@signalridge/pi-subagents 1.11.0 → 1.12.0

package/src/index.ts

@@ -165,6 +165,9 @@ import {
   streamToOutputFile,
   writeInitialEntry,
 } from "./output-file.js";
+import { registerParentQuestions } from "./parent-questions.js";
+import { captureProjectTrust, isProjectResource } from "./project-trust.js";
+import { captureQuestionOrigin } from "./question-origin.js";
 import { SubagentScheduler } from "./schedule.js";
 import { resolveStorePath, ScheduleStore } from "./schedule-store.js";
 import {
@@ -582,16 +585,18 @@ export default function (pi: ExtensionAPI): void {
     if (inert) return;
     if (!rootRuntime) {
       try {
-        const startupSettings = loadSettings(ctx.cwd);
+        const trust = captureProjectTrust(ctx);
+        const startupSettings = loadSettings(trust.cwd, trust.trusted);
         const startupAgents = loadCustomAgents(
-          ctx.cwd,
+          trust.cwd,
           startupSettings.strictAgentFiles === true,
+          trust.trusted,
         );
         rootRuntime = activateRootRuntime(
           pi,
           startupSettings,
           startupAgents,
-          ctx.cwd,
+          ctx,
           unsubscribeRootContext,
         );
       } catch (error: unknown) {
@@ -611,10 +616,12 @@ function activateRootRuntime(
   pi: ExtensionAPI,
   startupSettings: SubagentsSettings,
   startupAgents: Map<string, AgentConfig>,
-  initialCwd: string,
+  initialContext: ExtensionContext,
   unsubscribeRootContext: () => void,
 ): RootRuntime {
-  let sessionCwd = initialCwd;
+  let configurationOwner = initialContext;
+  let activeTrust = captureProjectTrust(configurationOwner);
+  let sessionCwd = activeTrust.cwd;
   let strictAgentFiles = startupSettings.strictAgentFiles === true;
 
   // ---- Register custom notification renderer ----
@@ -668,7 +675,12 @@ function activateRootRuntime(
 
   /** Reload agents from project/global custom agent dirs and merge with defaults (called on init and each Agent invocation). */
   const reloadCustomAgents = (strict = false) => {
-    const userAgents = loadCustomAgents(sessionCwd, strict);
+    const trust = captureProjectTrust(configurationOwner);
+    const changed = trust.cwd !== activeTrust.cwd || trust.trusted !== activeTrust.trusted;
+    activeTrust = trust;
+    sessionCwd = trust.cwd;
+    if (changed) applyRuntimeSettings(loadSettings(trust.cwd, trust.trusted));
+    const userAgents = loadCustomAgents(trust.cwd, strict, trust.trusted);
     registerAgents(userAgents);
   };
 
