fix: three bugs in task permissions - parser, deniedTools exemption, pattern merging

1. NativeToolCallParser: Remove permissions from update_todo_list cases
   (was erroneously added to wrong tool case, should only be on new_task)

2. deniedTools: Exempt ALWAYS_AVAILABLE_TOOLS (attempt_completion, etc.)
   from deniedTools check, matching the existing allowedTools behavior.
   Prevents parent from trapping subtask by denying completion tools.

3. Pattern merging: Replace broken exact-string intersection with layered
   enforcement. filePatterns/commandPatterns from parent and child are
   kept as separate layers (AND between layers, OR within each layer).
   This correctly handles narrowing: parent ["src/.*"] + child
   ["src/components/.*"] now allows only files matching BOTH patterns,
   instead of producing an empty intersection.

Author: roomote

packages/types/src/__tests__/task-permissions.spec.ts

@@ -1,5 +1,11 @@
 import { describe, it, expect } from "vitest"
-import { mergeTaskPermissions, matchesAnyPattern, taskPermissionsSchema } from "../task-permissions.js"
+import {
+	mergeTaskPermissions,
+	matchesAnyPattern,
+	matchesAllPatternLayers,
+	taskPermissionsSchema,
+	toTaskPermissions,
+} from "../task-permissions.js"
 import type { TaskPermissions } from "../task-permissions.js"
 
 describe("TaskPermissions", () => {
@@ -34,6 +40,28 @@ describe("TaskPermissions", () => {
 		})
 	})
 
+	describe("toTaskPermissions", () => {
+		it("wraps flat filePatterns into a single layer", () => {
+			const input = { filePatterns: ["src/.*"] }
+			const result = toTaskPermissions(input)
+			expect(result._filePatternLayers).toEqual([["src/.*"]])
+			expect(result.filePatterns).toEqual(["src/.*"])
+		})
+
+		it("wraps flat commandPatterns into a single layer", () => {
+			const input = { commandPatterns: ["npm test.*"] }
+			const result = toTaskPermissions(input)
+			expect(result._commandPatternLayers).toEqual([["npm test.*"]])
+		})
+
+		it("leaves layers undefined when patterns are not set", () => {
+			const input = { allowedTools: ["read_file"] }
+			const result = toTaskPermissions(input)
+			expect(result._filePatternLayers).toBeUndefined()
+			expect(result._commandPatternLayers).toBeUndefined()
+		})
+	})
+
 	describe("mergeTaskPermissions", () => {
 		it("returns undefined when both are undefined", () => {
 			expect(mergeTaskPermissions(undefined, undefined)).toBeUndefined()
@@ -49,18 +77,25 @@ describe("TaskPermissions", () => {
 			expect(mergeTaskPermissions(parent, undefined)).toEqual(parent)
 		})
 
-		it("intersects filePatterns when both defined", () => {
-			const parent: TaskPermissions = { filePatterns: ["src/.*", "tests/.*"] }
-			const child: TaskPermissions = { filePatterns: ["src/.*", "docs/.*"] }
+		it("accumulates filePatterns as separate layers when both defined", () => {
+			const parent = toTaskPermissions({ filePatterns: ["src/.*", "tests/.*"] })
+			const child = toTaskPermissions({ filePatterns: ["src/.*", "docs/.*"] })
 			const merged = mergeTaskPermissions(parent, child)
-			expect(merged?.filePatterns).toEqual(["src/.*"])
+			// Both layers are kept (AND semantics between layers)
+			expect(merged?._filePatternLayers).toEqual([
+				["src/.*", "tests/.*"],
+				["src/.*", "docs/.*"],
+			])
 		})
 
