multi_agent_chat: pack_subagent owns per-subagent PermissionMiddleware via Ruleset

surfsense_backend/app/agents/multi_agent_chat/middleware/main_agent/checkpointed_subagent_middleware/middleware.py

@@ -12,7 +12,6 @@ from deepagents.middleware.subagents import (
     SubAgentMiddleware,
 )
 from langchain.agents import create_agent
-from langchain.agents.middleware import HumanInTheLoopMiddleware
 from langchain.chat_models import init_chat_model
 from langgraph.types import Checkpointer
 
@@ -81,10 +80,6 @@ class SurfSenseCheckpointedSubAgentMiddleware(SubAgentMiddleware):
 
             middleware: list[Any] = list(spec.get("middleware", []))
 
-            interrupt_on = spec.get("interrupt_on")
-            if interrupt_on:
-                middleware.append(HumanInTheLoopMiddleware(interrupt_on=interrupt_on))
-
             specs.append(
                 {
                     "name": spec["name"],

surfsense_backend/app/agents/multi_agent_chat/middleware/shared/permissions/middleware/factory.py

@@ -9,9 +9,9 @@ matching OpenCode's ``permission/index.ts`` evaluation order):
    needs to *deny* what the user has explicitly forbidden; the default
    ``ask`` fallback would otherwise double-prompt every safe read-only
    call.
-2. ``extra_rulesets`` — caller-supplied rulesets. The KB subagent contributes
-   its destructive-FS ``ask`` rules here; connectors will follow once
-   they migrate off ``interrupt_on``.
+2. ``extra_rulesets`` — caller-supplied rulesets. Each subagent
+   contributes its own (KB: destructive-FS ``ask`` rules; connectors:
+   per-tool ``allow``/``ask``).
 
 Connector deny synthesis from ``new_chat._synthesize_connector_deny_rules``
 is intentionally NOT replicated: the multi-agent orchestrator already