Summary

Fixes opencode run hanging indefinitely when a subagent (e.g. @explore) invokes the question tool in non-interactive mode.

Fixes #11899, #10012
Related: #9554, #8852, #10746, #11932

Problem

When opencode run creates a session, it correctly sets question: deny, plan_enter: deny, and plan_exit: deny permission rules on the main session. However, subagent sessions created by TaskTool did not inherit these deny rules, so:

1. The question tool remained available to subagents
2. When invoked, PermissionNext.ask() published a permission.asked event and blocked waiting for a reply
3. The run.ts event handler filtered permission.asked events by sessionID, silently ignoring events from subagent sessions (which have different session IDs)
4. The subagent blocked forever with no way to receive a reply

Additionally, SessionPrompt.prompt() overwrote the session's permission array with tool-derived permissions instead of merging, which discarded any inherited deny rules even if they were correctly propagated.

Changes

Three minimal changes fix this:

packages/opencode/src/tool/task.ts — Propagate the parent session's deny rules to subagent sessions. Before creating a child session, fetch the parent session and include its deny rules in the subagent's permission array.

packages/opencode/src/session/prompt.ts — Merge tool-derived permissions with existing session permissions instead of replacing them. The backwards-compat tools field handling was overwriting session.permission with only the tool deny/allow rules, silently discarding inherited deny rules from the parent session.

packages/opencode/src/cli/cmd/run.ts — Remove the sessionID filter from the permission.asked event handler so that permission requests from subagent sessions are also auto-rejected. This serves as a safety net. The session.error and session.status handlers retain their session ID filters since those should only apply to the main session.

How I verified this works

1. Ran bun dev run with a prompt that triggers the @explore subagent
2. Verified the subagent session in the SQLite DB contains all inherited deny rules (question:deny, plan_enter:deny, plan_exit:deny) alongside the hardcoded ones (todowrite:deny, todoread:deny, task:deny)
3. Confirmed the subagent completes successfully without hanging
4. Typecheck passes across all 12 packages

Root cause analysis

The permission system uses findLast (last-match-wins) across a merged ruleset. run.ts sets deny rules on the main session, but TaskTool created subagent sessions with a hardcoded permission array that only included todowrite, todoread, and conditionally task deny rules — never propagating the parent's question/plan_enter/plan_exit deny rules. Even if the rules had been propagated to the session creation, SessionPrompt.prompt() would overwrite them when converting the tools parameter to permission rules.

Related PRs

• fix(run): disable question tool in non-interactive mode #11895 — Fixes LLM.resolveTools to check session permissions (complementary; prevents the tool from being sent to the LLM, but doesn't help if the subagent session lacks the deny rule)
• fix: propagate parent agent permissions to subagent child sessions #12584 — Propagates agent-level config permissions to subagent sessions (complementary; propagates agent permissions, not session-level deny rules from run.ts)
• fix: prevent subagent permission bypass via tools field inheritance #7473 — Broader refactor of subagent permission handling including prompt.ts merge fix (complementary; larger scope, includes tool registry filtering)
• fix(acp): handle permission requests from child sessions #12136 — Fixes ACP permission handling for child sessions (complementary; different subsystem)