fix(server): let parents recover their delegated children across accounts

apps/server/src/mcp/McpToolAccess.test.ts

@@ -15,6 +15,7 @@ import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
 import { McpSchema, McpServer, Tool, Toolkit } from "effect/ai";
 
+import { DispatchModeLimit } from "../orchestration-v2/DispatchModeLimit.ts";
 import { OrchestratorProjectionError } from "../orchestration-v2/Orchestrator.ts";
 import * as PeerForwarding from "../peer/PeerForwarding.ts";
 import * as ThreadManagement from "../orchestration-v2/ThreadManagementService.ts";
@@ -31,6 +32,22 @@ const backgroundThreadId = ThreadId.make("thread:background");
 const oldProviderThreadId = ThreadId.make("thread:old-provider-background");
 const archivedThreadId = ThreadId.make("thread:archived-background");
 const unknownOwnerThreadId = ThreadId.make("thread:unknown-background-owner");
+const ownChildThreadId = ThreadId.make("thread:own-child");
+const forgedChildThreadId = ThreadId.make("thread:forged-child");
+const planChildThreadId = ThreadId.make("thread:plan-child");
+
+const childShell = (threadId: ThreadId, parentThreadId: ThreadId) => ({
+  ...liveThreadShell(threadId),
+  lineage: {
+    rootThreadId: parentThreadId,
+    parentThreadId,
+    relationshipToParent: "subagent" as const,
+  },
+});
+const appOwnedChildren = new Map([
+  [supervisedThreadId, [ownChildThreadId]],
+  [planThreadId, [planChildThreadId]],
+]);
 
 const backgroundShell = (threadId: ThreadId, providerInstanceId: ProviderInstanceId) => ({
   ...liveThreadShell(threadId, { activeRunId: null }),
@@ -63,6 +80,10 @@ const shells = new Map([
       pendingBackgroundTasks: [{ taskId: "task:unknown", kind: "subagent" as const }],
     },
   ],
+  [ownChildThreadId, childShell(ownChildThreadId, supervisedThreadId)],
+  // Says it is the supervised thread's child, but that thread never delegated it.
+  [forgedChildThreadId, childShell(forgedChildThreadId, supervisedThreadId)],
+  [planChildThreadId, childShell(planChildThreadId, planThreadId)],
 ]);
 
 const threadCaller = (threadId: ThreadId): McpInvocationContext.McpInvocationScope => ({
@@ -121,6 +142,10 @@ const ProbeToolkit = Toolkit.make(
     ...probe,
     parameters: Schema.Struct({ threadId: Schema.optional(ThreadId) }),
   }),
+  Tool.make("writes_own_children", {
+    ...probe,
+    parameters: Schema.Struct({ threadId: Schema.optional(ThreadId) }),
+  }),
   Tool.make("starts_threads", {
     ...probe,
     parameters: Schema.Struct({
@@ -141,6 +166,16 @@ const probeHandlers: McpToolAccess.Handlers<typeof ProbeToolkit.tools> = {
     (input) => [input.threadId],
     () => ran,
   ),
+  // Answers with the modes the orchestrator rechecks under its lock.
+  writes_own_children: McpToolAccess.writesThreads(
+    (input) => [input.threadId],
+    () =>
+      Effect.gen(function* () {
+        const limit = yield* DispatchModeLimit;
+        return { ran: `${limit?.runtimeMode}/${limit?.interactionMode}` };
+      }),
+    { ownChildren: "at-their-runtime-mode" },
+  ),
   starts_threads: McpToolAccess.startsThreads(
     (input) => input,
     (_, modes) => Effect.succeed({ ran: `${modes.runtimeMode}/${modes.interactionMode}` }),
@@ -184,6 +219,7 @@ export const refusedAtCompileTime = () => {
       writes: unchecked,
       writes_with_capability: unchecked,
       writes_threads: unchecked,
+      writes_own_children: unchecked,
       starts_threads: unchecked,
       writes_environment: unchecked,
     }),
@@ -300,6 +336,27 @@ it.effect.each([
   ],
   ["writes_threads", supervised, { threadId: "thread:missing" }, "ran"],
 
