Subagents Awareness of Active Approval Modes

[jerop]

Subagents currently lack awareness of the active Approval Mode (e.g., Plan Mode or Auto-Edit Mode). While the Policy Engine blocks tool calls that violate a mode's constraints, the subagents' own instructions and tool definitions often conflict with these realities. For example, a "Generalist Agent" might attempt to perform a "batch refactoring" in Plan Mode. We need to reconcile the subagents tools with policy rules for approval modes.

[akh64bit]

Based on an analysis of how subagents currently interact with Approval Modes, here are more details on the underlying issues:

Case 1: Plan Mode

Scenario: A custom subagent with write tools configured is delegated a task while the user is in Plan Mode.
Current Behavior: The subagent's write tools are correctly blocked by the global PolicyEngine (via the plan.toml policies). However, the subagent itself is entirely unaware that it is operating in Plan Mode. Its static system prompt and internal tool schemas do not reflect this restriction.
Result: The subagent may repeatedly attempt to use its write tools to modify code directly, resulting in a failure loop and wasted tokens, instead of gracefully adapting its strategy to writing .md plans.

Case 2: Auto-Edit Mode

Scenario: A custom subagent without write tools configured is delegated a task while the user is in Auto-Edit Mode.
Current Behavior: The subagent cannot write files. It only has access to the tools explicitly declared in its toolConfig.tools.
Result: This is the correct and safe behavior. The global Auto-Edit Mode acts as a confirmation bypass for existing capabilities; it does not grant new tools to a subagent that was intentionally designed to be read-only.

Core Problems Identified

1. Missing System Prompt Context: Custom subagents (and built-in ones like the Generalist) receive a static systemPrompt upon creation. Unlike the main interactive agent, they do not automatically receive the contextual "Plan Mode" prompt snippets explaining that their write capabilities are globally restricted to the plans/ directory.
2. Misleading Agent Descriptions for Routing: Subagent descriptions (e.g., Generalist Agent's claim to handle "batch refactoring") are statically advertised to the semantic Router. In Plan Mode, the router might still delegate a refactoring task to the Generalist Agent based on this description, setting it up for inevitable failure since it cannot perform the refactoring.
3. Tool Registry Context Mismatch: While the ToolRegistry does dynamically append a Plan Mode warning ("ONLY FOR PLANS:") to schemas like write_file, this is often insufficient to override the subagent's core system prompt which might forcefully instruct it to perform general code refactoring.

To resolve this, subagents need their system prompts and routing descriptions to dynamically react to the active ApprovalMode (e.g., within LocalAgentExecutor and the Agent Registry).