feat(subagents): add resource, capability and model controls

[lyx2145181]

Summary

Give subagent profiles their own resource selections, Code mode/MCP capabilities, and model-override control, while keeping the existing profile editor and session lifecycle.

The goal is to make a role's configuration meaningful for the child it creates: select what it loads, explicitly opt into host capabilities, and keep its chosen model instead of silently inheriting a different parent loadout.

User-facing changes

Select skills and extensions per role

• Choose individual skills and extensions using compact, searchable pickers in the existing Resources field.
• Show a concise selection summary; open one picker at the current Choose button rather than adding permanent configuration panels.
• Use a tri-state bulk control to select the entire enabled catalog as concrete entries, regardless of the current search, or clear the selection. Preserve unknown/ambiguous saved entries instead of silently removing them.
• Keep the existing draft/Save workflow: opening, searching, retrying, and closing a picker do not save or change a selection. Built-in profiles remain read-only.

Opt into Code mode and selected MCP servers

• Add independent, default-off Code mode and MCP switches alongside skills/extensions.
• Choose exact MCP server identities by scope and name; children do not inherit the parent's MCP loadout or an automatic All/wildcard selection.
• Keep stored selections when MCP is switched off, and show unavailable/blocked entries without discarding them.
• The picker only reads the masked, files-only MCP overview. It does not edit server settings, enable servers, run Test, or start Sign-in.

Keep configured role and child models

• Add Allow parent model override beside the specified model, default off.
• When a role specifies a model and overrides are off, ignore the parent's Agent.model parameter and use the role model—even if the ignored parameter names an unknown or ambiguous model. Do not reject the task merely to make the parent retry without that parameter.
• With overrides enabled, allow an explicit per-create selection without editing the role. Roles without a specified model keep the existing explicit-selection/inheritance behavior.
• Resume ignores attached model parameters and retains the child's current model, including manual changes. Later parent/profile edits do not reassign an existing child.
• Cold reopening restores the saved active-branch model even before conversation messages exist. An unavailable saved model or missing configured authentication is an error, not a reason to silently select a default.

English, Simplified Chinese, and Traditional Chinese strings are included.

Technical adjustments

Resource loading and authorization

• Discover a static, source-aware resource catalog without evaluating extension code or installing packages. Apply restricted selections before SDK imports, using native resource discovery, scoped settings, and canonical project trust.
• Preserve foreign profile frontmatter and unedited aliases/selections. Apply narrowly scoped updates when toggling profiles and retain omitted capability/model fields from older clients.
• Restore children from their resource snapshots rather than rereading a changed role. Refresh non-resource settings while keeping transient child changes local.
• Account for tools registered during session_start/resource discovery: do not use early enumeration as the SDK's permanent allowlist. Enforce frozen builtin/extension authority using the actual registration winner for both direct calls and nested tool_call execution.

Delegated-run lifecycle

• Route delegated create/resume through AgentSessionWrapper admission, readiness, prompt preparation, and cancellation, and await actual completion rather than a prompt acknowledgment.
• Handle readiness failures immediately and recheck cancellation at queued/binding boundaries.
• Reset extension UI cancellation on resume after Stop without an unnecessary rebind.

Native host capabilities

• Reuse the existing builtin extension factory, McpHost, project trust, scoped settings, and credential storage rather than introducing a parallel pipeline.
• Use Code mode with models: false; tool search is a dependency, not a third profile setting. Respect native builtin disable/replacement rules.
• Authorize the selected scoped server and actual registry owner before transport value resolution, process spawning, or network connection.
• Separate structural declaration from execution-time readiness checks for MCP aggregates. Retain legitimate declarations during SDK catalog lag without replaying an old active-tool set or undoing explicit disablement.
• Resource snapshot v3 freezes capability flags, selected server identities, and tool authority—not configuration bytes, credentials, or remote tool catalogs. Existing v1/v2 snapshots gain no new host capabilities.

Model selection and editor reuse

• Resolve the selected create model before worktree/session/resource side effects. A protected role's ignored parent parameter is not parsed.
• Restore the saved child model from the active branch, including setup-only sessions, while leaving ordinary unsent-session defaults unchanged.
• Reuse the current model lookup, profile frontmatter, Toggle/Field components, and draft/Save flow. The override switch is disabled with an accessible explanation when no role model is specified; its dormant intent is retained.
• No new permission store or model-related resource snapshot version is introduced.

Compatibility and limits

• Existing boolean resource selections remain supported; CSV/string-array selections and foreign YAML are preserved through the native profile workflow.
• Intentional behavior change: roles with a specified model no longer accept parent model overrides by default. Enable the new switch to retain that behavior. Manual child model changes remain available.
• v1 keeps its historical hard allowlist; v2 retains its frozen resource/tool policy; neither is migrated or promoted to Code mode/MCP.
• Existing profile Save, copy, enabled PATCH, trust, and built-in read-only behavior are retained. No dependency/lockfile changes or user-data migration are included.
• These controls are not a filesystem/network/extension-JavaScript sandbox. Trusted extension code is not isolated, and guarded execution is not hard registry isolation.
• MCP aggregate admission relies on the audited SDK 1.0 public catalog-update timing; the corresponding integration coverage should be revisited on SDK upgrades.

Validation

• Exported and validated the final staged tree independently from the live preview checkout.
• Typecheck: tsc --noEmit --incremental false.
• ESLint: zero errors/warnings; git diff --check clean.
• Isolated temporary-HOME/agent-directory offline suite: 2,426 passed.
• Separately mocked plugin-update suite with offline unset: 5 passed. This is not a claim that one environment's npm test covers both paths.
• Independent focused review and integration checks for resources, late tools, host admission, readiness/Stop/resume, model selection, and cold restoration.
• In-process faux providers verify actual request model identities and single-shot behavior, including real Agent → controller → child resume after a manual model change.
• Manual preview testing of the final model behavior was reported successful after restarting the development preview to discard pre-change in-memory tool closures.

Related open work and design choices

• feat(subagents): preload named skills from profiles #1034 adds named skill-body preloading; this PR selects the discoverable skill catalog and does not implement that preload behavior.
• feat(subagents): scope extension loading before import #1035 overlaps pre-import extension scoping. This PR targets current main directly and also includes the picker, late-tool policy, and independent host capabilities; it is not stacked on that proposal.
• fix(subagents): isolate session-bound providers from parents #1076 addresses session-bound provider isolation. This PR does not implement or claim that isolation; parent ModelRuntime sharing remains a separate concern inherited from current main.
• fix(subagents): reject unsupported resume option overrides #1055 proposes rejecting unsupported resume options. This PR deliberately chooses a different model-parameter contract: document and ignore model on resume, retaining the existing child choice without making the parent retry. It does not implement model hot-swapping or change the handling of other resume options.

These are related proposals, not prerequisites. The model behavior above is an explicit reviewable policy choice rather than an accidental silent override.

Review structure

This PR contains six existing logical commits; it does not rewrite or squash their history:

1. Resource scoping and late-tool policy.
2. Compact resource pickers.
3. Wrapper-based delegated lifecycle.
4. Scoped Code mode/MCP runtime support.
5. Compact capability controls.
6. Configured role/child model preservation.

The model editor, resolver, persistence compatibility, and cold-restore fix form one complete final increment, so they are submitted together rather than as partially functioning layers. Unrelated font/sidebar/session-list customizations and personal planning files are excluded.