+  // A thread moves and resumes its own delegated children at the runtime mode they already have.
+  ["writes_own_children", supervised, { threadId: ownChildThreadId }, "full-access/default"],
+  [
+    "writes_own_children",
+    plan,
+    { threadId: planChildThreadId },
+    "interaction_mode_escalation_denied",
+  ],
+  [
+    "writes_own_children",
+    supervised,
+    { threadId: forgedChildThreadId },
+    "runtime_mode_escalation_denied",
+  ],
+  [
+    "writes_own_children",
+    supervisedClient,
+    { threadId: ownChildThreadId },
+    "runtime_mode_escalation_denied",
+  ],
+
   ["starts_threads", supervised, {}, "approval-required/default"],
   ["starts_threads", supervised, { runtimeMode: "full-access" }, "runtime_mode_escalation_denied"],
   ["starts_threads", plan, {}, "approval-required/plan"],
@@ -322,6 +379,8 @@ it.effect.each([
       probeServer(
         Layer.mock(ThreadManagement.ThreadManagementService)({
           getThreadShell: (threadId) => Effect.succeed(shells.get(threadId) ?? null),
+          listAppOwnedChildThreadIds: (threadId) =>
+            Effect.succeed(appOwnedChildren.get(threadId) ?? []),
         }),
       ),
     ),

apps/server/src/mcp/McpToolAccess.ts

@@ -23,12 +23,17 @@ import {
 import * as PeerForwarding from "../peer/PeerForwarding.ts";
 import { assertNotLinked, assertSameLink, callerLinkOrigin } from "./linkOrigin.ts";
 import * as McpInvocationContext from "./McpInvocationContext.ts";
-import { resolveInteractionMode, resolveRuntimeMode } from "./delegatedTaskModes.ts";
+import {
+  resolveInteractionMode,
+  resolveRuntimeMode,
+  runtimeModeRank,
+} from "./delegatedTaskModes.ts";
 import {
   assertFullAccess,
   assertLiveCaller,
   assertTargetWithinLimits,
   type Caller,
+  isOwnDelegatedChild,
   loadCaller,
   readCaller,
   unavailable,
@@ -197,25 +202,50 @@ export const writesWithCapability = <P, A, E, R>(handle: (params: P) => Effect.E
 export const writesThreads = <P, A, E, R>(
   threads: (params: P) => ReadonlyArray<ThreadId | undefined>,
   handle: (params: P) => Effect.Effect<A, E, R>,
+  options?: {
+    /**
+     * Whether the caller may act on its own delegated children whose runtime
+     * mode is above its own, at that mode, as moving one to another account
+     * and resuming it need. Interaction modes stay within the caller's.
+     */
+    readonly ownChildren?: "at-their-runtime-mode";
+  },
 ) =>
   declare(
     (params: P) =>
       Effect.gen(function* () {
         const caller = yield* writingCaller;
+        let runtimeMode = caller.limits.runtimeMode;
         for (const threadId of threads(params)) {
           if (threadId === undefined || threadId === caller.scope.thread?.threadId) continue;
           const target = yield* caller.threads
             .getThreadShell(threadId)
             .pipe(Effect.mapError(unavailable));
           if (target !== null && target.deletedAt === null) {
-            yield* assertTargetWithinLimits(caller.limits, target);
+            const ownChild =
+              options?.ownChildren === "at-their-runtime-mode" &&
+              runtimeModeRank(target.runtimeMode) > runtimeModeRank(caller.limits.runtimeMode) &&
+              (yield* isOwnDelegatedChild(caller.threads, caller.caller?.id, target));
+            if (ownChild && runtimeModeRank(target.runtimeMode) > runtimeModeRank(runtimeMode))
+              runtimeMode = target.runtimeMode;
+            yield* assertTargetWithinLimits(
+              ownChild ? { ...caller.limits, runtimeMode } : caller.limits,
+              target,
+            );
             yield* assertSameLink(caller, target);
           }
         }
         // Modes can rise after this check; the orchestrator rechecks under lock and records refusal before handlers wrap errors.
         const refused = yield* Ref.make<DispatchModeRefusal | undefined>(undefined);
         return yield* handle(params).pipe(
-          Effect.provideService(DispatchModeLimit, { ...caller.limits, refused }),
+          Effect.provideService(DispatchModeLimit, {
+            ...caller.limits,
+            runtimeMode,
+            ...(runtimeMode === caller.limits.runtimeMode
+              ? {}
+              : { ownChildRuntimeMode: runtimeMode }),
+            refused,
+          }),
           Effect.catch((error) =>
             Effect.flatMap(Ref.get(refused), (refusal) =>
               Effect.fail<E | OrchestratorMcpFailure>(

