fix(tool-subagent): enforce depth only at runtime

.agents/notes/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md

@@ -53,7 +53,7 @@ The effective parent depth is the greater of durable `SessionHeader.delegationDe
 
 Every public entry validates the domain rather than relying on one model-facing configuration path. Negative values, fractions, negative zero, non-finite values, unsafe integers, malformed stored parent depth, and derived overflow all reject. A direct `SubagentStartRequest` may omit the cap to leave depth unbounded; loader-resolved `dsh-tool-subagent` configuration instead defaults to `3`, accepts a numeric override, and uses explicit `'provider-managed'` to omit the cap for an out-of-process provider whose deployment owns its recursion budget. A numeric tool cap fails at provider mount when the provider lacks `depthLimit`.
 
-A deployment can combine depth and filtering. When a numeric tool cap and `toolFilter` are supported, `dsh-tool-subagent` denies its configured tool name in a child whose derived depth is at the cap; the provider's independent depth check still rejects direct or alternate starts beyond it. A deployment may also deny delegation tools entirely in children. Neither choice changes the provider's conversation-history behavior.
+A deployment can combine depth and filtering, but the numeric cap does not synthesize a filter. The delegation tool stays visible at the cap because authorization may depend on runtime state; every attempted start checks the calling agent's current durable and runtime depth, and a rejected start returns an errored tool result without publishing a child. A deployment may separately deny delegation tools in children when its visibility policy is static. Neither choice changes the provider's conversation-history behavior.
 
 ### Capability gating keeps providers honest
 
@@ -85,10 +85,10 @@ A security design would need a separate authority representation, propagation ru
 
 **Hide only tool schemas.** Presentation-only filtering lets the model execute a tool that the prompt says does not exist through Code Mode or a forged call. One resolver governs both presentation and execution instead.
 
-**Use only tool filtering to stop recursion.** Removing the delegation tool is useful but provider-specific and does not protect direct service callers or alternate delegation tools. Absolute depth is an independent structural bound.
+**Encode the depth cap as an automatic tool filter.** A creation-time filter snapshots a decision that may depend on runtime state, affects only one configured tool name, and does not protect direct service callers or alternate delegation tools. The provider instead enforces the absolute cap at every start.
 
 ## Consequences
 
 Contributors can configure child role, visible global tools, and recursion without defining new providers. Capability checks fail before ownership starts, unpublished setup makes the first request consistent, and one tool resolver prevents presentation/execution drift.
 
-The cost is that deployments must understand live allow/deny behavior and the distinction between visibility and authority. Provider authors must advertise each supported control accurately, and in-process providers must install every requested contribution before publication. The controls deliberately do not solve security confinement or parent-to-child non-escalation.
+The cost is that deployments must understand live allow/deny behavior and the distinction between visibility and authority. A model may call a visible delegation tool after the current depth policy forbids another child and receive an error. Provider authors must advertise each supported control accurately, and in-process providers must install every requested contribution before publication. The controls deliberately do not solve security confinement or parent-to-child non-escalation.

docs/config-catalog.md

@@ -1183,9 +1183,8 @@ export interface Config {
    * Maximum child depth: a non-negative safe integer (default `3`; `0` forbids
    * delegation entirely), or `'provider-managed'` to send no cap. A numeric cap
    * requires the provider's `depthLimit` capability (mount fails loud
-   * otherwise), and a child AT the cap additionally loses this tool from its
-   * schema when the provider supports `toolFilter` — the prompt face of the
-   * budget; the service keeps rejecting on the execution face.
+   * otherwise). The provider checks the calling agent's current depth at every
+   * start; the tool remains model-visible so runtime policy owns rejection.
    * `'provider-managed'` is for an out-of-process provider (ACP) whose
    * recursion budget belongs to the child harness's own deployment.
    */

docs/core-data-structures/subagent.md

@@ -237,5 +237,5 @@ interface SubagentProvider {
 
 The spawn and fork backends create an ordinary agent through `parent.ctx`, pass cancellation into core creation, and dispose through `AgentHandle`. Provider removal blocks new starts without revoking accepted runs. Each child gets a new flat scope rather than inheriting parent registrations. Depth and fork seeding reuse existing agent and session vocabulary:
 
-- **Delegation depth** is a merge-extensible `AgentOptions.subagentDepth` field (`0` for a top-level agent, parent + 1 for a child). Only `undefined` means top level; every stored present value must be a non-negative safe integer. The seam owns it — the loop neither sets nor reads it — so a nested spawn validates its parent's stored depth, rejects a derived child depth outside the safe-integer domain, and applies a defined absolute `request.maxDepth` cap to that child.
+- **Delegation depth** is durable `SessionHeader.delegationDepth` plus the merge-extensible runtime field `AgentOptions.subagentDepth`; absence means top-level depth zero, and the greater present value is authoritative. The seam owns both fields — the loop neither sets nor reads them — so an in-process child persists parent depth + 1, resume cannot lower it, and every start rejects a derived depth outside the safe-integer domain or above a defined absolute `request.maxDepth` cap.
 - **Fork seeding** uses `CreateAgentOptions.seed` (a `SessionEvent[]` prefix threaded through `AgentLoop.createAgent` → `ctx.sessions.prepare({ seed })`, the same primitive `resume` uses). The fork backend passes a *balanced completed-turn prefix* of the parent's log — the parent's events up to and including its last `turn/end` — so the seed is contiguous-from-0 and the [invariants](../../packages/support/invariants) replay accepts it (the in-flight, unbalanced turn is excluded).

