Add session permission support to background agents for denying questions

Implements question-denied session permission rules when creating child
sessions via background task delegation. This prevents subagents from
asking questions by passing explicit permission configuration during
session creation.

🤖 GENERATED WITH ASSISTANCE OF OhMyOpenCode

src/features/background-agent/manager-session-permission.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test"
+import { tmpdir } from "node:os"
+
+import type { PluginInput } from "@opencode-ai/plugin"
+
+import { BackgroundManager } from "./manager"
+
+describe("BackgroundManager session permission", () => {
+  test("passes explicit session permission rules to child session creation", async () => {
+    // given
+    const createCalls: Array<Record<string, unknown>> = []
+    const client = {
+      session: {
+        get: async () => ({ data: { directory: "/parent" } }),
+        create: async (input: Record<string, unknown>) => {
+          createCalls.push(input)
+          return { data: { id: "ses_child" } }
+        },
+        promptAsync: async () => ({}),
+        abort: async () => ({}),
+      },
+    }
+    const manager = new BackgroundManager({ client, directory: tmpdir() } as unknown as PluginInput)
+
+    // when
+    await manager.launch({
+      description: "Test task",
+      prompt: "Do something",
+      agent: "explore",
+      parentSessionID: "ses_parent",
+      parentMessageID: "msg_parent",
+      sessionPermission: [
+        { permission: "question", action: "deny", pattern: "*" },
+      ],
+    })
+    await new Promise(resolve => setTimeout(resolve, 50))
+    manager.shutdown()
+
+    // then
+    expect(createCalls).toHaveLength(1)
+    expect(createCalls[0]?.body).toEqual({
+      parentID: "ses_parent",
+      title: "Test task (@explore subagent)",
+      permission: [
+        { permission: "question", action: "deny", pattern: "*" },
+      ],
+    })
+  })
+})

src/features/background-agent/manager.ts

@@ -272,6 +272,7 @@ export class BackgroundManager {
       body: {
         parentID: input.parentSessionID,
         title: `${input.description} (@${input.agent} subagent)`,
+        ...(input.sessionPermission ? { permission: input.sessionPermission } : {}),
       } as Record<string, unknown>,
       query: {
         directory: parentDirectory,

src/features/background-agent/spawner.test.ts

@@ -3,7 +3,7 @@ import { describe, test, expect } from "bun:test"
 import { createTask, startTask } from "./spawner"
 
 describe("background-agent spawner.startTask", () => {
-  test("does not override parent session permission rules when creating child session", async () => {
+  test("applies explicit child session permission rules when creating child session", async () => {
     //#given
     const createCalls: any[] = []
     const parentPermission = [
@@ -41,6 +41,9 @@ describe("background-agent spawner.startTask", () => {
         parentModel: task.parentModel,
         parentAgent: task.parentAgent,
         model: task.model,
+        sessionPermission: [
+          { permission: "question", action: "deny", pattern: "*" },
+        ],
       },
     }
 
@@ -57,6 +60,8 @@ describe("background-agent spawner.startTask", () => {
 
     //#then
     expect(createCalls).toHaveLength(1)
-    expect(createCalls[0]?.body?.permission).toBeUndefined()
+    expect(createCalls[0]?.body?.permission).toEqual([
+      { permission: "question", action: "deny", pattern: "*" },
+    ])
   })
 })

src/features/background-agent/spawner.ts

@@ -61,6 +61,7 @@ export async function startTask(
   const createResult = await client.session.create({
     body: {
       parentID: input.parentSessionID,
+      ...(input.sessionPermission ? { permission: input.sessionPermission } : {}),
     } as Record<string, unknown>,
     query: {
       directory: parentDirectory,

src/features/background-agent/types.ts

@@ -1,4 +1,5 @@
 import type { FallbackEntry } from "../../shared/model-requirements"
+import type { SessionPermissionRule } from "../../shared/question-denied-session-permission"
 
 export type BackgroundTaskStatus =
   | "pending"
@@ -72,6 +73,7 @@ export interface LaunchInput {
   skills?: string[]
   skillContent?: string
   category?: string
+  sessionPermission?: SessionPermissionRule[]
 }
 
 export interface ResumeInput {