@@ -1184,6 +1196,28 @@ function activateRootRuntime(
   // same session. Invalidate pending off-screen mention turns only when the
   // replacement commits: before-switch/tree handlers can still cancel it.
   let sessionGeneration = 0;
+  const parentQuestions = registerParentQuestions(pi, () => currentCtx);
+  manager.setParentQuestionFactory((record, ctx) => {
+    const generation = sessionGeneration;
+    const sessionId = ctx.sessionManager.getSessionId();
+    const originCurrent = captureQuestionOrigin(ctx);
+    return (question, choices, signal) => {
+      // A retained channel can resume after ordinary native appends. Each
+      // question also owns the LIVE complete prefix at its own invocation.
+      const questionOriginCurrent = currentCtx ? captureQuestionOrigin(currentCtx) : () => false;
+      const controller = record.abortController;
+      const owner = JSON.stringify(record.owner);
+      const isCurrent = () => currentCtx !== undefined &&
+        sessionGeneration === generation && boundSessionId === sessionId &&
+        originCurrent(currentCtx) && questionOriginCurrent(currentCtx) &&
+        manager.getRecordMutable(record.id) === record && !record.detached &&
+        record.isBackground === true && record.status === "running" &&
+        record.abortController === controller && !controller?.signal.aborted &&
+        JSON.stringify(record.owner) === owner;
+      return parentQuestions.broker.request({ agentId: record.id, isCurrent }, question, choices,
+        controller ? AbortSignal.any([controller.signal, ...(signal ? [signal] : [])]) : signal);
+    };
+  });
   // Public synchronous bus preflight works in either extension load order. A
   // filtered-out activation has no bound context and must not veto navigation.
   pi.events.on("pi:navigation-preflight", (raw: unknown) => {
@@ -1254,8 +1288,17 @@ function activateRootRuntime(
       manager.detachForBranchChange();
       manager.resetManagedSpawns();
     }
+    parentQuestions.retire();
     sessionGeneration++;
-    sessionCwd = ctx.cwd;
+    const replacingConfiguration = currentCtx !== undefined;
+    configurationOwner = ctx;
+    const trust = captureProjectTrust(ctx);
+    sessionCwd = trust.cwd;
+    if (replacingConfiguration) {
+      activeTrust = trust;
+      applyRuntimeSettings(loadSettings(trust.cwd, trust.trusted));
+    }
+    reloadCustomAgents();
     boundSessionId = ctx.sessionManager?.getSessionId?.();
     currentCtx = ctx;
     await claimRpcRegistry(ctx, event.reason === "reload");
@@ -1370,6 +1413,7 @@ function activateRootRuntime(
   const detachCommittedTree = (event: unknown): void => {
     if (!currentCtx || detachedTreeEvent === event) return;
     detachedTreeEvent = event;
+    parentQuestions.retire();
     manager.detachForBranchChange();
   };
   // If workflows' committed-tree handler runs first, it must detach our old
@@ -1386,6 +1430,8 @@ function activateRootRuntime(
     // even when subagents' session_tree handler runs first.
     pi.events.emit("subagents:session_tree_committed", { event });
     currentCtx = ctx;
+    configurationOwner = ctx;
+    reloadCustomAgents();
     scheduler.stop();
     manager.clearCompleted(true);
     manager.resetManagedSpawns();
@@ -1426,6 +1472,7 @@ function activateRootRuntime(
         },
       });
       scheduler.stop();
+      parentQuestions.retire();
       currentCtx = undefined; // reject new spawns; owned cleanup RPC remains bound
       if (pending.length > 0) {
         let timer: ReturnType<typeof setTimeout> | undefined;
@@ -1860,8 +1907,8 @@ function activateRootRuntime(
 
   // ---- Agent tool description mode ----
   // "full" (default) keeps the rich Claude Code-style description; "compact"
-  // swaps in a ~75% smaller one for small/local models (#91). Read once at
-  // tool registration — flipping it applies on the next pi session.
+  // swaps in a ~75% smaller one for small/local models (#91). The description
+  // getter rechecks configuration authority so replacements cannot retain denied text.
   let toolDescriptionMode: ToolDescriptionMode = "full";
   function getToolDescriptionMode(): ToolDescriptionMode {
     return toolDescriptionMode;
@@ -1961,40 +2008,47 @@ function activateRootRuntime(
 