docs/glossary.md

@@ -14,4 +14,4 @@ FIXME(glossary-completeness): Expand this glossary before the first release so i
 - **shadowing** — most-specific-wins name resolution: a scoped tool/section/variable replaces its same-named global twin for that scope alone. The per-agent persona and per-agent tool-variant mechanism.
 - **restriction / scope-local registration** — a restriction (`tools.restrict`) filters the GLOBAL tool surface for one scope (compose by intersection); scope-local registrations are merged after that filter. A filtered-away global tool is absent from the prompt AND refuses execution, indistinguishably from a nonexistent one.
 - **setup window** — the creation slot where a creator composes an agent's scoped world (`CreateAgentOptions.setup`): after the scope and agent object exist but before the agent or session is published, `agent/session-start` fires, or the first prompt is assembled. Setup registers; it never drives the agent.
-- **lineage** — parent/child facts carried as data (`parentSession`, `subagentDepth`); never affects visibility. <a id="lineage"></a>
+- **lineage** — parent/child facts carried as data (`parentSession`, durable `delegationDepth`, runtime `subagentDepth`); never affects visibility. <a id="lineage"></a>

examples/acp-agent/depth-two.cordis.snapshot.yml

@@ -0,0 +1,36 @@
+# Keyless counterpart to depth-two.cordis.yml: apply the depth patch and replace
+# the live adapter with per-session replay.
+- id: base
+  name: '@cordisjs/plugin-include'
+  config:
+    path: ./cordis.yml
+    patches:
+      - id: llm-deepseek
+        name: '@deepseek-ai/dsh-llm-deepseek'
+        disabled: true
+      - id: sandbox
+        name: '@deepseek-ai/dsh-sandbox-local'
+        config:
+          runnerCommand:
+            - bash
+            - -c
+            - while [ "$1" != "--" ]; do shift; done; shift; exec "$@"
+            - passthrough-runner
+          runnerFailureSignatures:
+            - 'passthrough-runner: profile rejected'
+      - id: tool-subagent
+        name: '@deepseek-ai/dsh-tool-subagent'
+        config:
+          provider: spawn
+          toolName: subagent
+          maxDepth: 2
+      - insert:
+          - id: llm-replay
+            name: '@deepseek-ai/dsh-llm-replay'
+            config:
+              providers:
+                - id: deepseek
+                  name: DeepSeek
+                  models:
+                    - id: deepseek-v4-flash
+                    - id: deepseek-v4-pro

examples/acp-agent/depth-two.cordis.yml

@@ -0,0 +1,13 @@
+# Depth-limit snapshot overlay: keep the default composition and allow two
+# generations of spawn children before runtime enforcement rejects another.
+- id: base
+  name: '@cordisjs/plugin-include'
+  config:
+    path: ./cordis.yml
+    patches:
+      - id: tool-subagent
+        name: '@deepseek-ai/dsh-tool-subagent'
+        config:
+          provider: spawn
+          toolName: subagent
+          maxDepth: 2

examples/acp-agent/tests/acp.snapshot.ts

@@ -30,6 +30,7 @@ const BOTH_MODE_CONFIG = fileURLToPath(new URL('../both-mode.cordis.yml', import
 const WORKSPACE_CONTEXT_CONFIG = fileURLToPath(new URL('../workspace-context.cordis.yml', import.meta.url))
 const ADVANCED_CONFIG = fileURLToPath(new URL('../advanced.cordis.yml', import.meta.url))
 const FS_CONFIG = fileURLToPath(new URL('../fs.cordis.yml', import.meta.url))
+const DEPTH_TWO_CONFIG = fileURLToPath(new URL('../depth-two.cordis.yml', import.meta.url))
 
 function snapshotModeFromEnv(value: string | undefined): SnapshotSuiteOptions['mode'] {
   switch (value) {
@@ -105,12 +106,17 @@ const SCENARIOS: Scenario[] = [
   },
   { name: 'cancel', hasModelTurn: true, recorded: false, overridden: true },
   { name: 'cancel-tool-calls', hasModelTurn: true, recorded: false, overridden: true },
-  // Children sit at this example's configured depth cap (`maxDepth: 1`), so each child's header
-  // legitimately omits the delegation tool that spawned it (schema hiding).
-  { name: 'subagent-spawn', hasModelTurn: true, recorded: true, childToolOmissions: ['subagent'] },
-  { name: 'subagent-multi', hasModelTurn: true, recorded: true, childToolOmissions: ['subagent'] },
-  { name: 'subagent-fork', hasModelTurn: true, recorded: true, childToolOmissions: ['subagent_fork'] },
-  { name: 'subagent-mixed', hasModelTurn: true, recorded: true, childToolOmissions: ['subagent', 'subagent_fork'] },
+  { name: 'subagent-spawn', hasModelTurn: true, recorded: true },
+  { name: 'subagent-multi', hasModelTurn: true, recorded: true },
+  { name: 'subagent-fork', hasModelTurn: true, recorded: true },
+  { name: 'subagent-mixed', hasModelTurn: true, recorded: true },
+  {
+    name: 'subagent-depth-two-rejection',
+    hasModelTurn: true,
+    recorded: false,
+    overridden: true,
+    configPath: DEPTH_TWO_CONFIG,
+  },
   // The workflow tool: the model writes a one-child orchestration script; the
   // child runs as a spawn subagent under the worker-thread engine (its session is the
   // child fixture), and the tool result carries the script's return value.
@@ -125,9 +131,6 @@ const SCENARIOS: Scenario[] = [
     pinsHeader: true,
     headerClass: 'advanced',
     configPath: ADVANCED_CONFIG,
-    // The direct spawn child sits at the configured cap and loses `subagent`;
-    // workflow children bypass tool-subagent and keep the full set.
-    childToolOmissions: ['subagent'],
   },
   {
     name: 'cordis-inspect-jsdoc',

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/input.json

@@ -0,0 +1,7 @@
+{
+  "steps": [
+    { "op": "initialize" },
+    { "op": "newSession" },
+    { "op": "prompt", "text": "Delegate through two child generations. The depth-two child must attempt one more subagent call and report the rejection." }
+  ]
+}

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/replay.override.json

@@ -0,0 +1,22 @@
+[
+  {
+    "kind": "chunks",
+    "chunks": [
+      { "type": "block-start", "index": 0, "blockType": "tool-call" },
+      { "type": "tool-call-delta", "index": 0, "id": "call_root_child", "name": "subagent", "argumentsDelta": "{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}" },
+      { "type": "block-end", "index": 0, "block": { "type": "tool-call", "id": "call_root_child", "name": "subagent", "arguments": "{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}" } },
+      { "type": "usage", "usage": { "inputTokens": 10, "outputTokens": 5 } },
+      { "type": "finish", "reason": { "kind": "tool-calls" } }
+    ]
+  },
+  {
+    "kind": "chunks",
+    "chunks": [
+      { "type": "block-start", "index": 0, "blockType": "text" },
+      { "type": "text-delta", "index": 0, "text": "ROOT_DONE" },
+      { "type": "block-end", "index": 0, "block": { "type": "text", "text": "ROOT_DONE" } },
+      { "type": "usage", "usage": { "inputTokens": 10, "outputTokens": 2 } },
+      { "type": "finish", "reason": { "kind": "stop" } }
+    ]
+  }
+]

