Plan Mode Agent Spawned General Subagent to edit code

[DUCKJAIII]

Question

I was on Open Code GUI on Windows.

I was in plan mode, but the main agent was able to spawn General Agent to make code edits.

Is this a bug, or a feature?

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• [CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: Plan mode restrictions bypassed when spawning sub-agents (same behavior — plan mode agent using Task tool to spawn a general subagent that performs edits)
• Sub Agents Do Not Obey Plan / Build mode. #23533: Sub Agents Do Not Obey Plan / Build mode (subagent making code edits while parent is in plan mode)
• Opencode running in plan mode called a subagent to bypass edit permission #8852: Opencode running in plan mode called a subagent to bypass edit permission (closed — same question: bug or misconfiguration?)
• plan agent bypass #24615: Plan agent bypass (plan agent able to edit files, permissions not enforced by default)

[DUCKJAIII]

Bot is right, a duplicated issue

[nikitakot]

@DUCKJAIII you can solve it by setting the permissions properly

{
  "$schema": "https://opencode.ai/config.json",
  // set readonly global permissions, it will override default permissions for all agents, including the built-in agents (build, general, explore...)
  "permission": {
    "edit": "ask",
    "task": {
      // do not allow running subagents with edit permissions by default without user confirmation
      "*": "ask",
      "explore": "allow",
    },
  },
  "agent": {
    // allow edit permissions for specific agents
    "build": {
      "permission": {
        "edit": {
          "*": "allow",
        },
        "task": {
          // allow agents with edit permission to run subagents with edit permissions by default without user confirmation
          "general": "allow",
        },
      },
    },
    "general": {
      "permission": {
        "edit": {
          "*": "allow",
        },
        "task": {
          "general": "allow",
        },
      },
    },
  },
}

[neuhaus]

Is this a bug, or a feature?

it's a critical bug since Jan 1st 2026.

[neuhaus]

@DUCKJAIII you can solve it by setting the permissions properly

Does this fix bash access (including destructive commands) in plan mode? I'm not so sure it does.

[nikitakot]

@DUCKJAIII you can solve it by setting the permissions properly

Does this fix bash access (including destructive commands) in plan mode? I'm not so sure it does.

works on my end, it seems like once you set the global permissions they override all agents permissions, do you have any global bash permissions set?

[DUCKJAIII]

@DUCKJAIII you can solve it by setting the permissions properly

Does this fix bash access (including destructive commands) in plan mode? I'm not so sure it does.

Sorry to tell you that I have not implemented the recommended fix

My initial work around was to tell the agent to not spawn subagents with edit/destructive commands in plan mode via agents.md

The workaround was not ideal, but worked for me. I am using Gemini 3.1 pro custom tools

I will come back once I have tested the suggested fix and removing the instruction in agents.md

Alternatively, let me know your experience

[neuhaus]

@DUCKJAIII you can solve it by setting the permissions properly

Does this fix bash access (including destructive commands) in plan mode? I'm not so sure it does.

works on my end, it seems like once you set the global permissions they override all agents permissions, do you have any global bash permissions set?

I haven't changed any permissions yet.

[neuhaus]

This critical issue is a duplicate of issue #7292 and hasn't been fixed since it was introduced on Jan 1st.