Bug Description

runEmbeddedPiAgent accepts a toolsAllow parameter (used by active-memory plugin and sessions_spawn to restrict available tools for sub-agents), but never forwards it to runEmbeddedAttemptWithBackend. As a result, sub-agents receive ALL configured tools regardless of the toolsAllow filter.

Root Cause

In pi-embedded-runner (current CefZK1Pt hash), runEmbeddedPiAgent calls runEmbeddedAttemptWithBackend with ~50 explicitly listed parameters around line 8283, but toolsAllow is not included in the list.

// runEmbeddedPiAgent correctly receives toolsAllow
async function runEmbeddedPiAgent(params) {
  // params.toolsAllow = ["memory_search", "memory_get"] ✅

  // ...later...

  // BUG: toolsAllow is missing from this call
  const attempt = await runEmbeddedAttemptWithBackend({
    sessionId: params.sessionId,
    sessionKey: resolvedSessionKey,
    // ... ~50 params listed ...
    bootstrapPromptWarningSignature: ...
    // toolsAllow: params.toolsAllow,  ← MISSING
  });

  // Inside runEmbeddedAttemptWithBackend → runEmbeddedAttempt(params):
  // params.toolsAllow = undefined ❌
  // → toolsRaw = allTools (no filter applied)
}

Impact

Active Memory Plugin

• active-memory passes toolsAllow: ["memory_search", "memory_get"] to restrict sub-agent to only memory tools
• Due to this bug, the sub-agent receives all 68+ tools (50+ feishu plugin tools, built-in tools, etc.)
• System prompt balloons from ~3,600 chars → 23,610 chars (~8,000 tokens)
• Tool schemas add another ~12,000-15,000 tokens
• Total API input: ~37,000 tokens per call (should be ~3,000)
• Each call takes 25-30 seconds (vs expected <5 seconds), frequently timing out at 30s

Verified with instrumented dist

TOKEN-ENTRY (runEmbeddedPiAgent): toolsAllow=["memory_search","memory_get"] ✅
TOKEN-FILTER (runEmbeddedAttempt): toolsAllow=undefined allTools=68 ❌
TOKEN-DIAG:  systemPromptChars=23610 customTools=68 toolsAllow=undefined
API usage:   input_tokens=37,303 (StepFun step-3.5-flash)

Other Affected Features

• sessions_spawn with runtime="subagent" and toolsAllow - same issue if toolsAllow is passed through the same path
• Any plugin or feature that relies on toolsAllow to restrict sub-agent tool access

Environment

• OpenClaw version: 2026.4.12
• active-memory plugin config: queryMode: "recent", model: "stepfun/step-3.5-flash-2603"
• Verified via monkey-patched dist/pi-embedded-runner-CefZK1Pt.js with console.error diagnostics at three checkpoints (function entry, runEmbeddedAttempt, tool filter)

Fix

Add toolsAllow: params.toolsAllow to the runEmbeddedAttemptWithBackend call in runEmbeddedPiAgent:

  const attempt = await runEmbeddedAttemptWithBackend({
    sessionId: params.sessionId,
    // ...existing params...
+   toolsAllow: params.toolsAllow,
    bootstrapPromptWarningSignaturesSeen,
    bootstrapPromptWarningSignature: ...
  });

Related

• #65998 - MCP tool schemas bypass toolsAllow (different but related filtering issue)
• #66157 - Active-memory timeout with queryMode="message" (symptom, likely caused by this bug)