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.1.jsonl

@@ -0,0 +1,23 @@
+{"type":"session","version":0,"id":"22222222-2222-4222-8222-222222222222","createdAt":1001,"cwd":"/tmp/subagent-depth-two","parentSession":"11111111-1111-4111-8111-111111111111","delegationDepth":1}
+{"type":"turn/start","seq":0,"time":1784540790312,"data":{"turn":1,"trigger":{"kind":"message","source":{"kind":"user"}}}}
+{"type":"user/message","seq":1,"time":1784540790312,"data":{"content":[{"type":"text","text":"Call subagent once. Ask that child to attempt one further subagent call, then report the result."}],"source":{"kind":"user"}},"surfaceOp":"append"}
+{"type":"step/start","seq":2,"time":1784540790318,"data":{"turn":1,"step":1}}
+{"type":"request/header","seq":3,"time":1784540790318,"data":{"header":{"config":{"provider":"deepseek","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
+{"type":"assistant/chunk","seq":4,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}}}
+{"type":"assistant/chunk","seq":5,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"tool-call-delta","index":0,"id":"call_depth_one_child","name":"subagent","argumentsDelta":"{\"description\":\"Start depth two\",\"prompt\":\"Attempt one subagent call beyond the configured cap, then report the rejection.\"}"}}}
+{"type":"assistant/chunk","seq":6,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_depth_one_child","name":"subagent","arguments":"{\"description\":\"Start depth two\",\"prompt\":\"Attempt one subagent call beyond the configured cap, then report the rejection.\"}"}}}}
+{"type":"assistant/chunk","seq":7,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}}}
+{"type":"assistant/chunk","seq":8,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}}
+{"type":"assistant/message","seq":9,"time":1784540790318,"data":{"turn":1,"step":1,"content":[{"type":"tool-call","id":"call_depth_one_child","name":"subagent","arguments":"{\"description\":\"Start depth two\",\"prompt\":\"Attempt one subagent call beyond the configured cap, then report the rejection.\"}"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":5}},"sourceEventSeqs":[4,5,6,7,8],"surfaceOp":"append"}
+{"type":"tool/call","seq":10,"time":1784540790319,"data":{"turn":1,"step":1,"callId":"call_depth_one_child","name":"subagent","arguments":"{\"description\":\"Start depth two\",\"prompt\":\"Attempt one subagent call beyond the configured cap, then report the rejection.\"}"}}
+{"type":"tool/result","seq":11,"time":1784540790362,"data":{"turn":1,"step":1,"callId":"call_depth_one_child","content":[{"type":"text","text":"DEPTH_REJECTED"}],"isError":false},"sourceEventSeqs":[10],"surfaceOp":"append"}
+{"type":"step/end","seq":12,"time":1784540790363,"data":{"turn":1,"step":1}}
+{"type":"step/start","seq":13,"time":1784540790364,"data":{"turn":1,"step":2}}
+{"type":"assistant/chunk","seq":14,"time":1784540790365,"data":{"turn":1,"step":2,"chunk":{"type":"block-start","index":0,"blockType":"text"}}}
+{"type":"assistant/chunk","seq":15,"time":1784540790365,"data":{"turn":1,"step":2,"chunk":{"type":"text-delta","index":0,"text":"DEPTH_ONE_DONE"}}}
+{"type":"assistant/chunk","seq":16,"time":1784540790365,"data":{"turn":1,"step":2,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"DEPTH_ONE_DONE"}}}}
+{"type":"assistant/chunk","seq":17,"time":1784540790365,"data":{"turn":1,"step":2,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":2}}}}
+{"type":"assistant/chunk","seq":18,"time":1784540790365,"data":{"turn":1,"step":2,"chunk":{"type":"finish","reason":{"kind":"stop"}}}}
+{"type":"assistant/message","seq":19,"time":1784540790365,"data":{"turn":1,"step":2,"content":[{"type":"text","text":"DEPTH_ONE_DONE"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":2}},"sourceEventSeqs":[14,15,16,17,18],"surfaceOp":"append"}
+{"type":"step/end","seq":20,"time":1784540790365,"data":{"turn":1,"step":2}}
+{"type":"turn/end","seq":21,"time":1784540790365,"data":{"turn":1,"reason":{"kind":"completed"}}}

