[BUG] Subagents in plan mode can read files outside the working dir

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

In plan mode, sub agents spawned with the agent tool are not bound to the working directory. As a result, they can read any file on the operating system. This makes working with the plan tool explicitly uncomfortable and dangerous as you need to deny all tools upfront globally (e.g. the read file tool) which it should not use on different folders on your OS.

### What Should Happen?

When the subagent in plan mode wants to read a file outside of the working directory, it should issue a request to read that file.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Create a test file ~/test.txt with random content
2. create a test working directory claude-test
3. open a new claude session and go to plan mode
4. Ask to spawn a subagent and read the file content of ~/test.txt

### Claude Model

Sonnet (default)

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.187

### Platform

Anthropic API

### Operating System

Other Linux

### Terminal/Shell

Other

### Additional Information

_No response_

Reproduce the issue by entering plan mode in a Claude Code session, spawning a subagent with the agent tool, and asking it to read ~/test.txt from a separate working directory. Trace how plan-mode subagents receive their working directory and permission boundaries. Done means an outside-directory read triggers a request instead of succeeding automatically.

Written by the indexing model from the issue text.