fix: block subagents from spawning subagents

[Githubguy132010]

Context

Fixes #7055. Subagents were able to spawn further subagents when their merged agent permissions contained an explicit task rule. This created a recursion/infinite delegation risk and violated the expected boundary that only the top-level agent should delegate.

Implementation

The root cause was a hasTaskPermission check in packages/opencode/src/tool/task.ts that conditionally skipped adding a task: deny rule to the child session's permissions — and also conditionally kept task in the tool list passed to SessionPrompt.prompt — whenever the child agent had any explicit task permission configured.

The fix removes the conditional entirely. The task permission is now always denied on sessions created by TaskTool, and task is always excluded from the tool list for subagent prompts, regardless of the child agent's configured permissions.

Root cause analysis

The hasTaskPermission conditional was originally introduced in upstream opencode via anomalyco/opencode#8111 ("fix(task): respect agent task permission for nested sub-agents"), merged Jan 13 2026. That PR restored the ability for agents to opt in to the task tool via permission frontmatter after the permission rework in anomalyco/opencode#6319 removed it.

Before that upstream PR, task was unconditionally denied for all subagent sessions:

{ permission: "task", pattern: "*", action: "deny" }
// and
tools: { task: false }

The upstream PR made it conditional:

const hasTaskPermission = agent.permission.some((rule) => rule.permission === "task")

This check was too broad — it matched any rule mentioning task (including deny or ask), not just explicit allows. It was also vulnerable to user config: since user permissions are merged into every agent's permission array via PermissionNext.merge(defaults, ..., user), a user clicking "Always allow" on a task permission prompt would persist task: "allow" to global config, which would then cause hasTaskPermission to be true for every agent — including general and explore subagents.

What this PR changed

• First commit (c4898d78): reverted to unconditional deny — the safe baseline.
• Second commit (4ee4d49): tightened the conditional from rule.permission === "task" to rule.permission === "task" && rule.action === "allow", renamed to allowsTask. This preserves the orchestrator agent's ability to delegate (it has explicit task: "allow") while blocking subagents that only have task rules via user config inheritance.

Remaining gaps

Despite this fix, infinite recursion is still possible in specific scenarios:

1. User config override: If a user's global config contains task: "allow" (from a prior "Always allow" click), it gets merged into every agent's permissions, making allowsTask true for all subagents.

2. Cross-agent mutual recursion: The self-delegation guard added later in 4f2ac44 ("block same-agent recursive delegation") only prevents agent A → A loops. It does not prevent A → B → A → B chains (e.g. general → explore → general → ...).

3. No hard depth limit: The system relies entirely on permission-based gating with no maximum nesting depth counter. A proper fix would track depth via the parentID chain and refuse to create sessions beyond a threshold.

Screenshots

N/A — no UI changes.

How to Test

1. Configure a custom agent with an explicit task: allow permission rule in your config.
2. Invoke that agent as a subagent via the task tool.
3. Verify the subagent cannot call the task tool (previously it could; now it cannot).

Get in Touch

thomas07374

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kilo-code-bot]

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/tool/task.ts	64	allowsTask checks for any task: allow entry in the merged ruleset instead of the effective rule, so global/user task: allow can still re-enable nested delegation for subagents.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

None.

Files Reviewed (1 files)

• packages/opencode/src/tool/task.ts - 1 issue

---

_{Reviewed by gpt-5.4-20260305 · 2,997,678 tokens}

[alex-alecu]

Thank you for contribution.