…toolset injection (security)

Two privilege-escalation vectors closed:

1. Batch-mode injection (primary fix): the batch loop previously used
   `t.get("toolsets") or toolsets` for each task, so a model could name
   a valid profile (activating the mcp-* bypass in _build_child_agent)
   while supplying per-task toolsets that the profile never declared.
   Fix: when resolved_profile_name is set, all tasks in the batch receive
   profile_resolved_toolsets exclusively — per-task model-supplied toolsets
   are ignored.

2. Empty-profile bypass (secondary fix): a profile with no/empty toolsets
   still set resolved_profile_name, activating the mcp-* bypass with
   whatever caller-supplied toolsets were present. Fix: resolved_profile_name
   is only set when the profile declares a non-empty toolsets list; otherwise
   a warning is logged and the normal intersection path is used.

Tests added (tests/tools/test_delegate_toolset_scope.py):
- test_batch_injection_blocked_model_cannot_inject_evil_mcp_toolset: FAILS
  pre-fix (mcp-injected-evil present), PASSES post-fix
- test_single_task_profile_toolsets_unchanged: regression guard, PASSES both
- test_empty_profile_toolsets_bypass_not_activated: FAILS pre-fix
  (profile_name set), PASSES post-fix

Total: 16 → 19 tests, all green. tool_search: 63 pass, no collateral.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…l security hardening)

Assign list(profile_toolsets) instead of the bare reference at line ~2082
so in-place mutations of the working `toolsets` variable cannot corrupt
agent_profiles config for the process lifetime.  Also take an independent
list(toolsets) copy for profile_resolved_toolsets at line ~2110 (defence-
in-depth against future code inserted between the two assignments).

Adds TestProfileToolsetsAliasing::test_profile_toolsets_copy_prevents_config_corruption:
resolves a profile, mutates the child toolsets list returned to _build_child_agent,
and asserts the original profiles["documents"]["toolsets"] config list is unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…rent MCP bleed (security hardening)

When a named agent_profile is used, the profile's declared toolsets are
authoritative. Previously _preserve_parent_mcp_toolsets ran unconditionally
when inherit_mcp_toolsets=True, silently appending every parent MCP toolset
absent from the child's list — including ones the profile never declared.

Guard the bleed path with `and not profile_name` so inheritance is skipped
whenever delegation resolves through a profile. Non-profile (ad-hoc)
delegation continues to inherit parent MCP toolsets unchanged.

The variable `profile_name` is already in scope at the call site (function
parameter, also used at line 972 for the existing MCP bypass guard).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…G reaches the log

_read_logging_config now returns the loggers dict (4th element).
setup_logging iterates logging.loggers.<name> entries after attaching
handlers and calls logging.getLogger(name).setLevel() for each valid
entry.  Both bare-string ("DEBUG") and dict ({level: "DEBUG"}) shapes
are accepted; invalid levels are silently skipped.

When a per-logger override is finer-grained than the configured
top-level (e.g. DEBUG while agent.log runs at INFO), the root logger
and the agent.log handler are also lowered to the minimum per-logger
level so that propagated records actually reach the file.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pre-declare _cfg as Dict[str, Any] = {} so it is always bound and
Pyright knows the type is dict throughout the config bridge block.

Use an intermediate _expanded variable after _expand_env_vars() and
guard with isinstance(_, dict) so the re-assignment stays within the
declared dict type — _expand_env_vars has no return annotation and
Pyright infers a broad str | list | dict union.

Simplify the IPv4 network_cfg line: now that _cfg is always bound and
typed as dict, the old ('_cfg' in dir() else {}) guard is unnecessary.

Fixes Pyright errors at lines 863, 901, 917, 926, 930, 936, 978 that
were introduced by the Phase 2 lazy MCP discovery work.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>