anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #9254] fix: prevent Plan mode bypass via sub-agent spawning #13040

New Issue
Open
opened 2026-02-16 18:17:55 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:55 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/9254

State: open
Merged: No

Summary

Fixes #6527 - Plan Mode Security Bypass via Sub-Agent Spawning

When a parent session operates under Plan mode (edit="deny"), sub-agents spawned via the task tool could previously bypass these restrictions and gain full edit capabilities.

Changes

  • Added hasPlanRestrictions() function to detect Plan mode sessions
  • Added planPermissions() function returning permission rules that deny edit tools
  • Modified TaskTool to:
    • Force sub-agents to use the "plan" agent when parent has edit restrictions
    • Pass inherited permission rules to sub-agent sessions
    • Explicitly disable edit, write, patch, and multiedit tools

Security Impact

This closes a permission escalation vulnerability where spawning sub-agents via the task tool could circumvent intended read-only constraints in Plan mode.

Testing

Added 18 new tests covering:

  • Plan mode detection logic
  • Permission rule generation
  • Agent availability filtering
  • Permission evaluation
  • End-to-end security scenarios

All 770 tests pass.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/9254 **State:** open **Merged:** No --- ## Summary Fixes #6527 - Plan Mode Security Bypass via Sub-Agent Spawning When a parent session operates under Plan mode (`edit="deny"`), sub-agents spawned via the `task` tool could previously bypass these restrictions and gain full edit capabilities. ## Changes - Added `hasPlanRestrictions()` function to detect Plan mode sessions - Added `planPermissions()` function returning permission rules that deny edit tools - Modified `TaskTool` to: - Force sub-agents to use the "plan" agent when parent has edit restrictions - Pass inherited permission rules to sub-agent sessions - Explicitly disable `edit`, `write`, `patch`, and `multiedit` tools ## Security Impact This closes a permission escalation vulnerability where spawning sub-agents via the task tool could circumvent intended read-only constraints in Plan mode. ## Testing Added 18 new tests covering: - Plan mode detection logic - Permission rule generation - Agent availability filtering - Permission evaluation - End-to-end security scenarios All 770 tests pass.
yindo added the pull-request label 2026-02-16 18:17:55 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#13040
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?