fix(tool): subagent inherits the caller's tool denies (privilege escalation)

A restricted agent's tool restrictions live on its agent ruleset, but a
dispatched subagent ran with its own (often broader) permissions — so a
read-only or Plan-Mode caller could escalate by spawning a more-capable
subagent that edits files, runs bash, or reaches the network. Semantic port of
anomalyco/opencode#26597 ("subagent inherits parent agent's deny rules"),
adapted to PawWork's permission model.

The subagent's session.permission ruleset is the single source of truth for
what it inherits. At dispatch the agent tool forwards the caller's deny rules
onto the child session — patterns intact — so scoped denies (edit on one path),
whole-tool denies, and wildcard ("*") denies all reach the child as real rules.
Both the availability gate (Permission.disabled hides whole-tool denies from the
model) and the ask gate evaluate merge(subagentAgent.permission,
session.permission), so a forwarded deny binds the child the same way it bound
the caller. The caller agent's restrictions live on its agent ruleset, not the
session, so they are forwarded explicitly; session/per-prompt denies and
external_directory rules carry over too.

SessionPrompt.prompt still rebuilds session.permission from the boolean tools
map the agent tool passes, but that map is now availability-only — it lists the
subagent's structural constraints (no nested dispatch, no worktree switching, no
todos/primary-only tools), not caller-inherited authorization. So for an
agent-tool child the rebuild carries forward the caller's inherited rules the
map can't regenerate: external_directory rules, scoped (non-"*") denies, and
whole-tool denies for keys the map doesn't list (the wildcard "*" and unlisted
tools — automate, MCP, custom). Whole-tool denies for keys the map DOES list are
regenerated from the map each turn, so the ruleset stays stable instead of
accumulating; non-agent sessions still replace wholesale (pre-existing behavior).

Like upstream, forwarding is deny-only: a wildcard caller's allow-exceptions
(e.g. a read-only "*": deny agent that also allows read) are not preserved, so
its subagent loses those tools too — erring toward deny.

The caller is resolved as ctx.extra.callerAgent ?? ctx.agent: on a normal LLM
dispatch ctx.agent is the caller, but on a subtask command
SessionPrompt.handleSubtask runs the agent tool as the child, so it threads the
real caller through ctx.extra (PawWork sessions don't store their agent). edit
covers edit/write/apply_patch (all ask under the single "edit" key).

Resume (subagent_session_id) is covered too: it skips sessions.create, so the
inherited permission is recomputed from the current caller and re-applied onto
the existing child before it runs. Otherwise a caller that became more
restrictive after the child was created — e.g. switched to Plan Mode — could
resume it and regain the denied tools, since the child still carried its
original creator's permission.

Author: Astro-Han

packages/opencode/src/session/prompt.ts

@@ -1126,7 +1126,9 @@ NOTE: At any point in time through this workflow you should feel free to ask the
           sessionID,
           abort: taskAbort.signal,
           callID: part.callID,
-          extra: { bypassAgentCheck: true, promptOps },
+          // #26597: ctx.agent here is the subtask's (child) agent, not the dispatcher.
+          // Pass the real caller so the agent tool can honor its edit restriction.
+          extra: { bypassAgentCheck: true, promptOps, callerAgent: lastUser.agent },
           messages: msgs,
           metadata: (val: { title?: string; metadata?: Record<string, any> }) =>
             Effect.gen(function* () {
@@ -1877,8 +1879,30 @@ NOTE: At any point in time through this workflow you should feel free to ask the
         permissions.push({ permission: t, action: enabled ? "allow" : "deny", pattern: "*" })
       }
       if (permissions.length > 0) {
-        session.permission = permissions
-        yield* sessions.setPermission({ sessionID: session.id, permission: permissions })
+        // #26597: the boolean tools map is availability-only — it lists the subagent's structural
+        // denies (agent, worktree, todowrite, primary_tools), not what it inherited from its
+        // caller. The caller's deny rules are the single source of truth for inheritance and live
+        // on session.permission, forwarded at dispatch (tool/agent.ts). Rebuilding from the map
+        // alone would drop them, letting a caller regain access through the child. For agent-tool
+        // children, carry forward external_directory rules plus every caller deny the map does NOT
+        // regenerate: scoped (non-"*") denies (e.g. edit on one path) and whole-tool denies for
+        // keys absent from the map — the wildcard "*" and any tool not listed (automate, MCP,
+        // custom). Per-tool "*" denies for keys the map lists are regenerated each turn, so
+        // dropping them keeps this stable instead of accumulating.
+        // NOTE: like upstream #26597 this is forward-deny only — a caller's allow exception (e.g.
+        // a read-only "*": deny agent that also allows read) is not preserved, so its subagent
+        // loses those tools too. Matching upstream's deriveSubagentSessionPermission; toward deny.
+        const toolKeys = new Set(Object.keys(input.tools ?? {}))
+        const preserved = session.createdByAgentTool
+          ? (session.permission ?? []).filter(
+              (rule) =>
+                rule.permission === "external_directory" ||
+                (rule.action === "deny" && (rule.pattern !== "*" || !toolKeys.has(rule.permission))),
+            )
+          : []
+        const next = [...preserved, ...permissions]
+        session.permission = next
+        yield* sessions.setPermission({ sessionID: session.id, permission: next })
       }
 
