[FEATURE] Agent(agent_type) allowlist in tools has no effect inside a nested subagent definition

Summary

Inside a custom subagent definition, tools: Agent(inner) does not restrict which subagent types that subagent can spawn. The type list is accepted but ignored, so the only way to give a named subagent spawning ability is unrestricted spawning. There is no way to declare a per-subagent spawn allowlist.

Environment

Claude Code 2.1.259, macOS 15 (Darwin 25.1.0), subscription auth, claude -p --agents with inline definitions (same result with ~/.claude/agents/*.md).

Reproduction

agents.json:

{"outer_typed":{"description":"probe","tools":["Read","Agent(inner)"],"model":"haiku",
  "prompt":"When asked: call Agent with subagent_type inner, then call Agent with subagent_type other. Report both results."},
 "inner":{"description":"probe","tools":["Read"],"model":"haiku","prompt":"Reply PONG-INNER."},
 "other":{"description":"probe","tools":["Read"],"model":"haiku","prompt":"Reply PONG-OTHER."}}

claude -p --model haiku --setting-sources '' --agents "$(cat agents.json)" \
  "Spawn the agent named outer_typed with the prompt 'do your probe now', wait for it, return its report."

Observed: both nested spawns succeed. The subagent transcripts show Agent{subagent_type: inner} and Agent{subagent_type: other} tool calls from outer_typed, and both children replied. Expected: the other spawn is refused, as it is when the same Agent(inner) rule is applied to the main thread.

Control: a session-wide permissions.deny: ["Agent(other)"] passed via --settings DOES refuse the nested spawn ("Agent type 'other' has been denied by permission rule 'Agent(other)' from flagSettings"), so the deny path reaches nested calls; only the per-subagent allowlist does not.

Docs

code.claude.com/docs/en/sub-agents.md states this as current behaviour: "The Agent(agent_type) allowlist syntax applies only to an agent running as the main thread with claude --agent. In a subagent definition, listing Agent in tools lets that subagent spawn subagents of its own while the depth limit allows it, but any type list inside the parentheses is ignored." No rationale is given.

Why it matters

Nested spawning is on by default (depth 3 since 2.1.219). An orchestrator persona that should only fan out to, say, worker and researcher can today spawn any type at any model tier. The only per-subagent enforcement available is a PreToolUse:Agent hook that reads the caller's agent_type and re-implements the allowlist check that the frontmatter already expresses.

Request

Honour Agent(type, ...) in a subagent definition the same way it is honoured for the main thread (allowlist; other types fail with the existing denial message), or document the reason it cannot be.