   // Apply the already-validated session settings and emit the same lifecycle
   // event that the normal startup path exposes. Do not re-read process.cwd().
-  applySettings(startupSettings, {
-    setMaxConcurrent: (n) => manager.setMaxConcurrent(n),
-    setDefaultMaxTurns,
-    setGraceTurns,
-    setDefaultMaxTokens,
-    setDefaultMaxToolCalls,
-    setDefaultToolTimeout: (ms) => setDefaultToolTimeoutMs(ms),
-    setDefaultJoinMode,
-    setDefaultModel,
-    setSchedulingEnabled,
-    setScopeModels: setScopeModelsEnabled,
-    setStrictAgentFiles: (enabled) => {
-      strictAgentFiles = enabled;
-    },
-    setDisableDefaultAgents,
-    setToolDescriptionMode,
-    setFleetView: setFleetViewEnabled,
-    setOutputTranscript: setOutputTranscriptDefault,
-    setRememberAgents: (enabled) => manager.setRememberAgents(enabled),
-    setAgentMentions: (enabled) => {
-      agentMentionMode = enabled;
-    },
-    setSupervisorQuestions: (enabled) => {
-      supervisorQuestionsEnabled = enabled;
-      manager.setSupervisorQuestions(enabled);
-    },
-    setMaxSubagentDepth,
-    setMaxSubagentSpawnsPerBranch: (n) =>
-      manager.setMaxSubagentSpawnsPerBranch(n),
-    setFallbackSubagent,
-    setWorktreeIsolation: setWorktreeIsolationEnabled,
-    setAgentTiers: setAgentTiersSettings,
-  });
-  pi.events.emit("subagents:settings_loaded", { settings: startupSettings });
+  const baselineSettings: SubagentsSettings = { ...snapshotSettings(), strictAgentFiles: false, agentTiers: {} };
+  function applyRuntimeSettings(settings: SubagentsSettings): void {
+    // Clear optional policies as well: absence must not retain the old project's values.
+    setDefaultModel(settings.defaultModel ?? baselineSettings.defaultModel);
+    setFallbackSubagent(settings.fallbackSubagent ?? baselineSettings.fallbackSubagent);
+    applySettings({ ...baselineSettings, ...settings }, {
+      setMaxConcurrent: (n) => manager.setMaxConcurrent(n),
+      setDefaultMaxTurns,
+      setGraceTurns,
+      setDefaultMaxTokens,
+      setDefaultMaxToolCalls,
+      setDefaultToolTimeout: (ms) => setDefaultToolTimeoutMs(ms),
+      setDefaultJoinMode,
+      setDefaultModel,
+      setSchedulingEnabled,
+      setScopeModels: setScopeModelsEnabled,
+      setStrictAgentFiles: (enabled) => {
+        strictAgentFiles = enabled;
+      },
+      setDisableDefaultAgents,
+      setToolDescriptionMode,
+      setFleetView: setFleetViewEnabled,
+      setOutputTranscript: setOutputTranscriptDefault,
+      setRememberAgents: (enabled) => manager.setRememberAgents(enabled),
+      setAgentMentions: (enabled) => {
+        agentMentionMode = enabled;
+      },
+      setSupervisorQuestions: (enabled) => {
+        supervisorQuestionsEnabled = enabled;
+        manager.setSupervisorQuestions(enabled);
+      },
+      setMaxSubagentDepth,
+      setMaxSubagentSpawnsPerBranch: (n) =>
+        manager.setMaxSubagentSpawnsPerBranch(n),
+      setFallbackSubagent,
+      setWorktreeIsolation: setWorktreeIsolationEnabled,
+      setAgentTiers: setAgentTiersSettings,
+    });
+    pi.events.emit("subagents:settings_loaded", { settings });
+  }
+  applyRuntimeSettings(startupSettings);
 
   // A tier that nothing defines is a typo, and the resolver would only reach it
   // on the first spawn that needs it — possibly minutes in, mid-task. Report it
@@ -2023,7 +2077,7 @@ function activateRootRuntime(
    * prose working. A delivered mention costs no main-model turn; the answer
    * arrives through the ordinary completion notification either way.
    */
-  pi.on("input", async (event, ctx) => {
+  pi.on("input", parentQuestions.observeHandledInput(async (event, ctx) => {
     // Never hijack text the extension layer itself submitted (pi.sendMessage,
     // scheduled prompts) — only something a person typed can be a mention.
     if (event.source === "extension" || !isAgentMentionsEnabled())
@@ -2201,7 +2255,7 @@ function activateRootRuntime(
     // In `model` mode an off-screen mention-only turn rewrites the typed task
     // without copying parent history or its request-local context hooks.
     // Nothing reaches the chat, and it starts an ordinary top-level agent.
-    const registeredAgentTool = agentToolRef;
+    const registeredAgentTool = agentToolRef ? freshAgentToolDefinition() : undefined;
     if (getAgentMentionMode() === "model" && registeredAgentTool) {
       // The hidden turn is itself a provider call. Refuse before saying
       // "Starting" or spending that call when its inherited parent model is
@@ -2262,7 +2316,7 @@ function activateRootRuntime(
       );
     }
     return { action: "handled" };
-  });
+  }));
 