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.2.jsonl

@@ -0,0 +1,23 @@
+{"type":"session","version":0,"id":"33333333-3333-4333-8333-333333333333","createdAt":1002,"cwd":"/tmp/subagent-depth-two","parentSession":"22222222-2222-4222-8222-222222222222","delegationDepth":2}
+{"type":"turn/start","seq":0,"time":1784540790319,"data":{"turn":1,"trigger":{"kind":"message","source":{"kind":"user"}}}}
+{"type":"user/message","seq":1,"time":1784540790319,"data":{"content":[{"type":"text","text":"Attempt one subagent call beyond the configured cap, then report the rejection."}],"source":{"kind":"user"}},"surfaceOp":"append"}
+{"type":"step/start","seq":2,"time":1784540790334,"data":{"turn":1,"step":1}}
+{"type":"request/header","seq":3,"time":1784540790334,"data":{"header":{"config":{"provider":"deepseek","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
+{"type":"assistant/chunk","seq":4,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}}}
+{"type":"assistant/chunk","seq":5,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"tool-call-delta","index":0,"id":"call_depth_three_rejected","name":"subagent","argumentsDelta":"{\"description\":\"Exceed depth cap\",\"prompt\":\"This child must never start.\"}"}}}
+{"type":"assistant/chunk","seq":6,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_depth_three_rejected","name":"subagent","arguments":"{\"description\":\"Exceed depth cap\",\"prompt\":\"This child must never start.\"}"}}}}
+{"type":"assistant/chunk","seq":7,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}}}
+{"type":"assistant/chunk","seq":8,"time":0,"data":{"turn":1,"step":1,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}}
+{"type":"assistant/message","seq":9,"time":1784540790335,"data":{"turn":1,"step":1,"content":[{"type":"tool-call","id":"call_depth_three_rejected","name":"subagent","arguments":"{\"description\":\"Exceed depth cap\",\"prompt\":\"This child must never start.\"}"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":5}},"sourceEventSeqs":[4,5,6,7,8],"surfaceOp":"append"}
+{"type":"tool/call","seq":10,"time":1784540790335,"data":{"turn":1,"step":1,"callId":"call_depth_three_rejected","name":"subagent","arguments":"{\"description\":\"Exceed depth cap\",\"prompt\":\"This child must never start.\"}"}}
+{"type":"tool/result","seq":11,"time":1784540790337,"data":{"turn":1,"step":1,"callId":"call_depth_three_rejected","content":[{"type":"text","text":"Error: subagent depth 3 exceeds maxDepth 2"}],"isError":true},"sourceEventSeqs":[10],"surfaceOp":"append"}
+{"type":"step/end","seq":12,"time":1784540790338,"data":{"turn":1,"step":1}}
+{"type":"step/start","seq":13,"time":1784540790338,"data":{"turn":1,"step":2}}
+{"type":"assistant/chunk","seq":14,"time":1784540790339,"data":{"turn":1,"step":2,"chunk":{"type":"block-start","index":0,"blockType":"text"}}}
+{"type":"assistant/chunk","seq":15,"time":1784540790339,"data":{"turn":1,"step":2,"chunk":{"type":"text-delta","index":0,"text":"DEPTH_REJECTED"}}}
+{"type":"assistant/chunk","seq":16,"time":1784540790339,"data":{"turn":1,"step":2,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"DEPTH_REJECTED"}}}}
+{"type":"assistant/chunk","seq":17,"time":1784540790339,"data":{"turn":1,"step":2,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":2}}}}
+{"type":"assistant/chunk","seq":18,"time":1784540790339,"data":{"turn":1,"step":2,"chunk":{"type":"finish","reason":{"kind":"stop"}}}}
+{"type":"assistant/message","seq":19,"time":1784540790339,"data":{"turn":1,"step":2,"content":[{"type":"text","text":"DEPTH_REJECTED"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":2}},"sourceEventSeqs":[14,15,16,17,18],"surfaceOp":"append"}
+{"type":"step/end","seq":20,"time":1784540790339,"data":{"turn":1,"step":2}}
+{"type":"turn/end","seq":21,"time":1784540790339,"data":{"turn":1,"reason":{"kind":"completed"}}}

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/session.jsonl

@@ -0,0 +1,23 @@
+{"type":"session","version":0,"id":"11111111-1111-4111-8111-111111111111","createdAt":1000,"cwd":"/tmp/subagent-depth-two","delegationDepth":0}
+{"type":"turn/start","seq":0,"time":1784540790290,"data":{"turn":1,"trigger":{"kind":"message","source":{"kind":"user"}}}}
+{"type":"user/message","seq":1,"time":1784540790291,"data":{"content":[{"type":"text","text":"Delegate through two child generations. The depth-two child must attempt one more subagent call and report the rejection."}],"source":{"kind":"user"}},"surfaceOp":"append"}
+{"type":"step/start","seq":2,"time":1784540790308,"data":{"turn":1,"step":1}}
+{"type":"request/header","seq":3,"time":1784540790308,"data":{"header":{"config":{"provider":"deepseek","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
+{"type":"assistant/chunk","seq":4,"time":1784540790309,"data":{"turn":1,"step":1,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}}}
+{"type":"assistant/chunk","seq":5,"time":1784540790309,"data":{"turn":1,"step":1,"chunk":{"type":"tool-call-delta","index":0,"id":"call_root_child","name":"subagent","argumentsDelta":"{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}"}}}
+{"type":"assistant/chunk","seq":6,"time":1784540790309,"data":{"turn":1,"step":1,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_root_child","name":"subagent","arguments":"{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}"}}}}
+{"type":"assistant/chunk","seq":7,"time":1784540790309,"data":{"turn":1,"step":1,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":5}}}}
+{"type":"assistant/chunk","seq":8,"time":1784540790309,"data":{"turn":1,"step":1,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}}
+{"type":"assistant/message","seq":9,"time":1784540790310,"data":{"turn":1,"step":1,"content":[{"type":"tool-call","id":"call_root_child","name":"subagent","arguments":"{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":5}},"sourceEventSeqs":[4,5,6,7,8],"surfaceOp":"append"}
+{"type":"tool/call","seq":10,"time":1784540790310,"data":{"turn":1,"step":1,"callId":"call_root_child","name":"subagent","arguments":"{\"description\":\"Start depth one\",\"prompt\":\"Call subagent once. Ask that child to attempt one further subagent call, then report the result.\"}"}}
+{"type":"tool/result","seq":11,"time":1784540790381,"data":{"turn":1,"step":1,"callId":"call_root_child","content":[{"type":"text","text":"DEPTH_ONE_DONE"}],"isError":false},"sourceEventSeqs":[10],"surfaceOp":"append"}
+{"type":"step/end","seq":12,"time":1784540790382,"data":{"turn":1,"step":1}}
+{"type":"step/start","seq":13,"time":1784540790382,"data":{"turn":1,"step":2}}
+{"type":"assistant/chunk","seq":14,"time":1784540790383,"data":{"turn":1,"step":2,"chunk":{"type":"block-start","index":0,"blockType":"text"}}}
+{"type":"assistant/chunk","seq":15,"time":1784540790383,"data":{"turn":1,"step":2,"chunk":{"type":"text-delta","index":0,"text":"ROOT_DONE"}}}
+{"type":"assistant/chunk","seq":16,"time":1784540790383,"data":{"turn":1,"step":2,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"ROOT_DONE"}}}}
+{"type":"assistant/chunk","seq":17,"time":1784540790383,"data":{"turn":1,"step":2,"chunk":{"type":"usage","usage":{"inputTokens":10,"outputTokens":2}}}}
+{"type":"assistant/chunk","seq":18,"time":1784540790383,"data":{"turn":1,"step":2,"chunk":{"type":"finish","reason":{"kind":"stop"}}}}
+{"type":"assistant/message","seq":19,"time":1784540790383,"data":{"turn":1,"step":2,"content":[{"type":"text","text":"ROOT_DONE"}],"provenance":{"provider":"deepseek","model":"deepseek-v4-flash"},"usage":{"inputTokens":10,"outputTokens":2}},"sourceEventSeqs":[14,15,16,17,18],"surfaceOp":"append"}
+{"type":"step/end","seq":20,"time":1784540790383,"data":{"turn":1,"step":2}}
+{"type":"turn/end","seq":21,"time":1784540790383,"data":{"turn":1,"reason":{"kind":"completed"}}}

examples/acp-agent/tests/snapshots/subagent-depth-two-rejection/stdout.expected.jsonl

