Repository navigation
Task tool ignores per-target deny and allows self-dispatch recursion #11324
Description
Summary
Task tool ignores per-target deny rules and allows an agent to dispatch itself. This enables recursive subagent spawning (self-dispatch loop) even when permission.task denies that target.
Steps to reproduce
- Define an agent
srewith task permission allowing*but denyingsreas a target.
# opencode.json (agent snippet)
permission:
task:
"*": allow
sre: deny- Start a session as
@sre. - Invoke the Task tool with
subagent_type: "sre".
Example payload:
{
"tool": "task",
"arguments": {
"subagent_type": "sre",
"prompt": "...",
"description": "..."
}
}Expected
The Task tool call is rejected with a permission error because the target sre is denied.
Actual
The Task tool call succeeds and spawns @sre again, enabling recursive self-dispatch loops.
Impact
- Deny rules for specific subagent targets are not enforced at execution time.
- Self-dispatch loops can create runaway subagent chains.
Workaround
Add a custom guard in tool.execute.before to reject Task calls when the current agent is sre and subagent_type is sre.
Environment
- Observed on macOS with current
anomalyco/opencodemain (date: 2026-01-31) - Configured via agent permissions (see snippet above)
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Jan 30, 2026
This issue might be a duplicate of existing issues. Please check:
The core issue appears to be that the task tool systematically ignores configured permission rules. The most relevant are #7474 (nearly identical - ignoring per-target permissions) and #6527 (same root cause - restrictions ignored).
Feel free to ignore if your specific case isn't addressed by these issues.
HyunggyuJang commentedon Jan 30, 2026
I inspected
packages/opencode/src/tool/task.ts(lines ~23-60). Root cause: per-target deny is only used to filter the tool description (accessibleAgents). The execute path does not enforce it and proceeds toAgent.geteven whenPermissionNext.evaluate("task", params.subagent_type, caller.permission)isdeny.Suggestion (treat deny as not existing): add a guard in execute before
Agent.get:This keeps denied targets hidden and prevents self-dispatch loops (e.g., @sre -> task(subagent_type: "sre")).
github-actions commentedon Apr 1, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.