   // ---- Agent tool ----
 
@@ -2294,15 +2348,13 @@ function activateRootRuntime(
   // The catalogue is injected into the description rather than left to a lookup
   // tool: the host has to pick a tier on its first call, and a tool it must
   // remember to call first is a tool it will skip.
-  const tierListText = buildAgentTierListText();
-  const compactTierListText = buildCompactAgentTierListText();
-  const tierSection = tierListText ? `\n\n${tierListText}` : "";
-  const compactTierSection = compactTierListText
-    ? `\n\n${compactTierListText}`
-    : "";
+  const tierSection = (compact = false): string => {
+    const text = compact ? buildCompactAgentTierListText() : buildAgentTierListText();
+    return text ? `\n\n${text}` : "";
+  };
 
-  const compactAgentToolDescription = `Launch an autonomous agent for complex, multi-step tasks. Agent types:
-${buildCompactTypeListText()}${compactTierSection}
+  const compactAgentToolDescription = () => `Launch an autonomous agent for complex, multi-step tasks. Agent types:
+${buildCompactTypeListText()}${tierSection(true)}
 
 Custom agents: .pi/agents/<name>.md (project) or ${getAgentDir()}/agents/<name>.md (global).
 
@@ -2314,12 +2366,12 @@ Notes:
 - isolation: "worktree" runs the agent in an isolated git worktree; changes land on a branch.
 - Raw inherit_context is unavailable; put only an explicitly sanitized summary in the task prompt.`;
 
-  const fullAgentToolDescription = `Launch a new agent to handle complex, multi-step tasks autonomously. Each agent type has specific capabilities and tools available to it.
+  const fullAgentToolDescription = () => `Launch a new agent to handle complex, multi-step tasks autonomously. Each agent type has specific capabilities and tools available to it.
 
 Available agent types and the tools they have access to:
 ${buildTypeListText()}
 
-Custom agents can be defined in .pi/agents/<name>.md (project) or ${getAgentDir()}/agents/<name>.md (global) — they are picked up automatically. Project-level agents override global ones. Creating a .md file with the same name as a default agent overrides it.${tierSection}
+Custom agents can be defined in .pi/agents/<name>.md (project) or ${getAgentDir()}/agents/<name>.md (global) — they are picked up automatically. Project-level agents override global ones. Creating a .md file with the same name as a default agent overrides it.${tierSection()}
 
 When using the Agent tool, specify a subagent_type parameter to select which agent type to use.
 
@@ -2367,8 +2419,8 @@ Terse command-style prompts produce shallow, generic work.
       // Both carry their own leading blank line, so a template that drops the
       // placeholder inline renders byte-identically to the built-in description
       // whether or not any tier is configured.
-      tierList: () => tierSection,
-      compactTierList: () => compactTierSection,
+      tierList: () => tierSection(),
+      compactTierList: () => tierSection(true),
       defaultTier: getDefaultAgentTierText,
       agentDir: getAgentDir,
       scheduleGuideline: () => scheduleGuideline,
@@ -2384,10 +2436,12 @@ Terse command-style prompts produce shallow, generic work.
   };
 
   const loadCustomToolDescription = (): string | undefined => {
+    const trust = captureProjectTrust(configurationOwner);
     for (const path of [
-      join(sessionCwd, ".pi", "agent-tool-description.md"),
+      ...(trust.trusted ? [join(trust.cwd, ".pi", "agent-tool-description.md")] : []),
       join(getAgentDir(), "agent-tool-description.md"),
     ]) {
+      if (!trust.trusted && isProjectResource(path, trust.cwd)) continue;
       try {
         if (!existsSync(path)) continue;
         const text = readFileSync(path, "utf-8").trim();
@@ -2402,9 +2456,11 @@ Terse command-style prompts produce shallow, generic work.
     return undefined;
   };
 
