## Why
Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.
## What changed
Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.
Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.
## Testing
Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.
GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
rhan-oai
40cf168567