Repository navigation
[Security Bug] Subagent permissions not enforced - configured restrictions ignored #7474
Closed as not planned
Description
Description
Subagents spawned via the task tool completely ignore agent permission configurations in > v1.0.200. Regardless of what restrictions are defined in opencode.json, subagents have unrestricted access to all tools.
Example
Agent configured with restricted bash access:
"permission": {
"bash": {
"git*": "allow",
"*": "deny"
}
}Expected: Subagent can only run git commands
Actual: Subagent can run ANY bash command - restrictions ignored entirely
Root Cause
SessionPrompt.prompt()toolsparameter replaces session permissions instead of mergingToolRegistry.tools()doesn't filter tools by agent permission rules- Subagents inherit no permission restrictions from parent agent config
Impact
Security - All agent permission configurations are effectively useless. Any subagent has full unrestricted access.
Fix
PR #7473 addresses this by:
- Removing tools parameter override in task.ts
- Adding permission filtering to ToolRegistry
- Ensuring proper permission merge order
Related
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jan 9, 2026
This issue might be a duplicate of or closely related to existing issues. Please check:
Feel free to ignore if your specific case requires a separate track.
randomm commentedon Jan 9, 2026
So just commenting still briefly: I have been stuck on 1.0.200 with my rather convoluted agent > subagent setup that relies on permissions working. Sometimes subagents go off rails if permissions do not work.
Thus, today opencode/claude/me submitted the PR. Hopefully it is helpful!!
evanreichard commentedon Jan 10, 2026
@randomm - can you try moving
"*": "deny"so its the first directive. I was having the same issue and that seemed to fix it for me.randomm commentedon Jan 10, 2026
The subagents got a free for all regardless. The linked PR fixes this but having the deny as the first line is still necessary