Subagents can still recursively self-dispatch with global task permission (v1.17.20)

[eummo]

Description

This is a fresh reproduction of #18100 on OpenCode 1.17.20. That issue was automatically closed for inactivity with instructions to open a new issue if the problem remained relevant.

With global permission.task: "allow", a custom subagent can dispatch another instance of itself:

root
└─ concurrency-reviewer
   └─ concurrency-reviewer

We observed depth 2 and stopped further nesting by setting task: false on the reviewer. Current dev still has no hard runtime depth limit or same-agent cycle guard.

Expected: OpenCode should enforce a maximum nesting depth and/or reject same-agent self-dispatch with an explicit error.

Actual: each child can retain Task permission and create another child. Per-session step limits do not bound the whole tree.

Impact: runaway sessions, tokens, execution time, and more opportunities for a child permission wait to block the parent chain.

Related: #18100, #25681, #17722, #11324, and draft PR #33144.

Plugins

None.

OpenCode version

1.17.20

Steps to reproduce

1. Configure global permissions with "task": "allow".
2. Add a custom concurrency-reviewer subagent without an explicit Task denial.
3. Ask the root agent to delegate a review and give the reviewer work that it may delegate.
4. Observe the reviewer dispatching concurrency-reviewer again as its child.

Screenshot and/or share link

Not available; the session tree above was captured from the local benchmark run.

Operating System

Windows 11

Terminal

PowerShell