[But] Subagent Write tool blocked for report-style filenames (e.g. findings.md) despite explicit tools: Write grant

Summary

Subagents invoked via the Agent tool (Task tool) are blocked from using their Write tool when the target filename matches a "report-style" pattern (e.g. findings.md), even when Write is explicitly granted in the subagent's frontmatter tools: list and the subagent has no other job. Instead of writing the file, the call is intercepted and the subagent is told to return the content as text instead.

This appears to be an undocumented, filename-pattern-based guard enforced at the harness/platform level — not something configured via local settings.json, policy-limits.json, or remote-settings.json in the project.

Minimal repro

Subagent definition (.claude/agents/writer.md):

---
name: writer
description: "Writes a hardcoded string to a fixed report-style filename. Use only for reproducing a Write-tool bug."
tools: Write
---

# Writer

You are **Writer**. Your only job is a single Write tool call.

## Procedure

1. Use your Write tool to create a file named `findings.md` in the current
   working directory. The content must be exactly this one line:

   `hello from writer subagent`

2. Report back plainly whether the Write call succeeded or was blocked. If
   it was blocked or rejected, quote the exact error/message you received,
   verbatim, in full.

Invocation: launch this subagent with no special instructions (frontmatter is self-contained).

Observed result

The Write call is blocked every time (reproduced across multiple runs), with this verbatim message returned to the subagent in place of a tool result:

Subagents should return findings as text, not write report files. Include this content in your final response instead.

findings.md is never created on disk — confirmed via directory listing after each run.

Expected result

If a subagent is explicitly granted tools: Write in its frontmatter, it should be able to write to any filename the parent session's permissions would otherwise allow — including report-style names like findings.md, summary.md, etc. There's no documented restriction on subagent output filenames, and this blocks legitimate multi-agent pipelines (e.g. researcher → summarizer) that rely on subagents persisting intermediate/final output to disk rather than passing arbitrarily large content back through the text channel.

Contrast case (verified working)

The identical subagent pattern — same tools: Write grant, same single-Write-call procedure, same "report back plainly" instructions — but targeting a different, non-report-style filename (notes_output.md instead of findings.md) writes successfully. Only the filename differs:

---
name: writer
description: "Writes a hardcoded string to a fixed non-report filename. Use only for reproducing/contrasting a Write-tool bug."
tools: Write
---

# Writer

You are **Writer**. Your only job is a single Write tool call.

## Procedure

1. Use your Write tool to create a file named `notes_output.md` in the
   current working directory. The content must be exactly this one line:

   `hello from writer subagent`

Result: notes_output.md is created on disk with the exact content hello from writer subagent — no block, no intercepted message. Verified directly by reading the file back after the subagent run.

This isolates the variable: it's not Write access for subagents in general that's blocked, and not something about the subagent config — it's specifically the filename. Names like findings.md / summary.md (generic "report" nouns) trigger the guard; a name like notes_output.md does not. This strongly suggests a filename-pattern-based heuristic (e.g. matching against words like "findings", "summary", "report") applied specifically to subagent Write calls, rather than a general permissions restriction.

Environment

• Claude Code (CLI), invoked via VSCode native extension / Claude Agent SDK
• Model: Sonnet 5 (claude-sonnet-5)
• Platform: macOS (Darwin 23.6.0)
• No relevant rule found in local settings.json / policy-limits.json / remote-settings.json