docs: note full access for subagents

apps/server/src/services/skills/builtin-skills/bb-cli/SKILL.md

@@ -58,6 +58,8 @@ message agents, or inspect projects, providers, and environments.
 - Spawn creates a root thread unless you pass `--parent-thread`.
 - Spawned child threads inherit permission from explicit flags, then the
   parent thread's last execution, then project defaults.
+- When spawning a subagent, pass `--permission-mode full` unless the user or
+  task explicitly requests restricted access.
 - Use `--parent-self` inside a thread to parent the new thread to the current
   thread.
 - Use `--parent-thread <thread-id>` to choose another specific parent.

packages/templates/src/generated/templates.generated.ts

@@ -95,7 +95,7 @@ export const templateDefinitions = [
   },
   {
     "id": "bbGuideThreads",
-    "body": "Thread commands\n\nEvery command supports --json for machine-readable output.\n\nSpawning:\n\n  bb thread spawn --project <id> --prompt \"...\" [options]\n\n    --prompt <prompt>              Initial prompt (required)\n    --title <title>                Thread title\n    --project <id>                 Project (required)\n    --parent-thread <id>           Parent thread\n    --parent-self                  Parent to the current thread (BB_THREAD_ID)\n    --provider <id>                Provider override\n    --model <model>                Model override\n    --reasoning-level <level>      Reasoning level: low, medium, high, xhigh, max (provider-dependent)\n    --environment <id-or-path>     Attach to an existing environment (ID or workspace path)\n    --new-environment <kind>       Create a new environment (worktree)\n    --service-tier <tier>          Service tier: fast, default\n    --permission-mode <mode>       Permission mode: full, workspace-write, or readonly\n\n  Execution defaults resolve from explicit flags, live parent execution, project defaults, then product defaults.\n  Parenting is opt-in. Inside a thread, pass --parent-self to parent the new thread to the current thread.\n\nListing:\n\n  bb thread list                           List threads\n    --project <id>                         Filter by project\n    --parent-thread <id>                   Filter by parent thread\n    --archived                             Show only archived threads\n\nInspecting:\n\n  bb thread show [id]                      Show thread details and pull request status\n    --self                                 Target current thread\n    --work-status                          Include git working-tree status\n    --git-diff                             Include git diff\n    --diff-target <type>                   Diff scope: uncommitted, branch_committed, all, commit\n    --diff-sha <sha>                       Commit SHA (for --diff-target commit)\n    --diff-merge-base <branch>             Override merge-base branch for diff\n    --merge-base-branches                  List available merge-base branches\n\n  Shows pull request status for the attached environment branch when available.\n\n  bb thread log [id]                       Show thread event log\n    --self                                 Target current thread\n    --format <format>                      Output format: json, minimal, verbose\n    --limit <count>                        Limit entries\n    --after-seq <seq>                      Paginate after sequence number\n\n  bb thread output [id]                    Get the final output of a thread\n    --self                                 Target current thread\n\n  bb thread wait <id>                      Wait for a thread status or event (defaults to --status idle)\n    --status <status>                      Wait for this status\n    --event <type>                         Wait for this event type\n    --timeout <seconds>                    Timeout\n    --poll-interval <ms>                   Polling interval in milliseconds\n\nOpening files in the thread panel:\n\n  bb thread open <path>                    Open a file in the current BB thread panel\n  bb thread open <thread-id> <path>        Open a file in a specific BB thread panel\n    --line <number>                        Line number to focus\n\n  Inside a BB thread, BB_THREAD_ID selects the current thread automatically and\n  the thread ID argument is omitted. Outside a BB thread, pass the thread ID as\n  the first argument.\n\n  Paths can be thread-relative workspace paths, or absolute paths inside the\n  target thread workspace. Absolute paths under BB_THREAD_STORAGE open as\n  thread-storage files for the current thread. Use this for Markdown or HTML\n  artifacts you create for the user so they open in the BB IDE.\n\nThread terminals:\n\n  Use thread terminals for long-running commands that should stay alive for the\n  user, such as dev servers, watch tasks, REPLs, and database consoles. Terminals\n  are real PTY sessions scoped to the thread's environment, and they appear in the\n  bb UI as terminal tabs.\n\n  bb thread terminal start <id> --command \"pnpm dev\"\n    --title <title>                        Display title\n    --cols <n>                             Initial terminal columns\n    --rows <n>                             Initial terminal rows\n    --attach                               Attach interactively after starting\n    --json                                 Print the created terminal session\n\n  bb thread terminal list <id>             List running terminals for a thread\n\n  bb thread terminal attach <terminal-id> <id>\n                                            Attach interactively; Ctrl-B d detaches\n\n  bb thread terminal send <terminal-id> <id>\n    --text <text>                          Text to send\n    --stdin                                Read text from stdin\n    --enter                                Append a newline\n\n  bb thread terminal output <terminal-id> <id>\n    --since-seq <n>                        Read output chunks from a sequence\n    --tail-bytes <n>                       Bound output to latest N bytes\n    --limit-chunks <n>                     Bound output to latest N chunks\n    --json                                 Print chunks, nextSeq, and truncated\n\n  bb thread terminal wait <terminal-id> <id>\n    --contains <text>                      Wait for new output containing text\n    --regex <pattern>                      Wait for new output matching regex\n    --exit                                 Wait until the terminal exits\n    --from-start                           Include existing scrollback\n    --timeout <seconds>                    Timeout\n    --poll-interval <ms>                   Polling interval\n\n  bb thread terminal resize <terminal-id> <id> --cols <n> --rows <n>\n  bb thread terminal stop <terminal-id> <id>\n\n  Terminal commands require an explicit thread ID.