anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #6532] fix: inherit Plan mode permissions when spawning sub-agents #11959

New Issue
Open
opened 2026-02-16 18:16:53 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:16:53 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/6532

State: open
Merged: No

Summary

Fixes a security bypass where the model could escape Plan mode restrictions by spawning sub-agents.

Problem

When in Plan mode (read-only), the model could bypass restrictions by spawning sub-agents via the Task tool. Through reasoning/thinking or arbitrary decisions, the model could instruct sub-agents to run with full edit/write/bash permissions - completely circumventing Plan mode's safety guarantees.

Solution

  • Sub-agents from restricted parents (edit="deny") now run as Plan agent
  • Inherits Plan's bash whitelist (read-only commands: grep, ls, git status, etc.)
  • Explicitly disables edit/write tools for sub-agents
  • Throws descriptive error if Plan agent is unavailable
  • Adds comprehensive tests for Plan mode security restrictions

Testing

  • Added 7 new tests in test/tool/task.test.ts
  • All existing tests pass

Fixes #6527

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/6532 **State:** open **Merged:** No --- ## Summary Fixes a security bypass where the model could escape Plan mode restrictions by spawning sub-agents. ### Problem When in Plan mode (read-only), the model could bypass restrictions by spawning sub-agents via the Task tool. Through reasoning/thinking or arbitrary decisions, the model could instruct sub-agents to run with full edit/write/bash permissions - completely circumventing Plan mode's safety guarantees. ### Solution - Sub-agents from restricted parents (edit="deny") now run as Plan agent - Inherits Plan's bash whitelist (read-only commands: grep, ls, git status, etc.) - Explicitly disables edit/write tools for sub-agents - Throws descriptive error if Plan agent is unavailable - Adds comprehensive tests for Plan mode security restrictions ### Testing - Added 7 new tests in `test/tool/task.test.ts` - All existing tests pass Fixes #6527
yindo added the pull-request label 2026-02-16 18:16:53 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#11959
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?