669771097d
Per-session policy overrides (sandbox/mode, approval/policy) never crossed the delegation boundary: a spawn child of a read-only-switched parent ran under the wider deployment default, and a fork child missed any switch made after its seed boundary — delegation was a bypass channel for a user's tightening. The in-process driver now snapshots the delegating parent's override chain and stamps it onto the child through the canonical write paths (SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride), anchored inside the child's first turn via a one-shot agent/prompt-submit listener: turn-enclosed (durable), ahead of the first request (an inherited 'never' reaches the child's first system prompt), and positioned after any stale fork-seed switch so the ordinary last-event-wins fold resolves it. Only overrides are copied — an unswitched parent stamps nothing and the child follows the live deployment default; both services are consumed opportunistically, so compositions without them delegate unchanged. Nesting composes by construction (each stamp folds the already-stamped parent log). Evidence: inheritance.spec.ts drives scripted-model children into the real dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and no-stamp guards), inheritOverride contract tests in both service suites, and the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset → delegate → child denied, replayed keylessly). See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
subagent/ — subagent capability family
The subagent seam: an agent delegating work to a child agent. Like the bash and llm families this is a capability seam (see capability seams) — but with one defining difference: multiple provider implementations coexist in one context, registered by name, rather than the single-implementation bash shape. The registry mirrors the LLM adapter registry.
| Package | Role | ctx key |
|---|---|---|
subagent/ |
Abstract subagent seam: named-provider registry + vocabulary | ctx.subagents |
subagent-inprocess/ |
Shared in-process run driver (no provider; one cleanup effect per run) | — |
subagent-spawn/ |
In-process backend: a fresh child agent | (registers on ctx.subagents) |
subagent-fork/ |
In-process backend: a child seeded with the parent's completed-turn prefix | (registers on ctx.subagents) |
subagent-subprocess/ |
Shared out-of-process machinery: env scrub, dispose ladder, isolated config dirs (pure lib; registers nothing) | — |
subagent-acp/ |
Out-of-process backend: a child agent in a spawned subprocess, driven over ACP | (registers on ctx.subagents) |
tool-subagent/ |
Model-facing subagent delegation tool over ctx.subagents |
(registers on ctx.tools) |
The interface lives at subagent/subagent/. The in-process subagent-spawn / subagent-fork backends share the subagent-inprocess driver (a library with no provider of its own — both depend on it, neither on the other), and the out-of-process subagent-acp backend builds on the subagent-subprocess library (the credential env scrub, the dispose ladder, isolated config dirs). Tests replace only the child boundary with package-local fixtures.
The proposal and design rationale: .agents/notes/implemented/feature/2026-06-21-subagent-capability-seam.md.