[Bug]: Pi's injected T3 tool_call hook forces Full access and blocks Pi extensions from handling approvals in subagents #35609

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Configure a Pi extension that implements an auto permission/command-approval policy (Pi itself deliberately leaves permission policies to extensions).
2. Open a parent thread using Claude Code (or Codex) in Auto runtime mode.
3. Ask the parent thread to delegate a task that runs shell commands to Pi via delegate_task:
   • Leaving runtimeMode inherited ("inherit"), or
   • Explicitly requesting runtimeMode: "full-access" so Pi can bypass T3's tool_call confirmation hook and use the user's extension.

Expected behavior

A user running a parent agent in Auto should be able to delegate tasks to Pi without either:

• prompting the human on every single shell/non-edit tool call, or
• having to escalate the entire parent thread to Full access just so Pi can reach full-access and let the user's Pi extension enforce its own auto policy.

Actual behavior

1. In pi-t3-mcp-extension.ts (packages/provider-pi/src/server/mcpExtensionSource.ts), T3 Code's pi.on("tool_call", ...) listener only returns early when mode === "full-access". In auto-accept-edits (and approval-required), it calls ctx.ui.confirm(...) for every non-read-only, non-file-change tool (e.g. bash or custom tools), blocking/overriding user Pi extensions that try to implement auto approval.
2. When the parent thread is in Auto:
   • delegate_task(..., runtimeMode: "full-access") fails with runtime_mode_escalation_denied (Child runtime mode full-access is broader than parent mode auto.).
   • Inherited runtimeMode steps down to auto-accept-edits, which triggers manual confirmation prompts on every shell/tool call.
3. Because Pi does not offer an auto mode in PI_PRESENTATION (supportedRuntimeModes: ["approval-required", "auto-accept-edits", "full-access"]), Pi cannot be used unattended as a subagent from an Auto parent thread—even when the user installed a Pi extension specifically to provide auto approval.

(Note: #30538 / PR #30552 only step auto down to auto-accept-edits, which still prompts on every shell command and still prevents user extensions from running without full-access.)

Impact

Major degradation or frequent failure

Version or commit

0.1.10-nightly.20261112.4606 (commit d8f3fef)

Environment

Windows, T3 Code Nightly desktop app, Pi 1.5.2 (with custom auto-approval Pi extension), parent provider: Claude Code (Auto)

Workaround

Switch the parent thread (e.g. Claude Code) to Full access so the Pi child can also run in full-access, losing the parent's Auto safety classifier.