-		it("intersects commandPatterns when both defined", () => {
-			const parent: TaskPermissions = { commandPatterns: ["npm test.*", "npm run lint"] }
-			const child: TaskPermissions = { commandPatterns: ["npm test.*", "npm run build"] }
+		it("accumulates commandPatterns as separate layers when both defined", () => {
+			const parent = toTaskPermissions({ commandPatterns: ["npm test.*", "npm run lint"] })
+			const child = toTaskPermissions({ commandPatterns: ["npm test.*", "npm run build"] })
 			const merged = mergeTaskPermissions(parent, child)
-			expect(merged?.commandPatterns).toEqual(["npm test.*"])
+			expect(merged?._commandPatternLayers).toEqual([
+				["npm test.*", "npm run lint"],
+				["npm test.*", "npm run build"],
+			])
 		})
 
 		it("intersects allowedTools when both defined", () => {
@@ -85,42 +120,50 @@ describe("TaskPermissions", () => {
 		})
 
 		it("uses parent filePatterns when child has none", () => {
-			const parent: TaskPermissions = { filePatterns: ["src/.*"] }
+			const parent = toTaskPermissions({ filePatterns: ["src/.*"] })
 			const child: TaskPermissions = { deniedTools: ["execute_command"] }
 			const merged = mergeTaskPermissions(parent, child)
-			expect(merged?.filePatterns).toEqual(["src/.*"])
+			expect(merged?._filePatternLayers).toEqual([["src/.*"]])
 			expect(merged?.deniedTools).toEqual(["execute_command"])
 		})
 
-		it("returns empty array when intersection is empty", () => {
+		it("returns empty array when allowedTools intersection is empty", () => {
 			const parent: TaskPermissions = { allowedTools: ["read_file"] }
 			const child: TaskPermissions = { allowedTools: ["write_to_file"] }
 			const merged = mergeTaskPermissions(parent, child)
 			expect(merged?.allowedTools).toEqual([])
 		})
 
-		it("handles complex nested merge scenario with exact string matching", () => {
-			const grandparent: TaskPermissions = {
+		it("handles nested delegation where child narrows scope", () => {
+			const grandparent = toTaskPermissions({
 				filePatterns: ["src/.*"],
 				commandPatterns: ["npm.*"],
 				allowedTools: ["read_file", "write_to_file", "search_files"],
 				deniedTools: ["execute_command"],
-			}
-			const parent: TaskPermissions = {
+			})
+			const parent = toTaskPermissions({
 				filePatterns: ["src/components/.*"],
 				allowedTools: ["read_file", "write_to_file"],
-			}
+			})
 
-			// Intersection uses exact string matching, so "src/components/.*" (child)
-			// is not equal to "src/.*" (parent) -- intersection is empty
-			const merged1 = mergeTaskPermissions(grandparent, parent)
-			expect(merged1?.filePatterns).toEqual([])
+			const merged = mergeTaskPermissions(grandparent, parent)
+
+			// Both layers are kept -- runtime enforces AND between them
+			expect(merged?._filePatternLayers).toEqual([["src/.*"], ["src/components/.*"]])
 			// allowedTools intersection: read_file and write_to_file are in both
-			expect(merged1?.allowedTools).toEqual(["read_file", "write_to_file"])
+			expect(merged?.allowedTools).toEqual(["read_file", "write_to_file"])
 			// commandPatterns: only grandparent has them, so they pass through
-			expect(merged1?.commandPatterns).toEqual(["npm.*"])
+			expect(merged?._commandPatternLayers).toEqual([["npm.*"]])
 			// deniedTools: only grandparent has them, so they pass through
-			expect(merged1?.deniedTools).toEqual(["execute_command"])
+			expect(merged?.deniedTools).toEqual(["execute_command"])
+		})
+
+		it("deduplicates identical pattern layers", () => {
+			const parent = toTaskPermissions({ filePatterns: ["src/.*"] })
+			const child = toTaskPermissions({ filePatterns: ["src/.*"] })
+			const merged = mergeTaskPermissions(parent, child)
+			// Identical layers are deduplicated
+			expect(merged?._filePatternLayers).toEqual([["src/.*"]])
 		})
 	})
 
