fix(security): restrict subagent toolsets to parent's enabled set

[dieutx]

Summary

The delegate_task tool lets the LLM request arbitrary toolsets for subagents, including ones the user explicitly disabled for the parent. A model calling delegate_task(toolsets=["terminal", "file", "web", "browser"]) when the parent only has ["terminal", "file"] grants the subagent web and browser — a privilege escalation.

Root Cause

_build_child_agent() at delegate_tool.py:177 passes LLM-provided toolsets through _strip_blocked_tools (which removes delegation, clarify, memory, code_execution) but never intersects with the parent's enabled_toolsets. The blocked-tool filter is a different, smaller set than the user's tool restrictions.

Fix

Intersect before filtering (tools/delegate_tool.py)

parent_toolsets = set(getattr(parent_agent, "enabled_toolsets", None) or DEFAULT_TOOLSETS)
if toolsets:
    child_toolsets = _strip_blocked_tools([t for t in toolsets if t in parent_toolsets])

The no-toolsets path (child inherits parent's full set) and the blocked-tools filter are both unchanged.

Tests

5 new tests: intersection drops extras, subset passes through, no-toolsets inherits parent, blocked tools still removed, empty intersection yields empty set.

5 passed

[teknium1]

Merged via PR #3269. Your commit was cherry-picked onto current main with original authorship preserved. Good catch on the privilege escalation — subagent toolsets are now intersected with the parent's enabled set before filtering. Thanks!