[BUG] Subagents in plan mode can read files outside the working dir

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In plan mode, sub agents spawned with the agent tool are not bound to the working directory. As a result, they can read any file on the operating system. This makes working with the plan tool explicitly uncomfortable and dangerous as you need to deny all tools upfront globally (e.g. the read file tool) which it should not use on different folders on your OS.

What Should Happen?

When the subagent in plan mode wants to read a file outside of the working directory, it should issue a request to read that file.

Error Messages/Logs

Steps to Reproduce

1. Create a test file ~/test.txt with random content
2. create a test working directory claude-test
3. open a new claude session and go to plan mode
4. Ask to spawn a subagent and read the file content of ~/test.txt

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.187

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

_No response_