-  const agentToolDescription = (() => {
+  const agentToolDescription = () => {
+    const trust = captureProjectTrust(configurationOwner);
+    if (trust.cwd !== activeTrust.cwd || trust.trusted !== activeTrust.trusted) reloadCustomAgents();
     const mode = getToolDescriptionMode();
-    if (mode === "compact") return compactAgentToolDescription;
+    if (mode === "compact") return compactAgentToolDescription();
     if (mode === "custom") {
       const custom = loadCustomToolDescription();
       if (custom) return custom;
@@ -2412,16 +2468,18 @@ Terse command-style prompts produce shallow, generic work.
         '[pi-subagents] toolDescriptionMode is "custom" but no agent-tool-description.md found — using "full"',
       );
     }
-    return fullAgentToolDescription;
-  })();
+    return fullAgentToolDescription();
+  };
 
   // Captured so the mention clone can hand the copy the REAL registered tool:
   // its handler closes over this activation, which is what makes a clone-driven
   // spawn an ordinary top-level agent rather than something the fork owns.
+  const agentTypeParameterDescription = () =>
+    `The type of specialized agent to use. Available types: ${getAvailableTypes().join(", ")}. Custom agents from .pi/agents/*.md (project) or ${getAgentDir()}/agents/*.md (global) are also available.`;
   const agentTool = defineTool({
     name: SUBAGENT_TOOL_NAMES.AGENT,
     label: "Agent",
-    description: agentToolDescription,
+    get description() { return agentToolDescription(); },
     promptSnippet: "Launch autonomous sub-agents for complex multi-step tasks",
     promptGuidelines: [
       "Use Agent with specialized agents when the task matches an agent type's description. Subagents are valuable for parallelizing independent queries or for protecting the main context window from excessive results, but should not be used excessively when not needed. Importantly, avoid duplicating work that subagents are already doing — if you delegate research to a subagent, do not also perform the same searches yourself.",
@@ -2438,7 +2496,7 @@ Terse command-style prompts produce shallow, generic work.
           "A short (3-5 word) description of the task (shown in UI).",
       }),
       subagent_type: Type.String({
-        description: `The type of specialized agent to use. Available types: ${getAvailableTypes().join(", ")}. Custom agents from .pi/agents/*.md (project) or ${getAgentDir()}/agents/*.md (global) are also available.`,
+        description: agentTypeParameterDescription(),
       }),
       tier: Type.Optional(
         Type.String({
@@ -2458,6 +2516,9 @@ Terse command-style prompts produce shallow, generic work.
             "Set to true to run in background. Returns agent ID immediately. You will be notified on completion.",
         }),
       ),
+      supervisor_questions: Type.Optional(Type.Union([Type.Literal("human"), Type.Literal("parent"), Type.Literal("off")], {
+        description: 'Explicit question routing, default human. "parent" is ordinary clarification only (never permission/approval), supported only for fresh non-isolated top-level background calls. No schedules or mode-changing resumes.',
+      })),
       resume: Type.Optional(
         Type.String({
           description:
@@ -2692,6 +2753,16 @@ Terse command-style prompts produce shallow, generic work.
         ...params,
         agentTiers: getAgentTiersSettings(),
       });
+      if (params.supervisor_questions === "parent" &&
+          (!resolvedConfig.runInBackground || resolvedConfig.isolated || params.schedule || params.resume || !isSupervisorQuestionsEnabled())) {
+        throw new Error('supervisor_questions: "parent" requires a fresh non-isolated background Agent. Set run_in_background: true, omit schedule/resume, and enable Supervisor questions. Foreground calls cannot answer while blocked.');
+      }
+      if (params.schedule && params.supervisor_questions !== undefined) {
+        throw new Error('Scheduled calls do not support per-call question routing; omit supervisor_questions.');
+      }
+      if (params.resume && params.supervisor_questions !== undefined) {
+        throw new Error('Resume preserves the child question mode; omit supervisor_questions and use run_in_background: true for a parent-mode child.');
+      }
       if (!params.resume && !params.schedule && resolvedConfig.inheritContext) {
         return textResult(INHERIT_CONTEXT_UNAVAILABLE);
       }
@@ -2720,7 +2791,8 @@ Terse command-style prompts produce shallow, generic work.
       if (!resolvedConfig.agentTierSelected) {
         const scopeVerdict = checkModelScope({
           model,
-          cwd: ctx.cwd,
+          cwd: activeTrust.cwd,
+          authority: activeTrust,
           modelRegistry: ctx.modelRegistry,
           callerSupplied: resolvedConfig.modelFromParams,
           agentLabel: customConfig?.displayName ?? subagentType,
@@ -3009,6 +3081,7 @@ Terse command-style prompts produce shallow, generic work.
             : thinking,
           agentTier: resolvedConfig.requestedAgentTier,
           isBackground: true,
+          supervisorQuestions: params.supervisor_questions === "parent" ? "parent" : params.supervisor_questions === "off" ? false : undefined,
           isolation,
           invocation: agentInvocation,
           rootSessionId: ctx.sessionManager.getSessionId(),
@@ -3166,6 +3239,7 @@ Terse command-style prompts produce shallow, generic work.
               : thinking,
             agentTier: resolvedConfig.requestedAgentTier,
             isolation,
+            supervisorQuestions: params.supervisor_questions === "off" ? false : undefined,
             invocation: agentInvocation,
             signal,
             rootSessionId: ctx.sessionManager.getSessionId(),
@@ -3217,6 +3291,42 @@ Terse command-style prompts produce shallow, generic work.
   pi.registerTool(agentTool);
   agentToolRef = agentTool;
 
