feat(core): harden subagent durable pipeline, MCP tool permissions, and event delivery

- Subagent executor: bound child wait with a timeout, bounded-concurrency event
  consumption, surface failures as partial instead of completed, escape and frame
  background steers as untrusted data, and share foreground/background settle.
- MCP tools: gate execution behind PermissionV2.assert and make read-only
  subagents default-deny tools not explicitly allowlisted.
- Runner: honor plugin deny/skip tool results, narrow SubagentResult status,
  reuse coordinator tracking, and clean up fork-only dead code.
- Bus: create typed pub/sub channels on publish so early events are buffered for
  the first subscriber instead of dropped.
- Add per-session tool permission overrides and v1 provider availability-list
  policy migration.

Author: See U

packages/core/src/bus.ts

@@ -250,8 +250,7 @@ export const layerWith = (options?: LayerOptions) =>
         })
       }
 
-      function commitTransaction(
-        definition: Definition,
+      function commitTransaction(        definition: Definition,
         durable: NonNullable<Definition["durable"]>,
         event: Payload,
         aggregateID: string,
@@ -405,11 +404,11 @@ export const layerWith = (options?: LayerOptions) =>
                   version: definition.durable.version,
                 },
               }
-              yield* notify(event as Payload, true)
+              yield* notify(definition, event as Payload, true)
               return event
             }
           }
-          yield* notify(event as Payload, false)
+          yield* notify(definition, event as Payload, false)
           return event
         })
       }
@@ -422,15 +421,18 @@ export const layerWith = (options?: LayerOptions) =>
           ),
         )
 
-      function notify(event: Payload, isolateListeners: boolean) {
+      function notify(definition: Definition, event: Payload, isolateListeners: boolean) {
         return Effect.gen(function* () {
           yield* Effect.forEach(
             listeners,
             (listener) => (isolateListeners ? observe(event, listener) : listener(event)),
             { discard: true },
           )
-          const typed = pubsub.typed.get(event.type)
-          if (typed) yield* PubSub.publish(typed, event)
+          // Ensure the typed channel exists before publishing so an event published before the
+          // first subscriber attaches is buffered and delivered to it, rather than dropped. This
+          // matches the unbounded `all` channel: subscribers observe everything published.
+          const typed = yield* getOrCreate(definition)
+          yield* PubSub.publish(typed, event)
           yield* PubSub.publish(pubsub.all, event)
         })
       }
@@ -481,6 +483,7 @@ export const layerWith = (options?: LayerOptions) =>
             })
             if (committed && options?.publish) {
               yield* notify(
+                definition,
                 {
                   ...payload,
                   durable: {

packages/core/src/location-services.ts

@@ -27,13 +27,15 @@ import { ReferenceGuidance } from "./reference/guidance"
 import * as SessionRunnerLLM from "./session/runner/llm"
 import { SessionRunnerModel } from "./session/runner/model"
 import { SessionTodo } from "./session/todo"
+import { SessionToolPermissions } from "./session/tool-permissions"
 import { SkillV2 } from "./skill"
 import { SkillGuidance } from "./skill/guidance"
 import { Snapshot } from "./snapshot"
 import { SubagentRunner } from "./subagent/runner"
 import { SystemContextBuiltIns } from "./system-context/builtins"
 import { SystemContextRegistry } from "./system-context/registry"
 import { BuiltInTools } from "./tool/builtins"
+import { MCP } from "./tool/mcp"
 import { ReadToolFileSystem } from "./tool/read-filesystem"
 import { ToolRegistry } from "./tool/registry"
 import { ToolOutputStore } from "./tool-output-store"
@@ -71,9 +73,11 @@ export const locationServices = LayerNode.group([
   SkillGuidance.node,
   ReferenceGuidance.node,
   SessionTodo.node,
+  SessionToolPermissions.node,
   QuestionV2.node,
   ReadToolFileSystem.node,
   BuiltInTools.node,
+  MCP.toolNode,
   SessionRunnerModel.node,
   Snapshot.node,
   SubagentRunner.node,

packages/core/src/plugin.ts

@@ -13,6 +13,7 @@ import { Integration } from "./integration"
 import { KeyedMutex } from "./effect/keyed-mutex"
 import { PluginHost } from "./plugin/host"
 import { Reference } from "./reference"
+import { SessionHooks } from "./session/hooks"
 import { SkillV2 } from "./skill"
 import { State } from "./state"
 
