fix(opencode): block internal workers from primary Task routing

[onedotmint]

Summary

Fixes #285.

Magic Context has a few internal workers that are registered as hidden subagents. The problem is that hidden: true only keeps them out of the normal agent picker — it doesn't stop OpenCode from selecting them through Task routing.

That can lead to something like dreamer-reviewer being picked as a normal code-review subagent, even though it's really meant to be called internally by Magic Context.

This patch adds Task routing denies for Magic Context's internal worker agents.

For now, I only apply those denies to callers that are strictly primary: the built-in build and plan agents, plus agents explicitly configured with mode: "primary".

Existing user Task permissions are kept intact. If there is already a rule for one of the internal workers, the patch removes that exact rule and adds the final "deny" after the existing Task rules, so it still wins with OpenCode's last-match-wins behavior.

I also intentionally avoided adding anything to top-level config.permission.

Why only primary callers?

I originally looked at applying this more broadly, but agents using mode: "all" or mode: "subagent" may also run as Task children.

With the OpenCode permission behavior currently used by the plugin, adding an explicit Task rule to those agents can change the default anti-nesting behavior OpenCode applies to Task children.

So this patch leaves mode: "all", mode: "subagent", no-mode custom agents, general, and explore alone. The same applies if build or plan has been explicitly changed to a non-primary mode.

That does leave a small known gap for agents that can act as both primary and subagent, but I thought it was safer to keep this fix narrow rather than change Task-child behavior as a side effect.

Magic Context's own internal dispatch is unchanged. Internal workers such as dreamer-reviewer are still called directly with session.prompt({ agent: ... }); these new rules only affect normal Task delegation.

Testing

I added regression coverage around the routing boundary, existing permission preservation, rule ordering, and the direct reviewer dispatch path.

After rebasing onto the latest master:

• permission / registration tests: 53 passed
• reviewer dispatch test: 1 passed
• plugin typecheck: passed
• changed-file Biome check: passed
• git diff --check: passed
• full plugin suite: 3605 passed, 6 failed

Five of those full-suite failures reproduce on clean master. The remaining compiled-TUI assertion appears intermittent and passed three focused reruns after the rebase.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Block OpenCode from routing primary Task calls to Magic Context’s internal workers by appending explicit deny rules to permission.task. Fixes #285.

• Bug Fixes
  • Append final permission.task denies for internal worker IDs, preserving all unrelated user rules and supporting both action and map forms (last-match wins).
  • Apply denies only to primary callers: built-in build, plan, and agents with mode: "primary"; leave general, explore, mode: "all", mode: "subagent", and no-mode agents unchanged.
  • Do not modify top-level config.permission; internal workers stay hidden subagents and are still invoked via session.prompt({ agent: ... }).

^{Written for commit 2a83a4e. Summary will update on new commits.}

Greptile Summary

The PR prevents strictly primary OpenCode agents from selecting Magic Context’s hidden internal workers through normal Task delegation while preserving direct internal dispatch.

• Adds permission helpers that append final per-worker Task deny rules while retaining unrelated user permissions.
• Applies the rules to build, plan, and custom agents explicitly configured with mode: "primary".
• Adds regression coverage for routing scope, permission ordering and preservation, whole-permission actions, hidden-agent configuration, and direct reviewer dispatch.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defect identified.

The changed permission transformation preserves unrelated rules, places exact internal-worker denies last for strictly primary callers, and leaves the intentionally excluded dual-role and subagent configurations unchanged.

Important Files Changed

Filename	Overview
packages/plugin/src/agents/permissions.ts	Adds narrowly scoped Task-routing permission normalization, caller classification, and final internal-worker deny rules without an accepted defect.
packages/plugin/src/index.ts	Integrates internal-worker deny generation after hidden-agent registration and assigns the transformed agent configuration.
packages/plugin/src/agent-registration-drift.test.ts	Adds regression tests for caller scope, worker coverage, permission preservation, ordering, action normalization, and hidden-agent configuration.
packages/plugin/src/features/magic-context/user-memory/review-user-memories.test.ts	Verifies that reviewer work continues to use direct agent-specific session prompting.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[OpenCode agent configuration] --> B{Caller classification}
    B -->|build or plan with no non-primary override| C[Strictly primary caller]
    B -->|mode: primary| C
    B -->|mode: all, subagent, or excluded no-mode agent| D[Leave permissions unchanged]
    C --> E[Preserve existing permission rules]
    E --> F[Remove exact internal-worker rules]
    F --> G[Append final deny for every internal worker]
    G --> H[Normal Task routing cannot select internal workers]
    I[Magic Context direct session.prompt dispatch] --> J[Hidden internal worker remains callable internally]

Loading

_{Reviews (1): Last reviewed commit: "fix(opencode): block internal workers fr..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR addresses an OpenCode Task-routing gap where Magic Context’s internal hidden worker agents (e.g. dreamer-reviewer) could still be selected via task delegation, despite being hidden from the agent picker. It does so by appending explicit permission.task deny rules for internal worker IDs, scoped only to “primary” Task callers to avoid changing Task-child default behavior.

Changes:

• Introduces denyTaskRoutingToAgents / denyTaskRoutingToCallerAgents to append last-match-wins permission.task denies for internal worker agent IDs while preserving unrelated user rules.
• Wires the deny injection into the plugin config hook after hidden-agent registration is constructed.
• Adds regression coverage for deny rule ordering/preservation, caller scoping, and verifies the reviewer dispatch path still uses direct session.prompt({ agent: ... }).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
packages/plugin/src/index.ts	Applies Task-routing deny injection to agent configs after hidden worker registration is built.
packages/plugin/src/agents/permissions.ts	Adds permission normalization + scoped Task-routing deny utilities for internal worker agent IDs.
packages/plugin/src/agent-registration-drift.test.ts	Adds tests covering deny rule behavior, ordering, preservation, and caller scoping.
packages/plugin/src/features/magic-context/user-memory/review-user-memories.test.ts	Asserts the direct reviewer dispatch continues targeting the internal reviewer agent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}