       yield* throwIfAborted(options)

packages/opencode/src/tool/agent.ts

@@ -4,6 +4,7 @@ import { Session } from "../session"
 import { SessionID, MessageID } from "../session/schema"
 import { MessageV2 } from "../session/message-v2"
 import { Agent } from "../agent/agent"
+import type { Permission } from "../permission"
 import type { SessionPrompt } from "../session/prompt"
 import { Config } from "../config"
 import { SubagentRun } from "../session/subagent-run"
@@ -299,41 +300,72 @@ export const AgentTool = Tool.define(
             const parent = yield* sessions.get(ctx.sessionID)
             const parentExec = parent.executionContext
 
+            // #26597: a subagent must not use a tool its caller is denied, otherwise a restricted
+            // agent (Plan Mode's edit-deny, or a read-only "*": deny agent) could escalate by
+            // spawning a more-capable subagent. Resolve the caller's agent so its deny rules can be
+            // forwarded onto the child session below. The caller is ctx.agent on a normal LLM
+            // dispatch; for a subtask command SessionPrompt.handleSubtask runs the agent tool as the
+            // child and passes the real caller via ctx.extra.callerAgent (PawWork sessions don't
+            // store their agent).
+            const callerAgentName = (ctx.extra?.callerAgent as string | undefined) ?? ctx.agent
+            const callerAgent = yield* agent.get(callerAgentName).pipe(Effect.catchCause(() => Effect.succeed(undefined)))
+
+            // #26597: the subagent's inherited permission — the single source of truth for what it
+            // may do. Forward the caller's deny rules with patterns intact so they bind the child
+            // the same way they bind the caller: the caller agent's restrictions (scoped denies
+            // like edit on one path, or a wildcard "*" deny) live on its agent ruleset, not the
+            // session, so they're forwarded explicitly alongside the caller session's denies +
+            // external_directory. The rebuild in SessionPrompt.prompt carries these forward
+            // verbatim — it only regenerates the per-tool "*" denies the tools map below lists. The
+            // trailing rules are the subagent's own structural shape (no nested dispatch, no todos
+            // unless its agent allows them, primary-tool allows).
+            const inheritedPermission: Permission.Ruleset = [
+              ...(parent.permission ?? []).filter(
+                (rule) => rule.permission === "external_directory" || rule.action === "deny",
+              ),
+              ...(callerAgent?.permission ?? []).filter((rule) => rule.action === "deny"),
+              // v1 nested-deny: agent is denied unconditionally so a subagent cannot recursively
+              // dispatch its own subagents (#283 non-goal: nested subagents).
+              {
+                permission: id,
+                pattern: "*" as const,
+                action: "deny" as const,
+              },
+              ...(canTodo
+                ? []
+                : [
+                    {
+                      permission: "todowrite" as const,
+                      pattern: "*" as const,
+                      action: "deny" as const,
+                    },
+                  ]),
+              ...(cfg.experimental?.primary_tools?.map((item) => ({
+                pattern: "*",
+                action: "allow" as const,
+                permission: item,
+              })) ?? []),
+            ]
+
             const nextSession =
               session ??
               (yield* sessions.create({
                 parentID: ctx.sessionID,
                 title: params.description + ` (@${next.name} subagent)`,
                 createdByAgentTool: true,
                 subagentType: params.subagent_type,
-                permission: [
-                  ...(parent.permission ?? []).filter(
-                    (rule) => rule.permission === "external_directory" || rule.action === "deny",
-                  ),
-                  // v1 nested-deny: agent is denied unconditionally so a subagent cannot
-                  // recursively dispatch its own subagents (#283 non-goal: nested subagents).
-                  {
-                    permission: id,
-                    pattern: "*" as const,
-                    action: "deny" as const,
-                  },
-                  ...(canTodo
-                    ? []
-                    : [
-                        {
-                          permission: "todowrite" as const,
-                          pattern: "*" as const,
-                          action: "deny" as const,
-                        },
-                      ]),
-                  ...(cfg.experimental?.primary_tools?.map((item) => ({
-                    pattern: "*",
-                    action: "allow" as const,
-                    permission: item,
-                  })) ?? []),
-                ],
+                permission: inheritedPermission,
               }))
 
