openAgent

1import { PermissionV1 } from "@opencode-ai/core/v1/permission"
2import { LayerNode } from "@opencode-ai/core/effect/layer-node"
3import { expect } from "bun:test"
4import { Effect } from "effect"
5import { Agent } from "../../src/agent/agent"
6import { deriveSubagentSessionPermission } from "../../src/agent/subagent-permissions"
7import { Permission } from "../../src/permission"
8import { testEffect } from "../lib/effect"
9 
10const it = testEffect(LayerNode.compile(Agent.node))
11 
12function testAgent(input: {
13  name: string
14  mode: Agent.Info["mode"]
15  permission: Parameters<typeof Permission.fromConfig>[0]
16}) {
17  return {
18    name: input.name,
19    mode: input.mode,
20    permission: Permission.fromConfig(input.permission),
21    options: {},
22  } satisfies Agent.Info
23}
24 
25// `deriveSubagentSessionPermission` is imported from production. The test
26// exercises the actual helper that task.ts uses to build the subagent's
27// session permission, so any regression in that helper trips this test.
28 
29it.instance("subagent permissions take precedence over parent agent restrictions", () =>
30  Effect.gen(function* () {
31    const planAgent = yield* Agent.use.get("plan")
32    const generalAgent = yield* Agent.use.get("general")
33 
34    expect(planAgent).toBeDefined()
35    expect(generalAgent).toBeDefined()
36    // Sanity: the plan agent itself blocks edit. (Note: `write` and
37    // `apply_patch` route through the `edit` permission at the runtime
38    // tool layer — see Permission.disabled / EDIT_TOOLS.)
39    expect(Permission.evaluate("edit", "/some/file.ts", planAgent!.permission).action).toBe("deny")
40 
41    const parentSessionPermission: PermissionV1.Ruleset = []
42 
43    const subagentSessionPermission = deriveSubagentSessionPermission({
44      parentSessionPermission,
45      subagent: generalAgent!,
46    })
47 
48    // Mirror the runtime evaluation in session/prompt.ts (~line 410, 639):
49    //   ruleset: Permission.merge(agent.permission, session.permission ?? [])
50    const effective = Permission.merge(generalAgent!.permission, subagentSessionPermission)
51 
52    expect(Permission.evaluate("edit", "/some/file.ts", effective).action).not.toBe("deny")
53    expect(Permission.disabled(["edit", "write", "apply_patch"], effective)).toEqual(new Set())
54  }),
55)
56 
57it.instance("subagent's own read-only restriction remains effective", () =>
58  Effect.gen(function* () {
59    const explore = yield* Agent.use.get("explore")
60    expect(explore).toBeDefined()
61 
62    const parentSessionPermission: PermissionV1.Ruleset = []
63    const subagentSessionPermission = deriveSubagentSessionPermission({
64      parentSessionPermission,
65      subagent: explore!,
66    })
67    const effective = Permission.merge(explore!.permission, subagentSessionPermission)
68 
69    expect(Permission.evaluate("edit", "/x.ts", effective).action).toBe("deny")
70  }),
71)
72 
73it.instance(
74  "custom subagent can explicitly enable edits denied to its parent agent",
75  () =>
76    Effect.gen(function* () {
77      const planAgent = yield* Agent.use.get("plan")
78      const my = yield* Agent.use.get("my_subagent")
79      expect(planAgent).toBeDefined()
80      expect(my).toBeDefined()
81 
82      const parentSessionPermission: PermissionV1.Ruleset = []
83      const subagentSessionPermission = deriveSubagentSessionPermission({
84        parentSessionPermission,
85        subagent: my!,
86      })
87      const effective = Permission.merge(my!.permission, subagentSessionPermission)
88 
89      expect(Permission.evaluate("edit", "/some/file.ts", planAgent!.permission).action).toBe("deny")
90      expect(Permission.evaluate("edit", "/some/file.ts", effective).action).toBe("allow")
91      expect(Permission.disabled(["edit", "write", "apply_patch"], effective)).toEqual(new Set())
92    }),
93  {
94    config: {
95      agent: {
96        my_subagent: {
97          description: "A user-defined subagent",
98          mode: "subagent",
99          permission: {
100            edit: "allow",
101          },
102        },
103      },
104    },
105  },
106)
107 
108it.effect("subagent self permissions are preserved", () =>
109  Effect.sync(() => {
110    const executor = testAgent({
111      name: "executor",
112      mode: "subagent",
113      permission: {
114        "*": "deny",
115        read: "allow",
116        bash: "allow",
117        task: {
118          "*": "deny",
119          worker: "allow",
120        },
121        edit: "allow",
122      },
123    })
124 
125    const effective = Permission.merge(
126      executor.permission,
127      deriveSubagentSessionPermission({
128        parentSessionPermission: [],
129        subagent: executor,
130      }),
131    )
132 
133    expect(Permission.evaluate("read", "README.md", effective).action).toBe("allow")
134    expect(Permission.evaluate("bash", "git status", effective).action).toBe("allow")
135    expect(Permission.evaluate("task", "worker", effective).action).toBe("allow")
136    expect(Permission.evaluate("task", "other", effective).action).toBe("deny")
137    expect(Permission.disabled(["edit", "write", "apply_patch"], effective)).toEqual(new Set())
138  }),
139)
140 
141it.effect("subagent inherits parent session deny rules as hard runtime ceilings", () =>
142  Effect.sync(() => {
143    const executor = testAgent({
144      name: "executor",
145      mode: "subagent",
146      permission: {
147        bash: "allow",
148      },
149    })
150    const effective = Permission.merge(
151      executor.permission,
152      deriveSubagentSessionPermission({
153        parentSessionPermission: Permission.fromConfig({ bash: "deny" }),
154        subagent: executor,
155      }),
156    )
157 
158    expect(Permission.evaluate("bash", "git status", effective).action).toBe("deny")
159  }),
160)
161