[FEATURE] Mods: let agent.spawn rewrite cwd and prompt for dynamic-workflow agents, as it does for Agent-tool spawns

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet (closest: #91870, the general mods thread; #12748 asks for a cwd on the Task tool, which exists now for Agent-tool spawns)
• [x] This is a single feature request (not multiple features)

Problem Statement

I maintain a mod (plugin hooks module) that gives every subagent an orchestrator dispatches its own git worktree, a registered check that runs when it returns, a write boundary enforced in tool.call, and a ledger row. For agents spawned through the Agent tool this works because the agent.spawn hook may rewrite prompt and cwd (AgentSpawnInput: "A hook rewrites content (prompt, description, subagentType, model, background, cwd)").

For agents a dynamic workflow spawns (subagentType: "workflow-subagent", with workflow { runId, agentIndex } on the event since 2.1.292), the same hook may only refuse. On 2.1.294 the engine prints: agent.spawn hook: prompt, cwd were ignored: a hook can only refuse a workflow agent's spawn. So a mod cannot place a workflow agent in an isolated worktree or append substrate instructions before it starts. The only workaround I found (refuse the agent's first tool call with the worktree path as the reason, so it moves itself) leaks: when the agent's first message carries two tool calls in parallel, one is refused and the other runs in the base repository.

Proposed Solution

Let agent.spawn rewrite cwd and prompt (and description, model) for workflow agents exactly as it does for Agent-tool spawns, with the same pinned fields. A workflow script's agent() call would then run its agent in the directory and with the prompt the mod settled, and the script's own isolation: "worktree" option would compose with it (the mod's rewrite applies after the runtime's own choice, or the runtime refuses the rewrite and says so).

Alternative Solutions

• Refusing the first tool call (above): leaks on parallel tool calls, and Bash writes can only be audited, not placed.
• Rewriting the Workflow tool's script at the main-loop tool.call to add isolation: "worktree" to every agent(): gives isolation but not the mod's prompt, check or boundary.
• Running script-shaped plans inside the mod instead of the Workflow tool: what we do now; loses the workflow runtime's resume, stall handling and progress view.

Priority

High - Significant impact on productivity

Feature Category

Developer tools/SDK

Use Case Example

1. An orchestrator writes a dynamic workflow: a writer role fans out over 20 files, a reviewer role checks each.
2. The mod's agent.spawn hook sees each workflow agent (run id and index), cuts a worktree, sets cwd to it and appends "work only in <path>; a check runs when you return".
3. The agent edits in its worktree; the mod's tool.call hook denies writes outside the boundary; on turn.complete the mod runs the registered check and records the result.
4. The script continues with isolated, checked, recorded work, and the main conversation never carries the details.

Environment: Claude Code 2.1.294, macOS 25.3, plugin hooks module (mods). Probe details available on request.