[Bug] Plugin-scoped subagent definitions silently ignored in agent teams

Reproducing the same underlying bug on v2.1.211 but on a different spawn path — worth folding in so whoever fixes the source filter covers both entry points.

Environment

• Version: 2.1.211
• Platform: Linux (Ubuntu 24.04)
• Env: CLAUDE_CODE_WORKFLOWS=1, DISABLE_GROWTHBOOK=1
• Plugin installed from a third-party marketplace, cache at ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/agents/<agent>.md — SHA1 matches source frontmatter, so it's not a cache-staleness problem.

Repro (Agent-tool spawn, not TeamCreate)

Plugin subagent frontmatter:

---
name: <plugin>:<lead-agent>
description: ...
tools: Read, Glob, Grep, Bash, Agent, SendMessage, TaskCreate, TaskUpdate, TaskList, TeamCreate, Workflow
---

From the main loop:

Agent({ subagent_type: "<plugin>:<lead-agent>", prompt: "..." })

The subagent spawns, but when it introspects its own system prompt it reports only 4 tools available: Read, Bash, Agent, SendMessage. The other 7 declared in frontmatter (Glob, Grep, TaskCreate, TaskUpdate, TaskList, TeamCreate, Workflow) are missing. Confirmed across two consecutive CLI sessions (fresh restart, cache cleared).

Delta vs the teammate-spawn path in the OP

The failure mode is the same root cause (plugin frontmatter dropped) but the fallback differs between the two paths, which is useful signal for the fix:

| Path | OP (handleSpawnInProcess — teammate) | Agent tool (subagent_type from main loop) |
|---|---|---|
| Body appended? | No | Yes (the subagent's role prompt loads) |
| Frontmatter tools: honored? | No | No |
| Effective toolset | ["*"] (vanilla — inherits everything) | Truncated to a small default (Read, Bash, Agent, SendMessage) |
| Frontmatter model: honored? | No | (not tested) |

So the teammate path collapses to "no definition applied at all" and the Agent-tool path collapses to "body applied, tool allowlist silently replaced by a hard-coded default." Both silently degrade — no error surfaced either way.

Impact

Any plugin that ships a main-loop → lead subagent → workers topology is partially inoperative on 2.1.211: workers that need Write/Edit to modify code, Glob/Grep to search, or Workflow to invoke deterministic orchestration cannot perform their role. Fallback in practice is having the main loop take over the lead-subagent's job, which defeats the plugin architecture.

Prior history

#47898 reported the same class of bug against the Agent-tool spawn path back in April 2026 and was auto-closed as stale in May without a fix. Given #78234 covers the teammate path on the same runtime version, a shared fix is likely.

We've hit the same silent drop at larger scale and measured the blast radius. Three data points beyond what's in the issue body:

1. The degraded teammate doesn't just lose the definition — it gains tools the definition excluded. Our plugin ships review lenses with positive tools: allowlists (Read, Bash, Grep, Glob, TaskStop). Spawned with a name in an interactive session, the same subagent_type came up as a vanilla teammate holding Agent, Artifact, Bash, Edit, Read, Skill, ToolSearch, Write — i.e. write, delegation, and publishing capabilities the allowlist was built to withhold. Across 53 named dispatches of our plugin lenses, 0 resolved the definition (plain spawns of the same types resolve fine). Downstream we logged 9 real working-tree writes from "read-only" reviewers, and one leaf agent successfully spawning sub-agents — the teammate's own spawnDepth is 0, so leaf restrictions don't apply structurally.

1. Cost side-effect: each degraded teammate gets the full deferred-tool schema block injected — measured 27,469 bytes of deferred_tools_delta (plus 15,445 bytes of skill listing; 42,914 bytes ≈ 12k tokens per spawn). The skill listing appears to be documented teammate behavior; the deferred-tools delta contradicting the definition's tools: allowlist is the defect half.

1. Headless probes can't reproduce it. With claude -p, passing name does not take the in-process-teammate path — the bug only manifests in interactive sessions, so scripted probes/CI stay green. Repro'd as of 2.1.23x, macOS (2026-08-18).

The silent form is the damaging part for us too: it turns an authorization boundary into a false assurance — state records say "allowlist in place" while reviewers effectively run with the full toolset. Failing loudly (or honoring plugin scope as documented) would both be fine outcomes.

Still present in Version: 2.1.280 Windows

This bug completely prevents any plugin that has agent definitions from being used in agent teams CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 whenever the agents are named.

In my case, it makes the plugin I'm developing completely unusable.