+            // #26597: resume (subagent_session_id) skips sessions.create, so re-forward the CURRENT
+            // caller's inherited permission onto the existing child. Otherwise a caller that became
+            // more restrictive after the child was created — e.g. switched to Plan Mode — could
+            // resume it and regain the denied tools, since the child still carried its original
+            // creator's permission. The rebuild then carries this forward as on a fresh dispatch.
+            if (session) {
+              yield* sessions.setPermission({ sessionID: nextSession.id, permission: inheritedPermission })
+            }
+
             const childExec = nextSession.executionContext
             const sameWorktree =
               parentExec.activeWorktree?.directory === childExec.activeWorktree?.directory &&
@@ -441,6 +473,10 @@ export const AgentTool = Tool.define(
                       sessionID: nextSession.id,
                       model: { modelID: model.modelID, providerID: model.providerID },
                       agent: next.name,
+                      // Availability-only: structural constraints on the subagent (no nested
+                      // dispatch, no worktree switching, no todos unless its agent allows them, no
+                      // primary-only tools). Caller-inherited denies ride on session.permission
+                      // (forwarded above), not this map. See #26597.
                       tools: {
                         agent: false,
                         "enter-worktree": false,

packages/opencode/test/session/prompt.test.ts

@@ -4,6 +4,7 @@ import { NamedError } from "@opencode-ai/util/error"
 import { fileURLToPath, pathToFileURL } from "url"
 import { Effect, Layer } from "effect"
 import { Instance } from "../../src/project/instance"
+import { Permission } from "../../src/permission"
 import { ModelID, ProviderID } from "../../src/provider/schema"
 import { Session } from "../../src/session"
 import { MessageV2 } from "../../src/session/message-v2"
@@ -1002,3 +1003,170 @@ describe("session.agent-resolution", () => {
     }
   }, 30000)
 })
+
+// #26597: the prompt rebuilds session.permission from the boolean tools map, which can only
+// regenerate whole-tool ("*") rules for the keys it lists. For an agent-tool subagent it must
+// carry forward the caller's inherited rules the map can't regenerate — scoped denies,
+// external_directory rules, and whole-tool denies for keys the map doesn't list (the wildcard
+// "*", MCP/custom tools) — otherwise a caller denied e.g. edit on one path, an external dir, or a
+// whole tool regains it through the child. Whole-tool denies for keys the map DOES list are
+// regenerated from the map instead, so the ruleset doesn't accumulate across turns.
+describe("session.prompt subagent permission rebuild (#26597)", () => {
+  test("carries scoped denies and external_directory forward for an agent-tool subagent", async () => {
+    await using tmp = await tmpdir({
+      config: { agent: { build: { model: "openai/gpt-5.2" } } },
+    })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () =>
+        run(
+          Effect.gen(function* () {
+            const prompt = yield* SessionPrompt.Service
+            const sessions = yield* Session.Service
+            const parent = yield* sessions.create({})
+            const child = yield* sessions.create({
+              parentID: parent.id,
+              createdByAgentTool: true,
+              subagentType: "general",
+              permission: [
+                { permission: "external_directory", pattern: "/tmp/project/*", action: "allow" },
+                { permission: "edit", pattern: "/secret/**", action: "deny" },
+                { permission: "edit", pattern: "*", action: "deny" },
+              ],
+            })
+
+            yield* prompt.prompt({
+              sessionID: child.id,
+              agent: "build",
+              noReply: true,
+              tools: { agent: false, "enter-worktree": false },
+              parts: [{ type: "text", text: "x" }],
+            })
+
+            const after = yield* sessions.get(child.id)
+            // Scoped deny + external_directory survive (the boolean tools map can't express them).
+            expect(after.permission).toContainEqual({
+              permission: "external_directory",
+              pattern: "/tmp/project/*",
+              action: "allow",
+            })
+            expect(after.permission).toContainEqual({ permission: "edit", pattern: "/secret/**", action: "deny" })
+            // The structural denies the boolean tools map lists are regenerated from it.
+            expect(after.permission).toContainEqual({ permission: "agent", pattern: "*", action: "deny" })
+            // The whole-tool ("*") edit deny is ALSO carried forward: "edit" is absent from the
