Subagents Bypass Plan Mode READ-ONLY Restrictions

[isxlan0]

Description

Bug Report: Plan Mode Permission Bypass via Subagents

Description

In Plan Mode (READ-ONLY phase), the main agent's file editing permissions are correctly restricted, but subagents retain full file modification capabilities, creating a security bypass.

Steps to Reproduce

1. Enable Plan Mode in opencode
2. As the main agent, attempt to use edit or write tool → Blocked by rules
3. Use the task tool to spawn a subagent (type: general)
4. Instruct the subagent to use edit or write tool → Succeeds

Expected Behavior

Subagents should inherit the same READ-ONLY restrictions as the main agent when Plan Mode is active.

Actual Behavior

• Main agent: edit/write blocked with error: "The user has specified a rule which prevents you from using this specific tool call"
• Subagent: edit/write execute successfully, bypassing Plan Mode restrictions

Impact

This is a permission bypass vulnerability. Users enable Plan Mode to prevent unintended modifications during planning/review phase. The subagent loophole allows circumventing this safety mechanism.

Tools Affected

• edit (file editing)
• write (file creation)
• Likely affects other modification tools as well

Environment

• OS: Windows (win32)
• Shell: PowerShell 7+

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Plan mode doesn't restrict sub-agents spawned via task tool #26407: Plan mode doesn't restrict sub-agents spawned via task tool (essentially identical issue)
• Plan Mode Agent Spawned General Subagent to edit code #24741: Plan Mode Agent Spawned General Subagent to edit code (same behavior reported)
• Plan mode does not prevent write operations via Bash tool #22641: Plan mode does not prevent write operations via Bash tool (related bypass issue)
• Planning mode: subagents can trigger plan_exit, plan not shown before build switch, question text renders as plain text #18515: Planning mode: subagents can trigger plan_exit, plan not shown before build switch (related subagent/plan mode issues)

Please review these issues before continuing. If your issue is distinct, please clarify how it differs.

[nabilfreeman]

Unfortunately this fix appears to have caused a serious regression in permission inheritance for delegated subagents in deny-by-default configurations. I filed the follow-up here: #26700.

cc @kitlangton @nexxeln