Plugin agent manifest tools: question: true does not override inherited default question: deny permission

Summary

A plugin-defined agent whose manifest declares tools: { question: true } cannot actually call the built-in question tool. The inherited default permission question: "deny" (from the defaults block in packages/opencode/src/agent/agent.ts) is not overridden by the manifest tools: entry at agent-resolution time, so the tool is disabled for the agent.

Environment

• opencode: 1.18.5
• OS: Linux
• OPENCODE_EXPERIMENTAL_CODE_MODE=true (reproduces with codemode off as well)
• The adv agent is defined via a plugin manifest (~/.local/share/Advance/plugin/agents/adv.md) with tools: { ..., question: true, ... } and no explicit question permission override.

Reproduction

1. Define a plugin agent with a manifest that includes tools: { question: true } and no permission entry for question.
2. Run opencode debug agent <plugin-agent-name>.
3. Inspect the resolved tools dict and the permission list.

Observed (opencode debug agent adv)

{
  "tools": {
    "question": false,        // ← disabled despite manifest `question: true`
    "execute": true,
    // ...
  },
  "permission": [
    { "permission": "*",        "action": "allow", "pattern": "*" },
    { "permission": "question", "action": "deny",  "pattern": "*" }  // ← inherited default wins
  ]
}

The model never receives the question tool in its function list.

Root cause

packages/opencode/src/agent/agent.ts — the shared defaults permission includes:

const defaults = Permission.fromConfig({
  // ...
  question: "deny",
  plan_enter: "deny",
  plan_exit: "deny",
  // ...
})

The built-in build and plan agents explicitly override it:

permission: Permission.merge(defaults, Permission.fromConfig({ question: "allow", ... }), user)

But plugin-defined agents inherit defaults as-is. The manifest's tools: { question: true } does not propagate to an agent-level permission allow, so the inherited deny wins.

Expected behavior

A manifest declaring tools: { question: true } should produce an effective agent-level permission allow for question, overriding the inherited default deny — mirroring the override the built-in build/plan agents apply explicitly. The tools: map and the permission defaults should not silently disagree.

Workaround

Add an explicit permission override in the agent's config (opencode.jsonc):

"agent": {
  "<plugin-agent-name>": {
    "permission": { "question": "allow" }
  }
}

Verified: with the override, opencode debug agent <name> reports question: true and permission gains { permission: "question", action: "allow", pattern: "*" } (merged last, wins over the default deny).

Additional context

• First observed around the experimental codemode landing window (Jul 3–6: #34677 / revert #35077 / re-land #35185), which is what drew attention to it, but it reproduces with OPENCODE_EXPERIMENTAL_CODE_MODE=false too — so the codemode flag itself is not the trigger; it only made the absence visible.
• Affects any plugin-defined agent that relies on tools: { question: true } without an explicit permission override.
• plan_enter / plan_exit likely share the same shape (also deny in defaults).