bypassPermissions permission mode does not propagate to Task/Agent subagents

What happens

When the main session runs in bypassPermissions mode, its own tool calls are never gated by permission prompts (as expected). But subagents spawned via the Task/Agent tool run their tool calls as if in default mode — they repeatedly prompt the user for permission on ordinary Bash and Read calls that the parent session auto-approves.

This breaks unattended multi-agent pipelines: every subagent shell/read call blocks on a human approval that bypassPermissions was supposed to eliminate.

Environment

• Claude Code 2.1.220
• macOS 26.5.2

Configuration (verified)

~/.claude/settings.json:

{
  "permissions": {
    "allow": ["WebSearch", "WebFetch", "Bash", "Read", "Write", "Edit", "Glob", "Grep", "Task", "TodoWrite"],
    "deny": [],
    "defaultMode": "bypassPermissions"
  }
}

settings.local.json files only add allow entries; none override defaultMode.

Expected

A subagent spawned from a bypassPermissions session inherits the parent's permission mode (or at minimum the permissions.allow list), so bypassed / allow-listed tool calls do not prompt.

Actual

The subagent prompts the user on bare Bash/Read calls — i.e. it behaves as default mode. Two candidate causes:

1. Task/Agent subagents do not inherit the parent's live bypassPermissions mode (fall back to default).
2. Subagents do not inherit the user/project permissions.allow list, so even bare-allow-listed tools prompt.

The Agent tool's own documentation states that subagents inherit the parent session's permission mode and that its mode parameter is deprecated/ignored, so there is no caller-side override to work around this.

Minimal repro

1. In ~/.claude/settings.json, set permissions.defaultMode = "bypassPermissions".
2. Start a session; confirm the main session does not prompt on a Bash call.
3. Spawn a subagent via the Task tool with a prompt like: "run git status and report the output".
4. Observe whether the subagent's Bash(git status) call prompts for permission.

Expected: no prompt (parent is bypassed). Observed: a prompt appears.

Impact

Autonomous / unattended multi-agent workflows — a main session orchestrating Task subagents — stall, because each subagent tool call requires an interactive approval that bypass mode was meant to remove.