@@ -149,4 +192,31 @@ describe("TaskPermissions", () => {
 			expect(matchesAnyPattern("rm -rf /", ["npm.*", "yarn.*"])).toBe(false)
 		})
 	})
+
+	describe("matchesAllPatternLayers", () => {
+		it("returns true when layers is undefined", () => {
+			expect(matchesAllPatternLayers("anything", undefined)).toBe(true)
+		})
+
+		it("returns true when layers is empty", () => {
+			expect(matchesAllPatternLayers("anything", [])).toBe(true)
+		})
+
+		it("returns true when value matches all layers", () => {
+			const layers = [["src/.*"], ["src/components/.*"]]
+			expect(matchesAllPatternLayers("src/components/Button.tsx", layers)).toBe(true)
+		})
+
+		it("returns false when value fails to match one layer", () => {
+			const layers = [["src/.*"], ["src/components/.*"]]
+			// Matches src/.* but not src/components/.*
+			expect(matchesAllPatternLayers("src/utils/helper.ts", layers)).toBe(false)
+		})
+
+		it("handles single layer like matchesAnyPattern", () => {
+			const layers = [["src/.*", "tests/.*"]]
+			expect(matchesAllPatternLayers("tests/unit/test.ts", layers)).toBe(true)
+			expect(matchesAllPatternLayers("docs/readme.md", layers)).toBe(false)
+		})
+	})
 })

packages/types/src/task-permissions.ts

@@ -38,13 +38,46 @@ export const taskPermissionsSchema = z.object({
 	deniedTools: z.array(z.string()).optional(),
 })
 
-export type TaskPermissions = z.infer<typeof taskPermissionsSchema>
+/** The shape accepted as input from the model via the new_task tool. */
+export type TaskPermissionsInput = z.infer<typeof taskPermissionsSchema>
+
+/**
+ * Internal representation of task permissions.  Extends the input shape with
+ * layered pattern fields that accumulate across nested delegation so that
+ * each ancestor's constraints are enforced independently (AND semantics
+ * between layers, OR semantics within a layer).
+ */
+export interface TaskPermissions extends TaskPermissionsInput {
+	/**
+	 * Accumulated file-pattern layers from ancestor tasks.
+	 * Each inner array is an OR-group; all layers must match (AND between layers).
+	 * Populated only by `mergeTaskPermissions` -- never set from model input.
+	 */
+	_filePatternLayers?: string[][]
+	/**
+	 * Accumulated command-pattern layers from ancestor tasks.
+	 * Same semantics as `_filePatternLayers`.
+	 */
+	_commandPatternLayers?: string[][]
+}
+
+/**
+ * Convert a validated input object (flat arrays) into the internal
+ * `TaskPermissions` representation, wrapping patterns into single layers.
+ */
+export function toTaskPermissions(input: TaskPermissionsInput): TaskPermissions {
+	return {
+		...input,
+		_filePatternLayers: input.filePatterns ? [input.filePatterns] : undefined,
+		_commandPatternLayers: input.commandPatterns ? [input.commandPatterns] : undefined,
+	}
+}
 
 /**
  * Merge two TaskPermissions using most-restrictive-wins semantics.
  *
- * - filePatterns / commandPatterns: if both define patterns, keep only patterns
- *   present in both (intersection). If only one side defines patterns, use that.
+ * - filePatterns / commandPatterns: accumulated as independent layers so that
+ *   a value must match at least one pattern from EACH ancestor's layer.
  * - allowedTools: intersection of both lists (if both defined).
  * - deniedTools: union of both lists (most restrictive).
  *
@@ -64,14 +97,77 @@ export function mergeTaskPermissions(
 		return parent
 	}
 
