fix(plugin-handlers): deny task for read-only subagents

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/plugin-handlers/tool-config-handler.ts

@@ -4,6 +4,15 @@ import { isTaskSystemEnabled } from "../shared";
 
 type AgentWithPermission = { permission?: Record<string, unknown> };
 
+const TASK_DENIED_SUBAGENT_KEYS = [
+  "librarian",
+  "explore",
+  "oracle",
+  "multimodal-looker",
+  "metis",
+  "momus",
+] as const;
+
 function getConfigQuestionPermission(): string | null {
   const configContent = process.env.OPENCODE_CONFIG_CONTENT;
   if (!configContent) return null;
@@ -21,6 +30,12 @@ function agentByKey(agentResult: Record<string, unknown>, key: string): AgentWit
     | undefined;
 }
 
+function denyTaskForAgent(agentResult: Record<string, unknown>, key: string): void {
+  const agent = agentByKey(agentResult, key);
+  if (!agent) return;
+  agent.permission = { ...agent.permission, task: "deny" };
+}
+
 export function applyToolConfig(params: {
   config: Record<string, unknown>;
   pluginConfig: OhMyOpenCodeConfig;
@@ -59,6 +74,10 @@ export function applyToolConfig(params: {
     isCliRunMode ? "deny" :
     "allow";
 
+  for (const agentKey of TASK_DENIED_SUBAGENT_KEYS) {
+    denyTaskForAgent(params.agentResult, agentKey);
+  }
+
   const librarian = agentByKey(params.agentResult, "librarian");
   if (librarian) {
     librarian.permission = { ...librarian.permission, "grep_app_*": "allow" };