[BUG] Agent mode acceptEdits overrides parent bypassPermissions despite documented precedence

Preflight Checklist

• [x] I searched existing issues and did not find this exact current-version case where an explicit per-invocation Agent.mode weakens a parent bypassPermissions session.
• [x] This is a single bug report.
• [x] I am using the latest Claude Code version (2.1.210, also the current npm version at filing time).

What's Wrong?

A parent session running in bypassPermissions spawned a foreground plugin subagent through the Agent tool. The Agent invocation explicitly included mode: "acceptEdits". Claude Code honored that weaker per-invocation mode, and the subagent subsequently displayed a Bash approval prompt.

The parent transcript records:

{"type":"permission-mode","permissionMode":"bypassPermissions"}

The Agent tool call records:

{
  "subagent_type": "convex:convex-expert",
  "run_in_background": false,
  "mode": "acceptEdits"
}

The generated subagent metadata confirms the effective mode was weakened:

{
  "agentType": "convex:convex-expert",
  "spawnMode": "acceptEdits",
  "description": "Implement folder persistence",
  "spawnDepth": 1
}

The subagent then requested approval for:

cd <project>/packages/backend && npx tsc --noEmit 2>&1 | head -50

The dialog identified the command as coming from the convex:convex-expert agent and said, "This command requires approval."

This contradicts the current subagent documentation:

If the parent uses bypassPermissions or acceptEdits, this takes precedence and can't be overridden.

The documented behavior is also repeated in the Agent SDK permission documentation: subagents inherit bypassPermissions, and it cannot be overridden per subagent.

There were no permissions.ask rules. The configured PermissionRequest hook only sends a notification and does not return a permission decision. The plugin agent definition itself has no permissionMode frontmatter. The command operated inside the working directory.

What Should Happen?

When the parent session is in bypassPermissions, that mode should take precedence as documented. A weaker mode value on the Agent invocation should either be ignored or normalized to bypassPermissions.

The subagent's effective metadata should therefore show spawnMode: "bypassPermissions", and its Bash calls should not display approval prompts unless an explicit permissions.ask rule, deny rule, protected removal check, or blocking hook applies.

Error Messages/Logs

Bash command · from the convex:convex-expert agent

cd <project>/packages/backend && npx tsc --noEmit 2>&1 | head -50

This command requires approval

Do you want to proceed?
1. Yes
2. Yes, and don't ask again for: npx tsc *
3. No

Steps to Reproduce

1. Start Claude Code in a project with bypass enabled:

``sh
claude --dangerously-skip-permissions
``

1. Confirm the session transcript records permissionMode: "bypassPermissions".
2. Spawn a foreground subagent through the Agent tool while explicitly passing a weaker mode:

``json
{
"subagent_type": "general-purpose",
"description": "Reproduce permission inheritance",
"prompt": "Run a project typecheck through Bash, for example: npx tsc --noEmit 2>&1 | head -50",
"run_in_background": false,
"mode": "acceptEdits"
}
``

1. Observe that the subagent metadata records spawnMode: "acceptEdits" rather than inheriting the parent's bypassPermissions.
2. Observe the Bash approval dialog from the subagent.

The original occurrence used a plugin-provided subagent (convex:convex-expert), but its agent definition had no permission-mode frontmatter; the weaker mode came from the per-invocation Agent input.

Claude Model

Other. The occurrence was captured through a CCS/Superset-hosted Claude Code CLI session using a custom model provider. The permission-mode transition itself is recorded and enforced locally by Claude Code after the Agent tool input is accepted.

Is this a regression?

I don't know. Similar propagation bugs were reported in #37442 and #40241; #40241 says the earlier Edit/Write case was fixed in v2.1.98. This occurrence is on v2.1.210 and involves an explicit per-invocation mode: "acceptEdits" overriding the parent bypass mode.

Claude Code Version

2.1.210 (Claude Code)

Platform

Other: custom provider through CCS/Superset.

Operating System

macOS 26.5 / Darwin 25.5.0.

Terminal/Shell

Other: Claude Code CLI hosted by CCS/Superset; zsh environment.

Additional Information

Relevant documentation:

• https://code.claude.com/docs/en/sub-agents#permission-modes
• https://code.claude.com/docs/en/agent-sdk/permissions#permission-modes

Related historical reports:

• #37442 — Subagents don't inherit bypassPermissions mode from parent session
• #40241 — --dangerously-skip-permissions does not propagate to subagents
• #39523 — Bypass permissions meta issue

The important distinction in this report is that the parent did have bypass active, but the accepted Agent tool input explicitly requested acceptEdits, and Claude Code allowed that per-call mode to weaken the documented parent precedence.