@@ -162,6 +163,7 @@ export const node = makeLocationNode({
     CommandV2.node,
     Integration.node,
     Reference.node,
+    SessionHooks.node,
     SkillV2.node,
   ],
 })

packages/core/src/plugin/host.ts

@@ -1,18 +1,21 @@
 export * as PluginHost from "./host"
 
 import type { PluginContext as Interface } from "@opencode-ai/plugin/v2/effect"
-import { Effect, Schema } from "effect"
+import { EventManifest } from "@opencode-ai/schema/event-manifest"
+import { Effect, Schema, Stream } from "effect"
 import { AgentV2 } from "../agent"
 import { AISDK } from "../aisdk"
 import { Catalog } from "../catalog"
 import { CommandV2 } from "../command"
 import { Credential } from "../credential"
+import { EventV2 } from "../event"
 import { Integration } from "../integration"
 import { ModelV2 } from "../model"
 import { PluginV2 } from "../plugin"
 import { ProviderV2 } from "../provider"
 import { Reference } from "../reference"
 import type { DeepMutable } from "../schema"
+import { SessionHooks } from "../session/hooks"
 import { SkillV2 } from "../skill"
 
 const mutable = <T>(value: T) => value as DeepMutable<T>
@@ -22,6 +25,8 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: PluginV2.Int
   const aisdk = yield* AISDK.Service
   const catalog = yield* Catalog.Service
   const commands = yield* CommandV2.Service
+  const events = yield* EventV2.Service
+  const hooks = yield* SessionHooks.Service
   const integration = yield* Integration.Service
   const reference = yield* Reference.Service
   const skill = yield* SkillV2.Service
@@ -100,6 +105,24 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: PluginV2.Int
       reload: commands.reload,
       transform: commands.transform,
     },
+    event: {
+      // SDK event type strings are identical to the internal definition types, so
+      // the public manifest resolves a subscription directly. A few SDK types (e.g.
+      // server.instance.disposed) are not EventV2 definitions and never emit on the
+      // durable bus; those hand back an empty stream. Payload data is encoded so
+      // in-process subscribers receive the same shape as remote SDK consumers.
+      subscribe: ((type: string) => {
+        const definition = EventManifest.Latest.get(type)
+        if (!definition) return Stream.empty
+        return events.subscribe(definition).pipe(
+          Stream.map((payload) => ({
+            id: payload.id,
+            type: payload.type,
+            properties: Schema.encodeUnknownSync(definition.data)(payload.data),
+          })),
+        )
+      }) as Interface["event"]["subscribe"],
+    },
     integration: {
       reload: integration.reload,
       connection: {
@@ -215,5 +238,64 @@ export const make = Effect.fn("PluginHost.make")(function* (plugin: PluginV2.Int
           }),
         ),
     },
+    tool: {
+      // Bridges the public hook context onto the internal SessionHooks seam the
+      // runner invokes around each tool settlement. before-hooks may rewrite args,
+      // deny, or skip; after-hooks may append context to the tool result.
+      hook: ((name: string, callback: (event: unknown) => Effect.Effect<void>) => {
+        if (name === "execute.before") {
+          return hooks.registerPreToolUse((tool) =>
+            Effect.gen(function* () {
+              let input = tool.input
+              let denied: string | undefined
+              let skipped = false
+              yield* callback({
+                name: tool.name,
+                input: tool.input,
+                args: {
+                  update: (next: unknown) => {
+                    input = next
+                  },
+                },
+                deny: (reason: string) => {
+                  denied = reason
+                },
+                skip: () => {
+                  skipped = true
+                },
+              })
+              if (denied !== undefined) return { action: "deny" as const, reason: denied }
+              if (skipped) return { action: "skip" as const }
+              return input === tool.input
+                ? { action: "allow" as const }
+                : { action: "allow" as const, modifiedInput: input }
+            }),
+          )
+        }
+        if (name === "execute.after") {
+          return hooks.registerPostToolUse((tool) =>
+            Effect.gen(function* () {
+              const parts: string[] = []
+              yield* callback({
+                name: tool.name,
+                input: tool.input,
+                output: tool.output,
+                context: {
+                  add: (text: string) => {
+                    parts.push(text)
+                  },
+                },
+              })
+              return parts.length
+                ? { action: "continue" as const, additionalContext: parts.join("\n") }
+                : { action: "continue" as const }
+            }),
+          )
+        }
+        // Unknown hook names must not silently bridge to a different seam (e.g. a
+        // typo'd "execute.before" landing on the post hook). Warn and no-op.
+        return Effect.logWarning("Unknown tool hook name; ignoring", { name }).pipe(Effect.asVoid)
+      }) as Interface["tool"]["hook"],
+    },
   } satisfies Interface
 })

