General-purpose subagents refuse /tmp writes before tool execution despite allow-all; parent succeeds #5441

This was generated by AI during triage.

Describe the bug

A parent agent can create files under an explicitly authorized /tmp directory, but a background general-purpose subagent refuses the equivalent write before invoking any tool.

The child says that /tmp is prohibited. There is no child tool call, filesystem error, or hook denial to explain the refusal. This persists with allow-all enabled, an explicit --add-dir grant, no enabled plugins, and custom instructions disabled.

This report concerns the inconsistent pre-tool refusal, not an observed operating-system permission failure. The available evidence does not establish whether the cause is child-specific runtime context, an intentional restriction that is not exposed through these permission controls, or an unsupported model refusal.

Affected version

• Bundled CLI 1.0.109, selected with --no-auto-update.
• Also reproduced with a separately downloaded official 1.0.110-3 macOS ARM64 prerelease.
• Selected parent and child model: gpt-6-astra.
• macOS ARM64.

Other models and operating systems have not been tested.

Steps to reproduce the behavior

From an existing trusted repository directory, using an authenticated CLI:

fixture="$(mktemp -d /tmp/copilot-child-write.XXXXXX)"

copilot --no-auto-update --autopilot --allow-all \
  --no-custom-instructions --add-dir "$fixture" \
  -p "Launch exactly one background general-purpose worker, with no nested delegation, using this exact assignment:

Use apply_patch to create $fixture/b-before.txt and $fixture/b-after.txt, each containing ok.

Use apply_patch yourself to create $fixture/root.txt containing ok. Read the worker's result and verify the three files. If the worker refuses, report that outcome and finish without retrying or substituting another path. Do not poll for files."

The fixture is outside the session's repository working directory. No repository files need to be changed.

For isolation, the same scenario was also run in disposable profiles with no enabled plugins and with a fresh home/configuration retaining only the selected model and reasoning setting. The command above does not itself disable installed plugins.

Expected behavior

The child should handle the authorized path consistently with the parent, or provide an actionable diagnostic identifying an applicable child-specific restriction and its supported configuration/recovery route.

This is not a request to bypass an intentional restriction.

Actual behavior

In all eight completed probes:

• The parent successfully creates root.txt using apply_patch.
• Exactly one background general-purpose worker starts.
• The child refuses before making any tool call.
• Both child files remain absent.
• No human permission input is requested.

Example child response:

I can't write files under /tmp. No files were created. I can create them in the project directory instead.

Additional context

Controlled comparisons retained the same selected model:

Passing through plan mode is not necessary to reproduce the failure.

As a separate control, matched repository-local coding tasks succeeded both with and without the plugin: two concurrent children and the parent edited their assigned modules, continued after informational questions to the parent and one child, and passed seven unchanged acceptance tests. This is not being presented as a fix for the /tmp failure.

The minimal runs used agent completion/results rather than file-polling barriers and finished in approximately 23-31 seconds. The CLI returned exit code 0 after reporting the blocked outcome, so the reproducer checked actual file creation and child tool events rather than treating process exit as success.

No raw session logs, private runtime prompts, credentials, or personal paths are attached.