[FEATURE] Allow plugin subagents to opt-in to pre-approved permissions at install time

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Plugin subagents intentionally cannot use permissionMode in their frontmatter (documented as a security decision).
This makes it impossible for plugins to ship subagents that run Bash commands in background mode, where permission
prompts cannot be shown and are auto-denied.

The codex@openai-codex plugin is a concrete example: its codex:codex-rescue subagent exists solely to run one node
script, but fails silently in background mode because it cannot get Bash permission pre-approved.

The only workaround is to remove the subagent layer entirely and call Bash directly from the command context, which works, but defeats the plugin's architecture.

Proposed Solution

A controlled opt-in mechanism for plugin subagents to declare required tool permissions, approved once by the user at install time (e.g. during /codex:setup or /plugin install).

Similar to how mobile apps request permissions on install, the user sees exactly what the subagent needs and approves it once. The subagent then runs within those pre-approved boundaries without prompting on every invocation.

This could be implemented as a permissions field in the plugin manifest (plugin.json) that lists required tool approvals per subagent.

Alternative Solutions

1. Manually adding a Bash allow rule to ~/.claude/settings.json — works but is session-wide, not portable, and

requires users to know the exact companion script path.

1. Copying the agent file to ~/.claude/agents/ — promotes it to a regular agent that supports permissionMode, but

breaks on plugin updates.

Priority

High - Significant impact on productivity

Feature Category

Configuration and settings

Use Case Example

1. User installs codex plugin: /plugin install codex@openai-codex
2. Plugin declares it needs Bash(node:*) for its rescue subagent
3. User runs /codex:setup and sees: "This plugin needs permission to run node scripts. Allow? [yes/no]"
4. User approves once
5. /codex:rescue --background works correctly from that point on

Additional Context

_No response_