core: permission rejection is reported as user interruption #35821

Summary

A denied tool permission in a V2 child session is reported as an explicit user interruption. This makes foreground subagent calls fail with Session interrupted by user even though the user never interrupted them.

Environment

• opencode version: 0.0.0-next-15088
• OS: macOS 25.5.0, arm64
• Terminal: Zed (TERM=xterm-256color, COLORTERM=truecolor)
• Shell: /bin/zsh
• Install/channel: next
• Active plugins: share-with-team.ts, debug-workspace-plugin.ts, @warp-dot-dev/opencode-warp

Reproduction

1. Start a foreground Explore subagent from a V2 parent session.
2. Give it a task that causes it to attempt the shell tool.
3. Let the configured permissions reject shell for the Explore agent.
4. Inspect the child and parent durable events.

Observed consistently in two Explore children from parent session ses_0c0dc18b9ffeQwp2hcCZa4EK7d:

• ses_0c0cdb674ffeFsJ169taUaOwlx
• ses_0c0cc2818ffe54Orj8DX2LSK4v

Expected Behavior

A denied tool permission should remain a permission rejection. The child execution should fail or settle with a permission-specific outcome, and the parent subagent tool should report that the child could not use shell.

session.execution.interrupted { reason: "user" } should only be emitted for an actual explicit user interruption.

Actual Behavior

The child first records the correct tool and step failure:

session.tool.failed
error.type = "permission.rejected"
error.message = "Permission denied: shell"

session.step.failed
error.type = "permission.rejected"
error.message = "Permission denied: shell"

It then records an incorrect terminal event:

session.execution.interrupted
reason = "user"

The foreground parent subagent tool consequently reports:

Session interrupted by user

No user interrupt request occurred.

Additional Context

The runner converts permission-rejected tool settlement into UserInterruptedError, and SessionExecutionLocal.terminal(...) maps that error to session.execution.interrupted { reason: "user" }. This conflates two separate facts:

• the user or policy denied a particular tool action
• the user explicitly interrupted Session execution

General review subagents in the same parent session completed normally because they did not hit the denied Explore shell permission path.

This is particularly confusing for foreground subagents because the parent loses the actionable permission error and instead receives a false attribution to the user.