+  // Pi snapshots description and parameters when wrapping a registered tool.
+  // Trust changes alone emit no host event. Re-register before each new prompt,
+  // ahead of Pi's effective loadout snapshot, using its public post-bind refresh.
+  // Turn end also covers provider continuations after tools revoke authority.
+  // Keep the same exposure/execution policy and retain the active set.
+  function freshAgentToolDefinition() {
+    reloadCustomAgents();
+    return {
+      ...agentTool,
+      description: agentToolDescription(),
+      parameters: {
+        ...agentTool.parameters,
+        properties: {
+          ...agentTool.parameters.properties,
+          subagent_type: { ...agentTool.parameters.properties.subagent_type, description: agentTypeParameterDescription() },
+          tier: { ...agentTool.parameters.properties.tier, description: buildAgentTierParameterDescription() },
+        },
+      },
+    };
+  }
+  const refreshAgentDeclaration = () => {
+    const refreshed = freshAgentToolDefinition();
+    const activeTools = pi.getActiveTools();
+    pi.registerTool(refreshed);
+    // Pi's explicit --tools/SDK tools selector can re-activate every matching
+    // name during registry refresh. A metadata refresh must not undo a later
+    // activation/exposure decision by the host or another extension.
+    const refreshedActive = pi.getActiveTools();
+    if (activeTools.length !== refreshedActive.length || activeTools.some((name, i) => name !== refreshedActive[i])) {
+      pi.setActiveTools(activeTools);
+    }
+    agentToolRef = refreshed;
+  };
+  pi.on("before_agent_start", refreshAgentDeclaration);
+  pi.on("turn_end", refreshAgentDeclaration);
+
   // ---- get_subagent_result tool ----
 
   pi.registerTool(
@@ -4834,7 +4944,7 @@ Do not wrap the response in a markdown code fence. Return only the file contents
     //    scoped set would fail the scope check at spawn time.
     if (isScopeModelsEnabled()) {
       const enabled = resolveEnabledModels(
-        readEnabledModels(sessionCwd),
+        readEnabledModels(sessionCwd, captureProjectTrust(configurationOwner)),
         ctx.modelRegistry,
         sessionCwd,
       );

package/src/model-scope.ts

@@ -8,6 +8,7 @@
  */
 
 import { isModelInScope, type ModelRegistryRef, readEnabledModels, resolveEnabledModels } from "./enabled-models.js";
+import type { ProjectTrust } from "./project-trust.js";
 
