It's not clear what sub-agent permissions are allowed if multiple shell patterns are defined

[stsquad]

To upvote this issue, give it a thumbs up. See this list for the most upvoted issues.

Please avoid AI slops, be concise, and focus on what matters for this issue.

Describe the bug

I have a sub-agent defined with the following permissions:

---
mode: subagent
description: A subagent to run qemu helper tasks such as code exploration, building and issue handling
inherit: general
model: google/models/gemini-flash-latest
tools:
  allow:
    - eca__compact_chat
    - eca__directory_tree
    - eca__editor_diagnostics
    - eca__fetch_rule
    - eca__grep
    - eca__read_file
    - eca__skill
    - eca__task
    - eca__bg_job
    - eca__shell_command(ls)
    - eca__shell_command(global)
    - eca__shell_command(git grep)
    - eca__shell_command(git diff(\s+.*)?)
    - eca__shell_command(glab issue view)
    - eca__shell_command(glab issue list)
    - eca__shell_command(make)
---

You should check what skills are available, there is likely a skill available for the task you've been asked to do.

However when running the sub-agent I keep getting prompted for things that should be good to go. However /subagents indicates there is only one allow permission:

/subagents


Subagents available:

- **explorer**: Codebase search specialist. Focuses on finding and reading file contents without modifying the system.

  Tool permissions:
  Default: ask
  Allow: eca__compact_chat, eca__directory_tree, eca__editor_diagnostics, eca__fetch_rule, eca__grep, eca__read_file, eca__shell_command, eca__skill, eca__task
  Deny: eca__shell_command

- **general**: General-purpose agent for researching complex questions and executing multi-step tasks. 
Use this agent to execute multiple units of work in parallel.


- **qemu-helper-agent**: A subagent to run qemu helper tasks such as code exploration, building and issue handling
  Model: google/models/gemini-flash-latest
  Tool permissions:
  Allow: eca__bg_job, eca__compact_chat, eca__directory_tree, eca__editor_diagnostics, eca__fetch_rule, eca__grep, eca__read_file, eca__shell_command, eca__skill, eca__task

Expected behaviour

The subagents display should clearly show which shell patterns are enabled.A clear and concise description of what you expected to happen. It would be useful to find out why a tool permission was allowed or denied.

[zikajk]

@stsquad What about this?

 my-explorer: Explorer with a custom model
  Model: synthetic/hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4
  Tool permissions:
  Default: ask
  Allow: eca__compact_chat, eca__directory_tree, eca__editor_diagnostics, eca__fetch_rule, eca__grep, eca__read_file, eca__shell_command(git grep), eca__skill, eca__task
  Deny: eca__shell_command(.*-c\s+["'].*open.*["']w["'].*), eca__shell_command(.*[12&]?>>?\s*(?!/dev/null\b)(?!/tmp/\S*\b)(?!&\d+\b)(?!>)\S+.*), eca__shell_command(.*\b(rm|mv|cp|touch|mkdir)\b.*), eca__shell_command(.*\b(sed|awk|perl)\s+.*-i.*), eca__shell_command(.*\|\s*(tee|dd|xargs).*), eca__shell_command(.*bash.*-c.*[12&]?>>?\s*(?!/dev/null\b)(?!/tmp/\S*\b)(?!&\d+\b)(?!>)\S+.*), eca__shell_command(.*git\s+(add|commit|push).*), eca__shell_command(.*npm\s+install.*)

cc. @ericdallo

[zikajk]

Or this, which is more readable but takes up a lot more space (maybe it wouldn't be a bad idea to have it as an expandable block or a separate menu—I'm not sure).

- **explorer**: Codebase search specialist. Focuses on finding and reading file contents without modifying the system.

  Model: synthetic/hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4
  Tool permissions:
  Default: ask
  Allow:
    - eca__compact_chat
    - eca__directory_tree
    - eca__editor_diagnostics
    - eca__fetch_rule
    - eca__grep
    - eca__read_file
    - eca__shell_command:
      - pwd
      - git\s+diff(\s+.*)?
      - git\s+log(\s+.*)?
      - git\s+show(\s+.*)?
      - find(\s+.*)?
      - ls(\s+.*)?
    - eca__skill
    - eca__task
  Deny:
    - eca__shell_command:
      - .*[12&]?>>?\s*(?!/dev/null\b)(?!/tmp/\S*\b)(?!&\d+\b)(?!>)\S+.*
      - .*\|\s*(tee|dd|xargs).*
      - .*\b(sed|awk|perl)\s+.*-i.*
      - .*\b(rm|mv|cp|touch|mkdir)\b.*
      - .*git\s+(add|commit|push).*
      - .*npm\s+install.*
      - .*-c\s+["'].*open.*["']w["'].*
      - .*bash.*-c.*[12&]?>>?\s*(?!/dev/null\b)(?!/tmp/\S*\b)(?!&\d+\b)(?!>)\S+.*

[ericdallo]

@zikajk I'm pretty ok with your second suggestion as it's more important to describe well the subagents when the issue is invoked than anything, willing to open a PR for that?

[zikajk]

@ericdallo ok, I have it stashed. Will do pr tomorrow.
Maybe we can later think about some way how to show it temporary or something simillar. It takes a lot of space now.