apps/server/src/mcp/OrchestratorMcpService.ts

@@ -3192,8 +3192,18 @@ const make = Effect.gen(function* () {
       } satisfies OrchestratorMcpThreadReadResult;
     }),
     sendToThread: Effect.fn("OrchestratorMcpService.sendToThread")(function* (scope, input) {
-      const { parent, limits, target } = yield* loadScopedThread(scope, input.threadId, ["runs"]);
+      const {
+        parent,
+        limits: callerLimits,
+        target,
+      } = yield* loadScopedThread(scope, input.threadId, ["runs"]);
       yield* assertLiveCallerForOtherThread(scope, parent, target);
+      // The declaration lifts only the runtime limit, and only to its own child's preflight mode.
+      const ownChildRuntimeMode = (yield* DispatchModeLimit)?.ownChildRuntimeMode;
+      const limits =
+        ownChildRuntimeMode === undefined
+          ? callerLimits
+          : { ...callerLimits, runtimeMode: ownChildRuntimeMode };
       yield* resolveRuntimeMode(limits.runtimeMode, target.thread.runtimeMode);
       yield* resolveInteractionMode(limits.interactionMode, target.thread.interactionMode);
 

apps/server/src/mcp/threadAccess.ts

@@ -121,6 +121,24 @@ export const assertTargetWithinLimits = (
     Effect.asVoid,
   );
 
+/** A thread the calling thread itself delegated here, as `delegate_task` records it on the caller. */
+export const isOwnDelegatedChild = Effect.fn("mcp.isOwnDelegatedChild")(function* (
+  threads: Pick<ThreadManagement.ThreadManagementService["Service"], "listAppOwnedChildThreadIds">,
+  callerThreadId: ThreadId | undefined,
+  target: Pick<OrchestrationV2ThreadShell, "id" | "lineage">,
+) {
+  if (
+    callerThreadId === undefined ||
+    target.lineage.parentThreadId !== callerThreadId ||
+    target.lineage.relationshipToParent !== "subagent"
+  )
+    return false;
+  const children = yield* threads
+    .listAppOwnedChildThreadIds(callerThreadId)
+    .pipe(Effect.mapError(unavailable));
+  return children.includes(target.id);
+});
+
 /** Background subagents retain credentials until provider exit; archived threads and other instances cannot act. */
 export const isLiveCallerShell = (
   shell: Pick<

apps/server/src/mcp/toolkits/attachment/handlers.ts

@@ -125,6 +125,7 @@ export const layer = McpToolAccess.toLayer(
               status: result.run.status,
             };
           }),
+        { ownChildren: "at-their-runtime-mode" },
       ),
     };
   }),

apps/server/src/mcp/toolkits/attachment/tools.ts

@@ -48,7 +48,7 @@ const AttachmentSendTool = Tool.make("t3_thread_send_attachments", {
   ...shared,
   dependencies: [...shared.dependencies, DocumentText.DocumentText],
   description:
-    "Send uploaded attachments as a new message to a thread. No retry key. Target modes cannot exceed yours. Success does not mean the provider read them or finished.",
+    "Send uploaded attachments to a thread within your modes, or your child at its runtime mode. No retry key. Success does not mean the provider read them or finished.",
   parameters: Schema.Struct({
     threadId: Schema.optional(ThreadId),
     message: Schema.optional(Schema.String.check(Schema.isMaxLength(120000))),