From 74e519e54541731e2532307c6b1a26aa2536b373 Mon Sep 17 00:00:00 2001
From: ismeth <ufukaltinok@gmail.com>
Date: Thu, 19 Feb 2026 13:53:11 +0100
Subject: [PATCH] fix(athena): add call_omo_agent to ATHENA_RESTRICTIONS for
 consistent tool denial

ATHENA_RESTRICTIONS only denied write and edit, missing call_omo_agent that the agent factory already denies. This caused 6 callers of getAgentToolRestrictions() to get incomplete restrictions.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---
 src/shared/agent-tool-restrictions.test.ts | 33 ++++++++++++++++++++++
 src/shared/agent-tool-restrictions.ts      |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 src/shared/agent-tool-restrictions.test.ts

diff --git a/src/shared/agent-tool-restrictions.test.ts b/src/shared/agent-tool-restrictions.test.ts
new file mode 100644
index 00000000..96daad77
--- /dev/null
+++ b/src/shared/agent-tool-restrictions.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test"
+import {
+  getAgentToolRestrictions,
+  hasAgentToolRestrictions,
+} from "./agent-tool-restrictions"
+
+describe("agent-tool-restrictions", () => {
+  test("athena restrictions include call_omo_agent", () => {
+    //#given
+    //#when
+    const restrictions = getAgentToolRestrictions("athena")
+    //#then
+    expect(restrictions.write).toBe(false)
+    expect(restrictions.edit).toBe(false)
+    expect(restrictions.call_omo_agent).toBe(false)
+  })
+
+  test("council-member restrictions include call_omo_agent", () => {
+    //#given
+    //#when
+    const restrictions = getAgentToolRestrictions("council-member")
+    //#then
+    expect(restrictions.call_omo_agent).toBe(false)
+  })
+
+  test("hasAgentToolRestrictions returns true for athena", () => {
+    //#given
+    //#when
+    const result = hasAgentToolRestrictions("athena")
+    //#then
+    expect(result).toBe(true)
+  })
+})
diff --git a/src/shared/agent-tool-restrictions.ts b/src/shared/agent-tool-restrictions.ts
index 6c7e2257..9f453921 100644
--- a/src/shared/agent-tool-restrictions.ts
+++ b/src/shared/agent-tool-restrictions.ts
@@ -14,7 +14,7 @@ const EXPLORATION_AGENT_DENYLIST: Record<string, boolean> = {
 }
 
 const ATHENA_RESTRICTIONS = permissionToToolBooleans(
-  createAgentToolRestrictions(["write", "edit"]).permission
+  createAgentToolRestrictions(["write", "edit", "call_omo_agent"]).permission
 )
 
 const AGENT_RESTRICTIONS: Record<string, Record<string, boolean>> = {