike] spawned sub-agent "${ctx.spec.identity.agentId}" resolved to zero tools ` +
+            `(deny-all filter). Mount tools as capabilities and grant via spec.capabilityFilter, or pass ` +
+            `spec.toolAccess:'inherit' to run on the parent's plane. If a tool-less child is intentional, ignore this.`);
+    }
+    const plane = inherit
+        ? ctx.parentOpts.executionPlane
+        : new FilteredExecutionPlane(ctx.parentOpts.executionPlane, permitted, metaTools);
+    return { plane, metaTools };
+}
 /** Host-side driver for kernel-isolated sub-agent runs. */
 export class SubAgentOrchestrator {
     async run(ctx) {
-        // W-N1: "inherit" runs the child on the parent's plane with availability-derived meta-tools
-        // (trusted workflow nodes); "filtered" (default) filters to the manifest grants, empty ⇒
-        // deny-all (spawn path, quarantined nodes).
-        const inherit = ctx.toolAccess === "inherit";
-        const permitted = new Set(ctx.manifest.permitted_capability_ids ?? []);
-        const metaTools = inherit ? availableMetaTools(ctx.parentOpts) : deriveMetaTools(permitted, ctx.parentOpts);
-        const execPlane = inherit
-            ? ctx.parentOpts.executionPlane
-            : new FilteredExecutionPlane(ctx.parentOpts.executionPlane, permitted, metaTools);
+        const { plane: execPlane, metaTools } = resolveToolGrants(ctx);
         let systemPrompt = ctx.parentOpts.systemPrompt;
         let inheritEvents;
         if (ctx.manifest.context_inheritance === "full") {

package/dist/runtime/types/agent.d.ts

@@ -50,6 +50,13 @@ export interface AgentRunSpec {
     maxTurns?: number;
     /** O3: per-child wall-clock cap in ms (sets the child runner's `timeoutMs`; falls back to the parent's). */
     maxWallMs?: number;
+    /** Tool surface for a spawned sub-agent. Host-side only (like `modelHint`) — NOT sent to the kernel
+     *  (`agentRunSpecToKernel` maps fields explicitly and omits it). Default `"filtered"` keeps the spawn
+     *  path's deny-all-safe default: the child is filtered to its manifest grants, and a grant-less spawn
+     *  resolves to zero tools. `"inherit"` runs the child on the parent's execution plane with the
+     *  parent's meta-tool availability (same mechanism trusted workflow nodes use) — the child's surface
+     *  is a subset of the parent's, never a privilege escalation. */
+    toolAccess?: "inherit" | "filtered";
 }
 /** Kernel process-table observation (Phase 3 canonical spawn signal). */
 export interface AgentProcessChangedObservation {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/wasm",
-  "version": "0.2.45",
+  "version": "0.2.46",
   "description": "DeepStrike WASM SDK — browser, Cloudflare Workers, Deno Deploy",
   "type": "module",
   "main": "dist/index.js",
@@ -15,7 +15,7 @@
     "test": "node --experimental-vm-modules node_modules/.bin/jest"
   },
   "dependencies": {
-    "@deepstrike/wasm-kernel": "0.2.45"
+    "@deepstrike/wasm-kernel": "0.2.46"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",