@@ -0,0 +1,6 @@
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":1,"agentInfo":{"name":"deepseek-harness-acp","version":"0.0.1"},"agentCapabilities":{"loadSession":true,"promptCapabilities":{"image":false,"audio":false,"embeddedContext":false}},"authMethods":[]}}
+{"jsonrpc":"2.0","id":2,"result":{"sessionId":"{{sessionId}}","configOptions":[{"id":"model","name":"Model","description":"Sets this session's provider and model.","category":"model","type":"select","currentValue":"[\"deepseek\",\"deepseek-v4-flash\"]","options":[{"value":"[\"deepseek\",\"deepseek-v4-flash\"]","name":"deepseek-v4-flash"},{"value":"[\"deepseek\",\"deepseek-v4-pro\"]","name":"deepseek-v4-pro"}]},{"id":"permission","name":"Permissions","description":"The session permission preset: each choice bundles a sandbox mode and an approval policy.","category":"mode","type":"select","currentValue":"danger-full-access","options":[{"value":"workspace-write","name":"workspace-write","description":"Write inside the workspace and permitted temporary directories; wider retries require approval."},{"value":"danger-full-access","name":"danger-full-access","description":"Full file access without approval prompts."}]}]}}
+{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"{{sessionId}}","update":{"sessionUpdate":"tool_call","toolCallId":"call_root_child","title":"subagent","kind":"other","status":"in_progress","rawInput":{"description":"Start depth one","prompt":"Call subagent once. Ask that child to attempt one further subagent call, then report the result."}}}}
+{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"{{sessionId}}","update":{"sessionUpdate":"tool_call_update","toolCallId":"call_root_child","status":"completed","content":[{"type":"content","content":{"type":"text","text":"DEPTH_ONE_DONE"}}]}}}
+{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"{{sessionId}}","update":{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"ROOT_DONE"}}}}
+{"jsonrpc":"2.0","id":3,"result":{"stopReason":"end_turn"}}

packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts

@@ -69,9 +69,8 @@ describe('startInProcessRun', () => {
   })
 
   it('counts a RESUMED child by its persisted header depth, not the absent runtime depth', async () => {
-    // The review-reproduced failure chain: a depth-1 child comes back from
-    // persistence with a fresh AgentOptions (no subagentDepth). Its header must
-    // stay authoritative, or maxDepth: 1 would let it delegate as top-level.
+    // Resume rebuilds runtime options, so the durable header must keep this
+    // depth-1 child from delegating as though it were top-level.
     const { ctx } = await setup([textResponse('unused')])
     const resumed = (await ctx.agents.create({
       sessionId: SessionId('resumed-child'),

packages/subagent/tool-subagent/README.md

@@ -22,7 +22,7 @@ With `run_in_background: true`, the tool registers the parent-owned task before
 | `agentOptions` | Default child options, currently including `model`. |
 | `persona` | Per-child persona; requires provider `persona` capability. |
 | `toolFilter` | Per-child global-tool restriction; requires `toolFilter` capability. |
-| `maxDepth` | Absolute delegation-depth cap, default `3` (`0` forbids delegation); a numeric cap requires the `depthLimit` capability and fails the mount without it. `'provider-managed'` sends no cap — for an out-of-process provider whose budget belongs to the child harness. A child AT the cap also loses this tool from its schema when the provider supports `toolFilter` (prompt-face hiding; the service still rejects on the execution face). |
+| `maxDepth` | Absolute delegation-depth cap, default `3` (`0` forbids delegation); a numeric cap requires the `depthLimit` capability and fails the mount without it. `'provider-managed'` sends no cap for an out-of-process provider whose budget belongs to the child harness. The tool stays visible at the cap; each attempted start checks the calling agent's current depth and returns an errored tool result when rejected. |
 
 ## Concurrency
 

packages/subagent/tool-subagent/src/index.ts

@@ -12,7 +12,7 @@ import z from 'schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { Agent, AgentOptions } from '@deepseek-ai/dsh-agent'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
-import { assertSubagentMaxDepth, delegationDepthOf } from '@deepseek-ai/dsh-subagent'
+import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent'
 import type { SubagentProvider, SubagentResult, SubagentRun, SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 import type { TaskOutcome } from '@deepseek-ai/dsh-tasks'
 
@@ -57,9 +57,8 @@ export interface Config {
    * Maximum child depth: a non-negative safe integer (default `3`; `0` forbids
    * delegation entirely), or `'provider-managed'` to send no cap. A numeric cap
    * requires the provider's `depthLimit` capability (mount fails loud
-   * otherwise), and a child AT the cap additionally loses this tool from its
-   * schema when the provider supports `toolFilter` — the prompt face of the
-   * budget; the service keeps rejecting on the execution face.
+   * otherwise). The provider checks the calling agent's current depth at every
+   * start; the tool remains model-visible so runtime policy owns rejection.
    * `'provider-managed'` is for an out-of-process provider (ACP) whose
    * recursion budget belongs to the child harness's own deployment.
    */
@@ -199,28 +198,15 @@ function providerWording(inheritsConversation: boolean): { description: string;
   }
 }
 
