[BUG] Multiple Task(...) entries in agent tools frontmatter — only the last entry is honoured

What's Wrong?

When an agent's YAML frontmatter specifies multiple Task(plugin:agent-name) entries
in the tools: field (comma-separated format), only the last entry takes effect.
All previous Task(...) entries are silently ignored.

Spawning any agent that is not the last in the list fails with:

Agent type 'plugin:agent-a' has been denied by permission rule 'Task(plugin:agent-a)' from settings.

What Should Happen?

All Task(...) entries listed in tools: should be respected independently.
An agent with tools: Read, Bash, Task(plugin:agent-a), Task(plugin:agent-b) should
be allowed to spawn both plugin:agent-a and plugin:agent-b.

Steps to Reproduce

1. Create a plugin with two agents: plugin:agent-a and plugin:agent-b

1. Create an orchestrator agent with the following frontmatter:

``yaml
---
name: orchestrator
tools: Read, Bash, Task(plugin:agent-a), Task(plugin:agent-b)
---
``

1. Set "agent": "plugin:orchestrator" in settings.json and start a TUI session.

1. From the orchestrator, attempt to spawn plugin:agent-a:

→ Fails with: Agent type 'plugin:agent-a' has been denied by permission rule 'Task(plugin:agent-a)' from settings.

1. Attempt to spawn plugin:agent-b (the last entry):

→ Succeeds.

1. Swap order to tools: Read, Bash, Task(plugin:agent-b), Task(plugin:agent-a):

→ Now agent-a works, agent-b fails. Only the last entry ever works.

Error Messages/Logs

Agent type 'plugin:agent-a' has been denied by permission rule 'Task(plugin:agent-a)' from settings.

Workaround

Use disallowedTools: instead of tools: — agents are permitted by default and
only write/edit tools are blocked:

---
name: orchestrator
disallowedTools: Write, Edit, NotebookEdit
---

Root Cause Hypothesis

The tools: field parser likely uses Task as the map key (without the parenthesised
argument), so each Task(plugin:X) entry overwrites the previous one. Only the last
survives into the permission resolver.

Using the JSON array format ["Task(plugin:agent-a)", "Task(plugin:agent-b)"] was
not tested — may also be affected.

Additional Notes

• Feature was introduced in v2.1.33: _"Added support for restricting which sub-agents

can be spawned via Task(agent_type) syntax in agent tools frontmatter"_

• Behaviour is consistent and reproducible — order-dependent, always last-wins
• --print (non-interactive) mode appears unaffected; issue is specific to TUI sessions

with a named agent loaded via settings.json