+	// Collect pattern layers from both sides.  Each side may already carry
+	// accumulated layers from earlier merges (_*PatternLayers) as well as
+	// its own top-level patterns (filePatterns / commandPatterns).
+	const filePatternLayers = collectPatternLayers(
+		parent._filePatternLayers,
+		parent.filePatterns,
+		child._filePatternLayers,
+		child.filePatterns,
+	)
+
+	const commandPatternLayers = collectPatternLayers(
+		parent._commandPatternLayers,
+		parent.commandPatterns,
+		child._commandPatternLayers,
+		child.commandPatterns,
+	)
+
 	return {
-		filePatterns: intersectOptionalArrays(parent.filePatterns, child.filePatterns),
-		commandPatterns: intersectOptionalArrays(parent.commandPatterns, child.commandPatterns),
+		// The top-level field stores the child's own patterns (used for display /
+		// serialization); runtime enforcement uses the layers.
+		filePatterns: child.filePatterns ?? parent.filePatterns,
+		commandPatterns: child.commandPatterns ?? parent.commandPatterns,
+		_filePatternLayers: filePatternLayers.length > 0 ? filePatternLayers : undefined,
+		_commandPatternLayers: commandPatternLayers.length > 0 ? commandPatternLayers : undefined,
 		allowedTools: intersectOptionalArrays(parent.allowedTools, child.allowedTools),
 		deniedTools: unionOptionalArrays(parent.deniedTools, child.deniedTools),
 	}
 }
 
+/**
+ * Collect pattern layers from parent and child, deduplicating identical layers.
+ */
+function collectPatternLayers(
+	parentLayers: string[][] | undefined,
+	parentPatterns: string[] | undefined,
+	childLayers: string[][] | undefined,
+	childPatterns: string[] | undefined,
+): string[][] {
+	const layers: string[][] = []
+	const seen = new Set<string>()
+
+	const addLayer = (layer: string[]) => {
+		if (layer.length === 0) return
+		const key = JSON.stringify(layer)
+		if (!seen.has(key)) {
+			seen.add(key)
+			layers.push(layer)
+		}
+	}
+
+	// Add accumulated parent layers
+	if (parentLayers) {
+		for (const layer of parentLayers) {
+			addLayer(layer)
+		}
+	} else if (parentPatterns && parentPatterns.length > 0) {
+		addLayer(parentPatterns)
+	}
+
+	// Add accumulated child layers
+	if (childLayers) {
+		for (const layer of childLayers) {
+			addLayer(layer)
+		}
+	} else if (childPatterns && childPatterns.length > 0) {
+		addLayer(childPatterns)
+	}
+
+	return layers
+}
+
 /**
  * Check if a value matches at least one pattern in a list of regex patterns.
  */
@@ -86,6 +182,17 @@ export function matchesAnyPattern(value: string, patterns: string[]): boolean {
 	})
 }
 
+/**
+ * Check if a value matches ALL pattern layers (AND between layers, OR within each layer).
+ * Returns true if there are no layers.
+ */
+export function matchesAllPatternLayers(value: string, layers: string[][] | undefined): boolean {
+	if (!layers || layers.length === 0) {
+		return true
+	}
+	return layers.every((layer) => matchesAnyPattern(value, layer))
+}
+
 /**
  * Intersect two optional arrays. If both are defined, return elements present
  * in both. If only one is defined, return that one. If neither, return undefined.

src/core/assistant-message/NativeToolCallParser.ts

@@ -551,7 +551,6 @@ export class NativeToolCallParser {
 				if (partialArgs.todos !== undefined) {
 					nativeArgs = {
 						todos: partialArgs.todos,
-						permissions: partialArgs.permissions,
 					}
 				}
 				break
@@ -889,7 +888,6 @@ export class NativeToolCallParser {
 					if (args.todos !== undefined) {
 						nativeArgs = {
 							todos: args.todos,
-							permissions: args.permissions,
 						} as NativeArgsFor<TName>
 					}
 					break

src/core/tools/NewTaskTool.ts

@@ -1,7 +1,7 @@
 import * as vscode from "vscode"
 
 import { TodoItem } from "@roo-code/types"
-import { type TaskPermissions, taskPermissionsSchema } from "@roo-code/types"
+import { type TaskPermissions, taskPermissionsSchema, toTaskPermissions } from "@roo-code/types"
 
 import { Task } from "../task/Task"
 import { getModeBySlug } from "../../shared/modes"
@@ -101,7 +101,7 @@ export class NewTaskTool extends BaseTool<"new_task"> {
 						)
 						return
 					}
-					parsedPermissions = result.data
+					parsedPermissions = toTaskPermissions(result.data)
 				} catch (error) {
 					task.consecutiveMistakeCount++
 					task.recordToolError("new_task")