-function startRequest(
-  config: Config,
-  prompt: string,
-  parent: Agent,
-  signal: AbortSignal,
-  hideAtCapToolName: string | undefined,
-): SubagentStartRequest {
+function startRequest(config: Config, prompt: string, parent: Agent, signal: AbortSignal): SubagentStartRequest {
   const maxDepth = typeof config.maxDepth === 'number' ? config.maxDepth : undefined
-  // A child AT the cap cannot delegate further: deny it this tool so its
-  // schema hides what the service would reject anyway (prompt face; the
-  // depth check at start remains the execution face).
-  const childAtCap = maxDepth !== undefined && delegationDepthOf(parent) + 1 >= maxDepth
-  const toolFilter = childAtCap && hideAtCapToolName !== undefined
-    ? { ...config.toolFilter, deny: [...config.toolFilter?.deny ?? [], hideAtCapToolName] }
-    : config.toolFilter
   return {
     prompt: [{ type: 'text', text: prompt }],
     parent,
     signal,
     ...config.agentOptions !== undefined ? { agentOptions: config.agentOptions } : {},
     ...config.persona !== undefined ? { persona: config.persona } : {},
-    ...toolFilter !== undefined ? { toolFilter } : {},
+    ...config.toolFilter !== undefined ? { toolFilter: config.toolFilter } : {},
     ...maxDepth !== undefined ? { maxDepth } : {},
   }
 }
@@ -257,9 +243,6 @@ export function apply(ctx: Context, config: Config): void {
         + 'set maxDepth: \'provider-managed\' to leave the recursion budget to the provider',
       )
     }
-    // Schema hiding rides the child toolFilter, so it needs that capability;
-    // without it the depth check at start remains the only fence.
-    const hideAtCapToolName = provider.capabilities.toolFilter ? config.toolName ?? 'subagent' : undefined
     const wording = providerWording(provider.inheritsParentContext)
     const backgroundEnabled = config.enableRunInBackground !== false
     disposeTool = ctx.tools.register(defineTool({
@@ -314,7 +297,7 @@ export function apply(ctx: Context, config: Config): void {
               const controller = new AbortController()
               const start = ctx.subagents.start(
                 config.provider,
-                startRequest(config, args.prompt, parent, controller.signal, hideAtCapToolName),
+                startRequest(config, args.prompt, parent, controller.signal),
               )
               return {
                 cancel: (reason?: string) => {
@@ -333,7 +316,6 @@ export function apply(ctx: Context, config: Config): void {
           args.prompt,
           parent,
           exec.signal ?? new AbortController().signal,
-          hideAtCapToolName,
         )
 
         const run: SubagentRun = await ctx.subagents.start(config.provider, request)

packages/subagent/tool-subagent/tests/tool-subagent.spec.ts

@@ -23,13 +23,9 @@ import { SessionId } from '@deepseek-ai/dsh-session'
  * shipping code path.
  */
 
-/** A minimal parent Agent: the tool reads `agent.id` plus the delegation depth off its header/options. */
-function fakeAgent(id = 'parent-1', delegationDepth?: number): Agent {
-  return {
-    id: SessionId(id),
-    options: {},
-    session: { header: { ...delegationDepth === undefined ? {} : { delegationDepth } } },
-  } as unknown as Agent
+/** A minimal parent Agent passed through to the provider request. */
+function fakeAgent(id = 'parent-1'): Agent {
+  return { id: SessionId(id) } as unknown as Agent
 }
 
 async function setup(toolConfig: tool.Config, mockConfig: Partial<mock.Config> = {}) {
@@ -886,7 +882,7 @@ describe('background preflight failure (no orphaned child, by construction)', ()
   })
 })
 
-describe('depth budget defaults and schema hiding', () => {
+describe('depth budget configuration', () => {
   /** Mount the tool over a request-capturing provider with full capabilities. */
   async function captureSetup(config: Omit<tool.Config, 'provider'> = {}) {
     const requests: SubagentStartRequest[] = []
@@ -916,37 +912,14 @@ describe('depth budget defaults and schema hiding', () => {
     const { ctx, requests } = await captureSetup()
     await callSubagent(ctx, { description: 'd', prompt: 'p' })
     expect(requests[0]?.maxDepth).toBe(3)
-    expect(requests[0]?.toolFilter?.deny ?? []).not.toContain('subagent')
-  })
-
-  it('denies its own toolName to a child at the depth cap', async () => {
-    // The child of a depth-0 parent under maxDepth 1 sits AT the cap: any
-    // delegation it attempted would be rejected, so the tool must not appear in
-    // its schema at all (prompt-face hiding; the service still rejects).
-    const { ctx, requests } = await captureSetup({ maxDepth: 1 })
-    await callSubagent(ctx, { description: 'd', prompt: 'p' })
-    expect(requests[0]?.toolFilter?.deny).toContain('subagent')
-  })
-
-  it('merges the cap denial into a configured tool filter', async () => {
-    const { ctx, requests } = await captureSetup({ toolFilter: { deny: ['dangerous'] }, maxDepth: 1 })
-    await callSubagent(ctx, { description: 'd', prompt: 'p' })
-    expect(requests[0]?.toolFilter?.deny).toEqual(expect.arrayContaining(['dangerous', 'subagent']))
+    expect(requests[0]?.toolFilter).toBeUndefined()
   })
 
-  it('keeps the tool visible for a child below the cap', async () => {
-    const { ctx, requests } = await captureSetup({ maxDepth: 2 })
+  it('forwards an explicit tool filter unchanged instead of encoding the depth policy into it', async () => {
+    const { ctx, requests } = await captureSetup({ toolFilter: { deny: ['dangerous'] }, maxDepth: 0 })
     await callSubagent(ctx, { description: 'd', prompt: 'p' })
-    expect(requests[0]?.maxDepth).toBe(2)
-    expect(requests[0]?.toolFilter?.deny ?? []).not.toContain('subagent')
-  })
-
-  it('counts the parent by its persisted header depth when hiding', async () => {
-    // A resumed depth-1 parent under maxDepth 2: its child is AT the cap and
-    // must lose the tool even though the parent's runtime options carry no depth.
-    const { ctx, requests } = await captureSetup({ maxDepth: 2 })
-    await callSubagent(ctx, { description: 'd', prompt: 'p' }, { agent: fakeAgent('resumed-parent', 1) })
-    expect(requests[0]?.toolFilter?.deny).toContain('subagent')
+    expect(requests[0]?.maxDepth).toBe(0)
+    expect(requests[0]?.toolFilter).toEqual({ deny: ['dangerous'] })
   })
 
   it('rejects a numeric maxDepth on a provider without the depthLimit capability at mount', async () => {

packages/support/acp-snapshot/src/suite.ts

@@ -100,18 +100,6 @@ export interface Scenario {
    * {@link headerClass}.
    */
   configPath?: string
-  /**
-   * Global tool names allowed to be ABSENT from a non-primary (child) session's
-   * request/header relative to the class pin — the delegation tool a child at
-   * its depth cap loses to tool-subagent's schema hiding. Each child header is
-   * compared against the pin minus exactly the declared names it actually
-   * omitted, so any other divergence (or an undeclared omission) still fails.
-   * A child that omitted a declared tool also skips the text-level initial
-   * system prompt pin: the prompt embeds the toolset (Code Mode SDK sections),
-   * so a reduced child cannot equal the full-composition expected output — the
-   * structural header assertion remains its pin. Meaningless on the primary log.
-   */
-  childToolOmissions?: string[]
 }
 
