Sub-agents cannot inherit or configure permissive mode

[zoubo9034]

Sub-agents cannot inherit or configure permissive mode

Description

When creating a parent session with permissive=True, sub-agents spawned via session.tool("task", ...) do not inherit this setting and require HITL confirmation for all tool calls. There is currently no way to configure sub-agents to run in permissive mode.

Environment

• a3s-code version: 1.0.2
• Python version: 3.11
• OS: Linux

Problem

Current Behavior

1. Parent session created with permissive=True can execute tools without HITL confirmation ✅
2. Sub-agents spawned via session.tool("task", ...) require HITL confirmation for all tools ❌
3. Error message from sub-agent: "需要HITL确认管理器配置" (HITL confirmation manager required)

Root Cause

• agent.session() accepts a permissive parameter
• session.tool("task", ...) does not support passing session options to sub-agents
• Sub-agents create their own child sessions with default permissive=False
• Agent YAML frontmatter does not support a permissive field

Reproduction

Test Script

#!/usr/bin/env python3
from a3s_code import Agent
from pathlib import Path
import tempfile

# Setup workspace with minimal config
workspace = tempfile.mkdtemp()
config_path = Path(workspace) / "config.hcl"
config_path.write_text("""
default_model = "openai/gpt-4o"
providers {
  name = "openai"
  api_key = "sk-test"
  models {
    id = "gpt-4o"
    name = "GPT-4o"
    family = "gpt"
    tool_call = true
    modalities { input = ["text"] output = ["text"] }
    limit { context = 128000 output = 4096 }
  }
}
""")

# Create test sub-agent
agent_dir = Path(workspace) / "agents"
agent_dir.mkdir()
(agent_dir / "test-agent.md").write_text("""---
name: test-agent
description: "Test sub-agent"
mode: subagent
max_steps: 5
permissions:
  allow: ["Bash(*)", "Read", "Write"]
---
Test agent
""")

# Create agent and session
agent = Agent.create(str(config_path))
session = agent.session(workspace, permissive=True)

# Parent session works
result = session.tool("bash", {"command": "echo 'test'"})
print("Parent session:", result.output)  # ✅ Works

# Sub-agent requires HITL
result = session.tool("task", {
    "agent": "test-agent",
    "prompt": "Execute: bash -c 'echo test'"
})
print("Sub-agent:", result.output)  # ❌ Requires HITL confirmation

Expected Output

Both parent session and sub-agent should execute tools without HITL confirmation.

Actual Output

• Parent session: ✅ Tool executed successfully
• Sub-agent: ❌ Requires HITL confirmation manager

Impact

This limitation makes it impossible to use sub-agents in automated/headless environments where:

• No human is available to confirm tool execution
• Sub-agents need to execute tools autonomously
• Parallel task execution via sub-agents is required

Proposed Solutions

Option 1: Pass session options to sub-agents (Recommended)

Allow session.tool("task") to accept session options:

session.tool("task", {
    "agent": "my-agent",
    "prompt": "...",
    "session_options": {
        "permissive": True,
        "max_parse_retries": 3,
        # other session options
    }
})

Option 2: Support permissive in agent YAML

Allow agents to declare their permission mode:

---
name: my-agent
mode: subagent
permissive: true  # New field
permissions:
  allow: ["Bash(*)", "Read"]
---

Option 3: Inherit parent session settings

Sub-agents automatically inherit permissive (and potentially other settings) from parent session.

Pros: Simple, no API changes needed
Cons: Less explicit, might not fit all use cases

Workaround

Currently, the only workaround is to avoid using sub-agents and implement all logic in the parent session, which loses the benefits of:

• Isolated context windows
• Independent max_steps limits
• Parallel execution via parallel_task
• Permission isolation

---

Related Documentation:

• Sessions: https://a3s-lab.github.io/a3s/docs/code/sessions
• Sub-agents: https://a3s-lab.github.io/a3s/docs/code/subagents

[ZhiXiao-Lin]

✅ Issue Resolved

Sub-agents can now be configured with permissive mode via the task tool's permissive parameter.

Implementation

Added permissive: bool parameter to TaskParams in core/src/tools/task.rs. When set to true, the child agent is configured with a permissive permission policy that bypasses HITL confirmation.

Usage Example (Python SDK)

from a3s_code import Agent

agent = Agent.create("config.hcl")
session = agent.session(".", permissive=True)

# Spawn sub-agent with permissive mode
result = session.tool("task", {
    "agent": "general",
    "description": "Analyze code",
    "prompt": "Use glob and read tools to analyze Python files",
    "permissive": True,  # ← Sub-agent runs without HITL
    "max_steps": 10
})

Testing

Created comprehensive integration tests in sdk/python/examples/test_permissive_subagents.py:

• ✅ Sub-agent with permissive=True executes tools without HITL
• ✅ Sub-agent with permissive=False requires HITL (default behavior)
• ✅ Parallel sub-agents with mixed permissive settings

Bonus: SubAgent Event Streaming

Also implemented SubAgent event streaming support:

• Parent sessions can now monitor internal SubAgent events (tool calls, LLM responses, etc.)
• Events are forwarded from child agents to parent's broadcast channel
• Python SDK now recognizes subagent_start, subagent_end, subagent_progress, and tool_input_delta events

Commits

• a004591 - feat: add permissive mode support for sub-agents
• 74aeccf - test: add integration test for permissive mode in sub-agents
• d232e48 - feat: enable SubAgent event streaming to parent sessions

Branch

fix/security-and-windows-compat

This fix is ready for review and merge. It will be included in the next release (v1.0.3).