packages/core/src/session.ts

@@ -86,9 +86,12 @@ export type ListInput = typeof ListInput.Type
 
 type CreateInput = {
   id?: SessionSchema.ID
+  parentID?: SessionSchema.ID
+  title?: string
   agent?: AgentV2.ID
   model?: ModelV2.Ref
-  location: Location.Ref
+  // Optional when parentID is given: the child inherits the parent Session's location.
+  location?: Location.Ref
 }
 
 type CompactInput = {
@@ -244,7 +247,16 @@ const layer = Layer.effect(
         const sessionID = input.id ?? SessionSchema.ID.create()
         const recorded = yield* store.get(sessionID)
         if (recorded) return recorded
-        const project = yield* projects.resolve(input.location.directory)
+        // An explicit location wins; otherwise a child inherits its parent's location. The caller
+        // is trusted here: this process-local API is invoked only by internal services (subagent
+        // executor, prompt), never by a multi-principal HTTP/event surface. If the event bus or
+        // session API is ever exposed to multiple principals, parent-location inheritance must be
+        // gated on an ownership/authorization check.
+        const parent = input.location === undefined && input.parentID ? yield* store.get(input.parentID) : undefined
+        const location = input.location ?? parent?.location
+        if (location === undefined)
+          return yield* Effect.die(new Error("V2Session.create requires either location or an existing parentID"))
+        const project = yield* projects.resolve(location.directory)
         yield* db
           .insert(ProjectTable)
           .values({ id: project.id, worktree: project.directory, vcs: project.vcs?.type, sandboxes: [] })
@@ -257,10 +269,11 @@ const layer = Layer.effect(
           slug: Slug.create(),
           version: InstallationVersion,
           projectID: project.id,
-          directory: input.location.directory,
-          path: path.relative(project.directory, input.location.directory).replaceAll("\\", "/"),
-          workspaceID: input.location.workspaceID ? WorkspaceV2.ID.make(input.location.workspaceID) : undefined,
-          title: `New session - ${new Date(now).toISOString()}`,
+          parentID: input.parentID,
+          directory: location.directory,
+          path: path.relative(project.directory, location.directory).replaceAll("\\", "/"),
+          workspaceID: location.workspaceID ? WorkspaceV2.ID.make(location.workspaceID) : undefined,
+          title: input.title ?? `New session - ${new Date(now).toISOString()}`,
           agent: input.agent,
           model: input.model
             ? {
@@ -274,7 +287,7 @@ const layer = Layer.effect(
           time: { created: now, updated: now },
         })
         const projected = yield* events
-          .publish(SessionV1.Event.Created, { sessionID, info }, { location: input.location })
+          .publish(SessionV1.Event.Created, { sessionID, info }, { location })
           .pipe(
             Effect.as({ type: "created" } as const),
             Effect.catchDefect((defect) => {

packages/core/src/session/hooks.ts

@@ -1,6 +1,6 @@
 export * as SessionHooks from "./hooks"
 
-import { Context, Effect, Layer, Ref } from "effect"
+import { Context, Effect, Layer, Ref, Scope } from "effect"
 import { makeLocationNode } from "../effect/app-node"
 
 export type PreToolUseResult =
@@ -25,8 +25,8 @@ export type PostToolUseHook = (tool: {
 }) => Effect.Effect<PostToolUseResult>
 
 export interface Interface {
-  readonly registerPreToolUse: (hook: PreToolUseHook) => Effect.Effect<void>
-  readonly registerPostToolUse: (hook: PostToolUseHook) => Effect.Effect<void>
+  readonly registerPreToolUse: (hook: PreToolUseHook) => Effect.Effect<void, never, Scope.Scope>
+  readonly registerPostToolUse: (hook: PostToolUseHook) => Effect.Effect<void, never, Scope.Scope>
   readonly runPreToolUse: (tool: {
     readonly name: string
     readonly input: unknown
@@ -87,9 +87,11 @@ const layer = Layer.effect(
     return Service.of({
       registerPreToolUse: Effect.fn("SessionHooks.registerPreToolUse")(function* (hook: PreToolUseHook) {
         yield* Ref.update(preHooks, (current) => [...current, hook])
+        yield* Effect.addFinalizer(() => Ref.update(preHooks, (current) => current.filter((item) => item !== hook)))
       }),
       registerPostToolUse: Effect.fn("SessionHooks.registerPostToolUse")(function* (hook: PostToolUseHook) {
         yield* Ref.update(postHooks, (current) => [...current, hook])
+        yield* Effect.addFinalizer(() => Ref.update(postHooks, (current) => current.filter((item) => item !== hook)))
       }),
       runPreToolUse,
       runPostToolUse,

