fix(agents): retain tools for direct completion delivery

src/agents/command/attempt-execution.cli.test.ts

@@ -228,15 +228,22 @@ const SUBAGENT_ANNOUNCE_DELIVERY_CASES: readonly SubagentAnnounceDeliveryCase[]
 ];
 
 const SUBAGENT_ANNOUNCE_EMBEDDED_DELIVERY_CASES: readonly SubagentAnnounceDeliveryCase[] = [
-  ...SUBAGENT_ANNOUNCE_DELIVERY_CASES.map((testCase) =>
-    testCase.name === "automatic source replies"
-      ? {
-          ...testCase,
-          expectedDisableTools: false,
-          expectedToolsAllow: SUBAGENT_ANNOUNCE_REQUESTER_TOOLS,
-        }
-      : testCase,
-  ),
+  ...SUBAGENT_ANNOUNCE_DELIVERY_CASES.map((testCase) => {
+    if (testCase.name === "automatic source replies") {
+      return {
+        ...testCase,
+        expectedDisableTools: false,
+        expectedToolsAllow: SUBAGENT_ANNOUNCE_REQUESTER_TOOLS,
+      };
+    }
+    if (!testCase.expectedDisableTools) {
+      return {
+        ...testCase,
+        expectedToolsAllow: testCase.runtimeToolsAllow ?? SUBAGENT_ANNOUNCE_REQUESTER_TOOLS,
+      };
+    }
+    return testCase;
+  }),
   {
     name: "a raw model run despite message-tool-only delivery",
     sourceReplyDeliveryMode: "message_tool_only",

src/agents/command/attempt-execution.ts

@@ -731,7 +731,10 @@ export function runAgentAttempt(params: {
     trustedSubagentAnnounceHandoff &&
     !isRawModelRun &&
     !isCliExecutionProvider &&
-    !messageToolOwnsVisibleReply(params.opts);
+    (!messageToolOwnsVisibleReply(params.opts) || completionNeedsMessageDelivery);
+  // Message-tool-only delivery constrains the visible reply, not the parent
+  // continuation's verified authority. Keep the inherited cap while requiring
+  // message to survive every applicable policy before enabling any tools.
   // An explicit cap is enforced even when tools are disabled; clear it so a
   // denied completion can finish tool-free and its owner can relay frozen text.
   const runtimeToolsAllow = isSubagentAnnounceHandoff