+            // tools map (which lists only agent/enter-worktree here), so the map can't regenerate
+            // it — dropping it would let the caller's edit deny vanish through the child. A
+            // whole-tool deny for a key the map DOES list is regenerated instead (next test).
+            expect(after.permission).toContainEqual({ permission: "edit", pattern: "*", action: "deny" })
+          }),
+        ),
+    })
+  }, 30000)
+
+  test("regenerates a whole-tool deny the map lists instead of double-carrying it", async () => {
+    await using tmp = await tmpdir({
+      config: { agent: { build: { model: "openai/gpt-5.2" } } },
+    })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () =>
+        run(
+          Effect.gen(function* () {
+            const prompt = yield* SessionPrompt.Service
+            const sessions = yield* Session.Service
+            const parent = yield* sessions.create({})
+            const child = yield* sessions.create({
+              parentID: parent.id,
+              createdByAgentTool: true,
+              subagentType: "general",
+              permission: [{ permission: "edit", pattern: "*", action: "deny" }],
+            })
+
+            yield* prompt.prompt({
+              sessionID: child.id,
+              agent: "build",
+              noReply: true,
+              // "edit" is in the map, so its "*" deny is regenerated from the map — the forwarded
+              // copy is dropped from the carry-forward so the ruleset doesn't accumulate.
+              tools: { agent: false, edit: false },
+              parts: [{ type: "text", text: "x" }],
+            })
+
+            const after = yield* sessions.get(child.id)
+            expect((after.permission ?? []).filter((r) => r.permission === "edit" && r.pattern === "*")).toHaveLength(1)
+            expect(Permission.evaluate("edit", "*", after.permission ?? []).action).toBe("deny")
+          }),
+        ),
+    })
+  }, 30000)
+
+  test("carries the caller's wildcard deny forward so tools absent from the map stay denied", async () => {
+    await using tmp = await tmpdir({
+      config: { agent: { build: { model: "openai/gpt-5.2" } } },
+    })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () =>
+        run(
+          Effect.gen(function* () {
+            const prompt = yield* SessionPrompt.Service
+            const sessions = yield* Session.Service
+            const parent = yield* sessions.create({})
+            // A read-only-style caller forwards a wildcard ("*") deny onto the child.
+            const child = yield* sessions.create({
+              parentID: parent.id,
+              createdByAgentTool: true,
+              subagentType: "general",
+              permission: [{ permission: "*", pattern: "*", action: "deny" }],
+            })
+
+            yield* prompt.prompt({
+              sessionID: child.id,
+              agent: "build",
+              noReply: true,
+              tools: { agent: false, edit: false },
+              parts: [{ type: "text", text: "x" }],
+            })
+
+            const after = yield* sessions.get(child.id)
+            // The wildcard deny is preserved, so a tool absent from the boolean tools map
+            // (automate, MCP, custom) still evaluates to deny for the subagent.
+            expect(after.permission).toContainEqual({ permission: "*", pattern: "*", action: "deny" })
+            expect(Permission.evaluate("automate", "*", after.permission ?? []).action).toBe("deny")
+          }),
+        ),
+    })
+  }, 30000)
+
+  test("replaces permission wholesale for a non-agent-tool session", async () => {
+    await using tmp = await tmpdir({
+      config: { agent: { build: { model: "openai/gpt-5.2" } } },
+    })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () =>
+        run(
+          Effect.gen(function* () {
+            const prompt = yield* SessionPrompt.Service
+            const sessions = yield* Session.Service
+            const session = yield* sessions.create({
+              permission: [{ permission: "edit", pattern: "/secret/**", action: "deny" }],
+            })
+
+            yield* prompt.prompt({
+              sessionID: session.id,
+              agent: "build",
+              noReply: true,
+              tools: { agent: false },
+              parts: [{ type: "text", text: "x" }],
+            })
+
+            const after = yield* sessions.get(session.id)
+            // Not an agent-tool child → the rebuild replaces wholesale (pre-existing behavior).
+            expect(after.permission).not.toContainEqual({ permission: "edit", pattern: "/secret/**", action: "deny" })
+            expect(after.permission).toContainEqual({ permission: "agent", pattern: "*", action: "deny" })
+          }),
+        ),
+    })
+  }, 30000)
+})