packages/core/src/session/runner/model.ts

@@ -3,6 +3,7 @@ export * as SessionRunnerModel from "./model"
 import { makeLocationNode } from "../../effect/app-node"
 import { type Model } from "@opencode-ai/llm"
 import * as AnthropicMessages from "@opencode-ai/llm/protocols/anthropic-messages"
+import * as Gemini from "@opencode-ai/llm/protocols/gemini"
 import * as OpenAICompatibleChat from "@opencode-ai/llm/protocols/openai-compatible-chat"
 import * as OpenAIResponses from "@opencode-ai/llm/protocols/openai-responses"
 import { Auth, type AnyRoute } from "@opencode-ai/llm/route"
@@ -153,6 +154,13 @@ export const fromCatalogModel = (
         .model({ id: resolved.api.id }),
     )
   }
+  if (resolved.api.type === "aisdk" && resolved.api.package === "@ai-sdk/google") {
+    return Effect.succeed(
+      withDefaults(resolved, Gemini.route)
+        .with({ auth: key === undefined ? Auth.none : Auth.header("x-goog-api-key", key) })
+        .model({ id: resolved.api.id }),
+    )
+  }
   if (resolved.api.type === "aisdk" && resolved.api.package === "@ai-sdk/openai-compatible" && resolved.api.url) {
     return Effect.succeed(
       withDefaults(resolved, OpenAICompatibleChat.route)
@@ -176,6 +184,7 @@ export const supported = (model: ModelV2.Info) =>
   model.api.type === "aisdk" &&
   (model.api.package === "@ai-sdk/openai" ||
     model.api.package === "@ai-sdk/anthropic" ||
+    model.api.package === "@ai-sdk/google" ||
     (model.api.package === "@ai-sdk/openai-compatible" && model.api.url !== undefined))
 
 /** Resolves models from the catalog belonging to the current Location runtime. */

packages/core/src/session/tool-permissions.ts

@@ -0,0 +1,39 @@
+export * as SessionToolPermissions from "./tool-permissions"
+
+import { Context, Effect, Layer, Ref } from "effect"
+import { makeLocationNode } from "../effect/app-node"
+import { PermissionV2 } from "../permission"
+import { SessionSchema } from "./schema"
+
+// Per-session tool permission overrides consulted by the runner before falling back to the
+// selected agent's permissions. Subagent creation uses this to preserve the read-only subagent
+// default without changing the durable runner's agent-permission resolution. In-memory and
+// Location-scoped: overrides are cleared once the subagent run that set them completes, so the
+// map stays bounded by the set of in-flight subagents rather than the process lifetime.
+export interface Interface {
+  readonly set: (sessionID: SessionSchema.ID, rules: PermissionV2.Ruleset) => Effect.Effect<void>
+  readonly get: (sessionID: SessionSchema.ID) => Effect.Effect<PermissionV2.Ruleset | undefined>
+  readonly delete: (sessionID: SessionSchema.ID) => Effect.Effect<void>
+}
+
+export class Service extends Context.Service<Service, Interface>()("@opencode/v2/SessionToolPermissions") {}
+
+const layer = Layer.effect(
+  Service,
+  Effect.gen(function* () {
+    const overrides = yield* Ref.make(new Map<SessionSchema.ID, PermissionV2.Ruleset>())
+    return Service.of({
+      set: (sessionID, rules) => Ref.update(overrides, (current) => new Map(current).set(sessionID, rules)),
+      get: (sessionID) => Ref.get(overrides).pipe(Effect.map((current) => current.get(sessionID))),
+      delete: (sessionID) =>
+        Ref.update(overrides, (current) => {
+          if (!current.has(sessionID)) return current
+          const next = new Map(current)
+          next.delete(sessionID)
+          return next
+        }),
+    })
+  }),
+)
+
+export const node = makeLocationNode({ service: Service, layer, deps: [] })