 /**
  * When enabled, subagent model choices are validated against `enabledModels`
@@ -41,6 +42,8 @@ export type ModelScopeVerdict =
 export function checkModelScope(args: {
   model: { provider: string; id: string } | undefined;
   cwd: string;
+  /** Captured config root/trust and retained ancestor denials; omit only for standalone helpers. */
+  authority?: ProjectTrust;
   modelRegistry: ModelRegistryRef;
   /** True when the model came from the tool call rather than frontmatter. */
   callerSupplied: boolean;
@@ -52,7 +55,7 @@ export function checkModelScope(args: {
   const { model, cwd, modelRegistry, callerSupplied, agentLabel, modelInput } = args;
   if (!scopeModelsEnabled || !model) return { kind: "ok" };
 
-  const allowed = resolveEnabledModels(readEnabledModels(cwd), modelRegistry, cwd);
+  const allowed = resolveEnabledModels(readEnabledModels(cwd, args.authority), modelRegistry, cwd);
   if (!allowed || isModelInScope(model, allowed)) return { kind: "ok" };
 
   // A tier whose profile says `inherit` names no model of its own, so fall back

package/src/nested-tools.ts

@@ -27,6 +27,7 @@ import {
   streamToOutputFile,
   writeInitialEntry,
 } from "./output-file.js";
+import { configurationContext, type ProjectTrust } from "./project-trust.js";
 import { getForegroundOutcomeNote, getStatusNote, partialOutputSuffix } from "./status-note.js";
 import type {
   AgentConfig,
@@ -104,6 +105,8 @@ export interface NestedToolContext {
   allowedSubagents: "all" | string[];
   /** Root used for agent/config discovery; may differ from the agent's working directory. */
   configCwd: string;
+  /** Immutable configuration authority captured by the runner, including ancestor denials. */
+  projectTrust: ProjectTrust;
 }
 
 function textResult(text: string, isError = false) {
@@ -152,7 +155,9 @@ export function createNestedSubagentTools(context: NestedToolContext): ToolDefin
   // Agents resolve from a registry built for THIS branch's config root (under
   // worktree isolation, the copy). Never via registerAgents — that is
   // process-global state shared with the main session and every other agent.
-  const loadRegistry = () => buildAgentRegistry(loadCustomAgents(context.configCwd));
+  const loadRegistry = () => buildAgentRegistry(loadCustomAgents(
+    context.configCwd, false, context.projectTrust.trusted, context.projectTrust.deniedRoots,
+  ));
   const allowedTypesIn = (registry: Map<string, AgentConfig>): Set<string> | undefined =>
     context.allowedSubagents === "all"
       ? undefined
@@ -250,6 +255,7 @@ export function createNestedSubagentTools(context: NestedToolContext): ToolDefin
         const scopeVerdict = checkModelScope({
           model,
           cwd: context.configCwd,
+          authority: context.projectTrust,
           modelRegistry: ctx.modelRegistry,
           callerSupplied: invocation.modelFromParams,
           agentLabel: config?.displayName ?? resolvedType,
@@ -339,7 +345,7 @@ export function createNestedSubagentTools(context: NestedToolContext): ToolDefin
         }
       };
 
-      // `ctx` is forwarded to the manager unmodified, never captured at tool-build
+      // `ctx` is forwarded with configuration-root provenance, never captured at tool-build
       // time: each AgentSession builds its own ExtensionRunner from that session's
       // cwd/sessionManager/modelRegistry, so this is the CHILD's context. Capturing
       // one earlier would silently give a grandchild the wrong worktree base, the
@@ -350,7 +356,7 @@ export function createNestedSubagentTools(context: NestedToolContext): ToolDefin
       // letting it escape into the child's turn.
       try {
         if (invocation.runInBackground) {
-          const id = context.manager.spawn(context.pi, ctx, resolvedType, params.prompt, {
+          const id = context.manager.spawn(context.pi, configurationContext(ctx, context.configCwd, context.projectTrust), resolvedType, params.prompt, {
             ...options,
             isBackground: true,
           });
@@ -362,7 +368,7 @@ export function createNestedSubagentTools(context: NestedToolContext): ToolDefin
 
         const { record } = await context.manager.spawnAndWait(
           context.pi,
-          ctx,
+          configurationContext(ctx, context.configCwd, context.projectTrust),
           resolvedType,
           params.prompt,
           { ...options, signal },