Plan mode doesn't restrict sub-agents spawned via task tool #26407

Description

While I was working on a project, I noticed that the plan mode agent managed to spawn the another agent as a sub-task.This allowed the plan agent to bypass the read-only restriction.

I was in plan mode working on a session monitor plugin. I asked the model to create an implementation plan, and it did — but then it also spawned the the general tool as a subagent and passed the full set of instructions I was going to have the build agen implement. The sub-agent executed everything: created a plugin file, edited AGENTS.md, updated tracking files, and ran tests.

I realize that this bug has been reported before, but wanted to submit this in case it adds additional context for fixing the issue.

Plugins

opencode-agent-skills, opencode-observability.ts

OpenCode version

1.14.40 (Running in WSL. Command line: opencode serve --hostname 0.0.0.0 --port 4096)

Steps to reproduce

1. Asked the plan agent to write detailed instructions with this prompt: I agree, sounds like a solid plan. Create detailed instructions and add a step at the top for tracking. Then, we'll pass it on to the build agent.
2. Asked a follow-up question. Prompt: Do the instructions including testing?
3. Answered the assessment and answered the agent's question: "Should I add these to the instructions?" with "Yes"
4. The agent wrote the instructions, then proceed to spawn the sub-agent. I allowed it to run, as it was a low-impact change.

Screenshot and/or share link

Operating System

Microsoft Windows Version 25H2 (0S Build 26200.8246), WSL2, Ubuntu 24.04.4 LTS

Terminal

Ubuntu terminal. Cmd: opencode serve --hostname 0.0.0.0 --port 4096 & web ui