Task tool permission override no longer works for nested sub-agents

[malhashemi]

Description

After the permission rework in #6319, agents can no longer enable the task tool via permission frontmatter to allow nested sub-agents.

Steps to Reproduce

1. Create an agent with permission: { task: "allow" } in frontmatter:

---
name: orchestrator
mode: subagent
permission:
  task: allow
---

2. Call this agent via the Task tool from a primary agent
3. The sub-agent cannot spawn other sub-agents despite having task: allow

Expected Behavior

Agents with permission: { task: "allow" } should be able to use the Task tool to spawn nested sub-agents.

Actual Behavior

The task tool is always disabled for sub-agents regardless of agent permissions.

Root Cause

In #6319, the ...agent.tools spread was removed from task.ts that previously allowed agents to override the default task: false restriction:

tools: {
  todowrite: false,
  todoread: false,
  task: false,
  ...Object.fromEntries((config.experimental?.primary_tools ?? []).map((t) => [t, false])),
- ...agent.tools,  // This was removed
},

The old agent schema had a tools: z.record(z.string(), z.boolean()) field that enabled this override. With the new permission system, this capability was lost.

Environment

• opencode version: v1.1.15+
• Affects: Any agent trying to use nested sub-agents

[le0nidas]

Not sure if it is related but I'm on OpenCode v1.1.19 and I still cannot spawn a subagent from another.

Here is the frontmatter part of the subagent the needs to spawn:

---
description: Executes epics by orchestrating task flow between Pinky and user reviews
mode: subagent
model: github-copilot/gpt-5-mini
temperature: 0.1
tools:
  write: false
  edit: false
  bash: true
  task: true
permission:
  bash:
    "bd *": allow
    "git *": allow
    "cat *": allow
    "*": deny
  task:
    "pinky": allow
    "*": deny
---

Should I open a new issue? Is it something that I'm missing in the setup? Any help is appreciated, thank you in advance.

[malhashemi]

Hey the permissions are sequential now, so that deny at the bottom is overriding your allow list, just move it to the top and it should work

[le0nidas]

That did the trick! Thank you!