anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[Security Bug] Subagent permissions not enforced - configured restrictions ignored #4517

New Issue
Closed
opened 2026-02-16 17:44:27 -05:00 by yindo · 4 comments
yindo commented 2026-02-16 17:44:27 -05:00
Owner
Copy Link
Copy Source

Originally created by @randomm on GitHub (Jan 9, 2026).

Originally assigned to: @thdxr on GitHub.

Description

Subagents spawned via the task tool completely ignore agent permission configurations in > v1.0.200. Regardless of what restrictions are defined in opencode.json, subagents have unrestricted access to all tools.

Example

Agent configured with restricted bash access:

"permission": {
  "bash": {
    "git*": "allow",
    "*": "deny"
  }
}

Expected: Subagent can only run git commands
Actual: Subagent can run ANY bash command - restrictions ignored entirely

Root Cause

  1. SessionPrompt.prompt() tools parameter replaces session permissions instead of merging
  2. ToolRegistry.tools() doesn't filter tools by agent permission rules
  3. Subagents inherit no permission restrictions from parent agent config

Impact

Security - All agent permission configurations are effectively useless. Any subagent has full unrestricted access.

Fix

PR #7473 addresses this by:

  • Removing tools parameter override in task.ts
  • Adding permission filtering to ToolRegistry
  • Ensuring proper permission merge order

Related

Related to #6527, #5894, #3808

Originally created by @randomm on GitHub (Jan 9, 2026). Originally assigned to: @thdxr on GitHub. ## Description Subagents spawned via the `task` tool completely ignore agent permission configurations in > v1.0.200. Regardless of what restrictions are defined in `opencode.json`, subagents have unrestricted access to all tools. ## Example Agent configured with restricted bash access: ```json "permission": { "bash": { "git*": "allow", "*": "deny" } } ``` **Expected:** Subagent can only run git commands **Actual:** Subagent can run ANY bash command - restrictions ignored entirely ## Root Cause 1. `SessionPrompt.prompt()` `tools` parameter **replaces** session permissions instead of merging 2. `ToolRegistry.tools()` doesn't filter tools by agent permission rules 3. Subagents inherit no permission restrictions from parent agent config ## Impact **Security** - All agent permission configurations are effectively useless. Any subagent has full unrestricted access. ## Fix PR #7473 addresses this by: - Removing tools parameter override in task.ts - Adding permission filtering to ToolRegistry - Ensuring proper permission merge order ## Related Related to #6527, #5894, #3808
yindo closed this issue 2026-02-16 17:44:27 -05:00
yindo commented 2026-02-16 17:44:27 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 9, 2026):

This issue might be a duplicate of or closely related to existing issues. Please check:

  • #6527: [Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents - Same root cause where subagents inherit no permission restrictions from parent agent config
  • #3808: Task should inherit current agent permissions/tools for MCP - Directly addresses that tasks/subagents should use same agent with same permissions
  • #5894: [BUG] Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass - Related security issue where plugin hooks don't apply to subagent tool calls

Feel free to ignore if your specific case requires a separate track.

@github-actions[bot] commented on GitHub (Jan 9, 2026): This issue might be a duplicate of or closely related to existing issues. Please check: - #6527: [Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents - Same root cause where subagents inherit no permission restrictions from parent agent config - #3808: Task should inherit current agent permissions/tools for MCP - Directly addresses that tasks/subagents should use same agent with same permissions - #5894: [BUG] Plugin hooks (tool.execute.before) don't intercept subagent tool calls - security policy bypass - Related security issue where plugin hooks don't apply to subagent tool calls Feel free to ignore if your specific case requires a separate track.
yindo commented 2026-02-16 17:44:27 -05:00
Author
Owner
Copy Link
Copy Source

@randomm commented on GitHub (Jan 9, 2026):

So just commenting still briefly: I have been stuck on 1.0.200 with my rather convoluted agent > subagent setup that relies on permissions working. Sometimes subagents go off rails if permissions do not work.

Thus, today opencode/claude/me submitted the PR. Hopefully it is helpful!!

@randomm commented on GitHub (Jan 9, 2026): So just commenting still briefly: I have been stuck on 1.0.200 with my rather convoluted agent > subagent setup that relies on permissions working. Sometimes subagents go off rails if permissions do not work. Thus, today opencode/claude/me submitted the PR. Hopefully it is helpful!!
yindo commented 2026-02-16 17:44:27 -05:00
Author
Owner
Copy Link
Copy Source

@evanreichard commented on GitHub (Jan 10, 2026):

@randomm - can you try moving "*": "deny" so its the first directive. I was having the same issue and that seemed to fix it for me.

@evanreichard commented on GitHub (Jan 10, 2026): @randomm - can you try moving `"*": "deny"` so its the first directive. I was having the same issue and that seemed to fix it for me.
yindo commented 2026-02-16 17:44:27 -05:00
Author
Owner
Copy Link
Copy Source

@randomm commented on GitHub (Jan 10, 2026):

The subagents got a free for all regardless. The linked PR fixes this but having the deny as the first line is still necessary

@randomm commented on GitHub (Jan 10, 2026): The subagents got a free for all regardless. The linked PR fixes this but having the deny as the first line is still necessary
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4517
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?