 /** One suite's inputs: the agent to boot, where its fixtures live, and its scenario table. */
@@ -294,36 +282,6 @@ export function restorePinnedToolSchemas(header: unknown, schemas: readonly unkn
   return { ...header, tools: schemas }
 }
 
-/**
- * The pinned header with exactly the DECLARED omissions a child actually made
- * removed from its tool list. A child at its depth cap legitimately lacks the
- * delegation tool that spawned it (tool-subagent schema hiding); removing only
- * declared-AND-actually-absent names keeps every other divergence — including
- * an undeclared omission — a loud mismatch.
- * @param pinned The class-pinned full header (tool schemas restored).
- * @param actual The child session's normalized header under comparison.
- * @param allowed The scenario's declared {@link Scenario.childToolOmissions}.
- * @returns The expected header for this child log.
- */
-export function applyChildToolOmissions(pinned: unknown, actual: unknown, allowed: readonly string[]): unknown {
-  if (pinned === null || typeof pinned !== 'object' || Array.isArray(pinned)) {
-    throw new Error('acp-snapshot: pinned request header must be an object')
-  }
-  const toolNames = (header: unknown): Set<string> => {
-    const tools = (header as { tools?: unknown }).tools
-    return new Set(Array.isArray(tools)
-      ? tools.map(tool => (tool as { name?: unknown }).name).filter((name): name is string => typeof name === 'string')
-      : [])
-  }
-  const actualNames = toolNames(actual)
-  const pinnedTools = (pinned as { tools?: unknown[] }).tools ?? []
-  const tools = pinnedTools.filter((tool) => {
-    const name = (tool as { name?: unknown }).name
-    return !(typeof name === 'string' && allowed.includes(name) && !actualNames.has(name))
-  })
-  return { ...pinned, tools }
-}
-
 /**
  * Render a normalized prompt as a repository-friendly Markdown snapshot.
  * Prompt text is unchanged except that a missing terminal newline is added so
@@ -667,20 +625,9 @@ export function defineAcpSnapshotSuite(options: SnapshotSuiteOptions): void {
             .toBe(headers.length)
           for (const [k, header] of headers.entries()) {
             const expected = expectedChanges > 0 ? pinnedHeaders[k] : pinnedHeaders[0]
-            // A child (non-primary) log may omit declared delegation tools —
-            // schema hiding at the depth cap; see Scenario.childToolOmissions.
-            const childOmissions = logIndex === 0 ? [] : scenario.childToolOmissions ?? []
-            const target = childOmissions.length === 0
-              ? expected
-              : applyChildToolOmissions(expected, header, childOmissions)
             expect(header, `session ${log.id}: request/header #${k + 1} diverged from the pinned (${pinningScenario.name}) header`)
-              .toEqual(target)
-            // A child that omitted a declared tool cannot equal the text-level
-            // prompt pin (the prompt embeds the toolset); its header assertion
-            // above remains the structural pin.
-            const omittedDeclaredTool = target !== expected
-              && (target as { tools?: unknown[] }).tools?.length !== (expected as { tools?: unknown[] }).tools?.length
-            if (expectedChanges === 0 && !omittedDeclaredTool) {
+              .toEqual(expected)
+            if (expectedChanges === 0) {
               expect(formatSystemPromptSnapshot(prompts[k] as string), `session ${log.id}: initial system prompt #${k + 1} diverged from ${pinningScenario.name}/${SYSTEM_PROMPT_SNAPSHOT}`)
                 .toEqual(initialPromptSnapshot)
             }

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/behavior.json

@@ -1,116 +0,0 @@
-{
-  "prompt": "respond",
-  "echoWorkspace": true,
-  "logs": [
-    {
-      "file": "b/parent.jsonl",
-      "lines": [
-        {
-          "type": "session",
-          "id": "{{SID}}",
-          "createdAt": 200,
-          "cwd": "{{CWD}}"
-        },
-        {
-          "type": "request/header",
-          "seq": 0,
-          "time": 5,
-          "data": {
-            "header": {
-              "config": {
-                "model": "fake"
-              },
-              "system": "SYS PROMPT",
-              "tools": [
-                {
-                  "name": "t1",
-                  "description": "D1",
-                  "parameters": {
-                    "type": "object"
-                  }
-                }
-              ]
-            },
-            "reason": "initial"
-          }
-        },
-        {
-          "type": "assistant/chunk",
-          "seq": 1,
-          "time": 5,
-          "data": {
-            "turn": 1,
-            "step": 1,
-            "chunk": {
-              "type": "text-delta",
-              "index": 0,
-              "text": "hi"
-            }
-          }
-        }
-      ]
-    },
-    {
-      "file": "b/child1.jsonl",
-      "lines": [
-        {
-          "type": "session",
-          "id": "eeeeeeee-1111-4222-8333-444444444444",
-          "createdAt": 300,
-          "cwd": "{{CWD}}",
-          "parentSession": "{{SID}}"
-        },
-        {
-          "type": "request/header",
-          "seq": 0,
-          "time": 6,
-          "data": {
-            "header": {
-              "config": {
-                "model": "fake"
-              },
-              "system": "SYS PROMPT",
-              "tools": []
-            },
-            "reason": "initial"
-          }
-        }
-      ]
-    },
-    {
-      "file": "b/child2.jsonl",
-      "lines": [
-        {
-          "type": "session",
-          "id": "ffffffff-2222-4333-8444-555555555555",
-          "createdAt": 400,
-          "cwd": "{{CWD}}",
-          "parentSession": "{{SID}}"
-        },
-        {
-          "type": "request/header",
-          "seq": 0,
-          "time": 6,
-          "data": {
-            "header": {
-              "config": {
-                "model": "fake"
-              },
-              "system": "SYS PROMPT",
-              "tools": [
-                {
-                  "name": "t1",
-                  "description": "D1",
-                  "parameters": {
-                    "type": "object"
-                  }
-                }
-              ]
-            },
-            "reason": "initial"
-          }
-        }
-      ]
-    }
-  ]
-}

