fix(opencode): preserve external_dir and deny parent permissions in task child sessions#23290
Conversation
Carry forward only transitive-safe session rules when `task` creates a child session. This keeps parent `external_directory` approvals and deny rules so subagents stop re-prompting for trusted paths, while avoiding broad allow-rule inheritance that could accidentally grant write access to restrictive agents like `explore`. Verification: - bunx prettier --write packages/opencode/src/tool/task.ts packages/opencode/test/tool/task.test.ts - bun test --timeout 30000 test/tool/task.test.ts - bun typecheck Session: ses_25fac94daffeLwJ8p3cQRCI5pF
|
The following comment was made by an LLM, it may be inaccurate: Based on my search results, I found related PRs that address similar permission and restriction preservation issues in task child sessions: Related PRs:
These PRs are related to the same codebase area (task tool, permissions, subagent sessions) but don't appear to be direct duplicates of PR #23290. Your PR is specifically addressing the narrow issue of preserving only safe parent permissions (external_directory and deny rules) when task creates child sessions. |
Remove the extra task tool regression test to keep this PR narrowly focused on the runtime permission fix. The task tool change remains covered by local validation, but the branch diff is now smaller and easier to review. Verification: - bun test --timeout 30000 test/tool/task.test.ts - bun typecheck Session: ses_25fac94daffeLwJ8p3cQRCI5pF
…' into fix-subagent-session-permissions
Drop the extra trailing blank line in `packages/opencode/test/tool/task.test.ts` so the file stays clean after the earlier PR diff simplification. Session: ses_25fac94daffeLwJ8p3cQRCI5pF EOF && git push && gh pr checks 23290 -R anomalyco/opencode --watch --fail-fast
remorses
changed the title
external_dir and deny parent permissions in task child sessions
|
/review |
|
lgtm |
2 participants
Issue for this PR
Closes #20549
Closes #6527
Type of change
What does this PR do?
When
taskcreates a child session, it now carries over only the parent session'sexternal_directoryrules and deny rules.That fixes repeated prompts for trusted external paths while avoiding broad allow-rule inheritance that could make restrictive subagents like
explorewritable.How did you verify your code works?
bunx prettier --write packages/opencode/src/tool/task.ts packages/opencode/test/tool/task.test.tsbun test --timeout 30000 test/tool/task.test.tsbun typecheckScreenshots / recordings
Not applicable.
Checklist