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/input.json

@@ -1 +0,0 @@
-{ "steps": [{ "op": "initialize" }, { "op": "newSession" }, { "op": "prompt", "text": "plain" }] }

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/session.1.jsonl

@@ -1,2 +0,0 @@
-{"type":"session","id":"eeeeeeee-1111-4222-8333-444444444444","createdAt":12,"cwd":"/rec/plain-cwd","parentSession":"56565656-7878-4989-8a9a-9b9b9b9b9b9b"}
-{"type":"request/header","seq":0,"time":12,"data":{"header":{"config":{"model":"fake"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/session.2.jsonl

@@ -1,2 +0,0 @@
-{"type":"session","id":"ffffffff-2222-4333-8444-555555555555","createdAt":13,"cwd":"/rec/plain-cwd","parentSession":"56565656-7878-4989-8a9a-9b9b9b9b9b9b"}
-{"type":"request/header","seq":0,"time":12,"data":{"header":{"config":{"model":"fake"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/session.jsonl

@@ -1,3 +0,0 @@
-{"type":"session","id":"56565656-7878-4989-8a9a-9b9b9b9b9b9b","createdAt":11,"cwd":"/rec/plain-cwd"}
-{"type":"request/header","seq":0,"time":11,"data":{"header":{"config":{"model":"fake"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
-{"type":"assistant/chunk","seq":1,"time":11,"data":{"turn":1,"step":1,"chunk":{"type":"text-delta","index":0,"text":"hi"}}}

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/stdout.expected.jsonl

@@ -1,5 +0,0 @@
-{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":1,"agentCapabilities":{"loadSession":false}}}
-{"jsonrpc":"2.0","id":2,"result":{"sessionId":"{{sessionId}}"}}
-{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"{{sessionId}}","update":{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"thinking about it"}}}}
-{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"{{sessionId}}","update":{"sessionUpdate":"agent_message_chunk","content":{"type":"text","text":"workspace:seed.txt"}}}}
-{"jsonrpc":"2.0","id":3,"result":{"stopReason":"end_turn"}}

packages/support/acp-snapshot/tests/fixtures/suite/child-omission/workspace/seed.txt

@@ -1 +0,0 @@
-seeded

packages/support/acp-snapshot/tests/suite.spec.ts

@@ -16,7 +16,6 @@ import {
   parseToolSchemasSnapshot,
   refreshFixtureReplacements,
   sessionFixtureNames,
-  applyChildToolOmissions,
   restorePinnedToolSchemas,
   stabilizeRefreshLog,
   unknownToolCallIds,
@@ -48,10 +47,6 @@ const RECORD_SRC = fileURLToPath(new URL('./fixtures/record-suite', import.meta.
 const REPLAY_SCENARIOS: Scenario[] = [
   { name: 'pin-turn', hasModelTurn: true, recorded: true, pinsHeader: true, expectedHeaderChanges: 1, headerClass: 'main' },
   { name: 'plain-turn', hasModelTurn: true, recorded: true, headerClass: 'main', configPath: AGENT.configPath },
-  // Two scripted children under a declared omission: one omits t1 (header pin
-  // minus the declared tool, prompt pin skipped), one keeps the full set (pin
-  // and prompt compared verbatim) — the childToolOmissions branches.
-  { name: 'child-omission', hasModelTurn: true, recorded: false, headerClass: 'main', childToolOmissions: ['t1'] },
   { name: 'no-model', hasModelTurn: false, recorded: false, headerClass: 'main' },
   { name: 'blocked-log', hasModelTurn: false, comparesLog: true, recorded: false, headerClass: 'main' },
   { name: 'authored-error', hasModelTurn: true, recorded: false, overridden: true, headerClass: 'main' },
@@ -371,37 +366,6 @@ describe('tool-schema snapshots', () => {
   })
 })
 
-describe('applyChildToolOmissions', () => {
-  const pinned = { system: 's', tools: [{ name: 'bash' }, { name: 'subagent' }, { name: 'subagent_fork' }] }
-
-  it('removes exactly the declared tools the child actually omitted', () => {
-    const actual = { system: 's', tools: [{ name: 'bash' }, { name: 'subagent_fork' }] }
-    expect(applyChildToolOmissions(pinned, actual, ['subagent', 'subagent_fork']))
-      .toEqual({ system: 's', tools: [{ name: 'bash' }, { name: 'subagent_fork' }] })
-  })
-
-  it('keeps a declared tool the child still carries and an undeclared omission', () => {
-    // The child omitted `bash` (undeclared) — the expectation keeps it, so the
-    // equality assertion downstream still fails loudly on the real divergence.
-    const actual = { system: 's', tools: [{ name: 'subagent' }, { name: 'subagent_fork' }] }
-    expect(applyChildToolOmissions(pinned, actual, ['subagent']))
-      .toEqual(pinned)
-  })
-
-  it('tolerates a headerless tool list and unnamed tool entries', () => {
-    expect(applyChildToolOmissions({ system: 's' }, { tools: 'not-an-array' }, ['subagent']))
-      .toEqual({ system: 's', tools: [] })
-    const unnamed = { system: 's', tools: [{ name: 42 }] }
-    expect(applyChildToolOmissions(unnamed, { tools: [] }, ['subagent'])).toEqual(unnamed)
-  })
-
-  it('rejects a non-object pinned header', () => {
-    expect(() => applyChildToolOmissions(null, {}, [])).toThrow(/must be an object/)
-    expect(() => applyChildToolOmissions([], {}, [])).toThrow(/must be an object/)
-    expect(() => applyChildToolOmissions('x', {}, [])).toThrow(/must be an object/)
-  })
-})
-
 describe('unknownToolCallIds', () => {
   it('returns structured UNKNOWN_TOOL call ids and ignores other results', () => {
     const log = [