\n\n  For a dev server, prefer:\n\n    bb thread terminal start <thread-id> --title \"pnpm dev\" --command \"pnpm dev\"\n    bb thread terminal wait <terminal-id> <thread-id> --contains \"Local:\" --timeout 120\n\n  Do not run long-lived servers as one-off foreground commands when the user will\n  need to inspect logs, refresh the page, or stop the process later.\n\nMessaging:\n\n  bb thread tell <id> <message>            Send a follow-up message\n    --mode <mode>                          Message mode: queue (default), steer, or auto\n    --model <model>                        Model override for this turn\n    --reasoning-level <level>              Reasoning level override\n\n  bb thread stop [id]                      Stop an active or provisioning thread\n    --self                                 Stop current thread\n\nOwnership:\n\n  bb thread update [id]                    Update thread metadata\n    --self                                 Target current thread\n    --title <title>                        Set title\n    --parent-thread <id>                   Assign to a parent thread\n    --clear-parent-thread                  Remove parent assignment\n\nLifecycle:\n\n  bb thread archive [id]                   Archive a thread\n    --self                                 Archive current thread\n\n  bb thread unarchive [id]                 Unarchive a thread\n    --self                                 Unarchive current thread\n\n  bb thread delete <id>                    Delete permanently\n    --yes                                  Skip confirmation\n\nRead-only commands require a thread ID or --self where supported.\nMutating thread lifecycle and messaging commands require an explicit ID or --self.\nTerminal commands require an explicit thread ID.",
+    "body": "Thread commands\n\nEvery command supports --json for machine-readable output.\n\nSpawning:\n\n  bb thread spawn --project <id> --prompt \"...\" [options]\n\n    --prompt <prompt>              Initial prompt (required)\n    --title <title>                Thread title\n    --project <id>                 Project (required)\n    --parent-thread <id>           Parent thread\n    --parent-self                  Parent to the current thread (BB_THREAD_ID)\n    --provider <id>                Provider override\n    --model <model>                Model override\n    --reasoning-level <level>      Reasoning level: low, medium, high, xhigh, max (provider-dependent)\n    --environment <id-or-path>     Attach to an existing environment (ID or workspace path)\n    --new-environment <kind>       Create a new environment (worktree)\n    --service-tier <tier>          Service tier: fast, default\n    --permission-mode <mode>       Permission mode: full, workspace-write, or readonly\n\n  Execution defaults resolve from explicit flags, live parent execution, project defaults, then product defaults.\n  When spawning a subagent, pass --permission-mode full unless the user or task explicitly requests restricted access.\n  Parenting is opt-in. Inside a thread, pass --parent-self to parent the new thread to the current thread.\n\nListing:\n\n  bb thread list                           List threads\n    --project <id>                         Filter by project\n    --parent-thread <id>                   Filter by parent thread\n    --archived                             Show only archived threads\n\nInspecting:\n\n  bb thread show [id]                      Show thread details and pull request status\n    --self                                 Target current thread\n    --work-status                          Include git working-tree status\n    --git-diff                             Include git diff\n    --diff-target <type>                   Diff scope: uncommitted, branch_committed, all, commit\n    --diff-sha <sha>                       Commit SHA (for --diff-target commit)\n    --diff-merge-base <branch>             Override merge-base branch for diff\n    --merge-base-branches                  List available merge-base branches\n\n  Shows pull request status for the attached environment branch when available.\n\n  bb thread log [id]                       Show thread event log\n    --self                                 Target current thread\n    --format <format>                      Output format: json, minimal, verbose\n    --limit <count>                        Limit entries\n    --after-seq <seq>                      Paginate after sequence number\n\n  bb thread output [id]                    Get the final output of a thread\n    --self                                 Target current thread\n\n  bb thread wait <id>                      Wait for a thread status or event (defaults to --status idle)\n    --status <status>                      Wait for this status\n    --event <type>                         Wait for this event type\n    --timeout <seconds>                    Timeout\n    --poll-interval <ms>                   Polling interval in milliseconds\n\nOpening files in the thread panel:\n\n  bb thread open <path>                    Open a file in the current BB thread panel\n  bb thread open <thread-id> <path>        Open a file in a specific BB thread panel\n    --line <number>                        Line number to focus\n\n  Inside a BB thread, BB_THREAD_ID selects the current thread automatically and\n  the thread ID argument is omitted. Outside a BB thread, pass the thread ID as\n  the first argument.\n\n  Paths can be thread-relative workspace paths, or absolute paths inside the\n  target thread workspace. Absolute paths under BB_THREAD_STORAGE open as\n  thread-storage files for the current thread. Use this for Markdown or HTML\n  artifacts you create for the user so they open in the BB IDE.\n\nThread terminals:\n\n  Use thread terminals for long-running commands that should stay alive for the\n  user, such as dev servers, watch tasks, REPLs, and database consoles. Terminals\n  are real PTY sessions scoped to the thread's environment, and they appear in the\n  bb UI as terminal tabs.\n\n  bb thread terminal start <id> --command \"pnpm dev\"\n    --title <title>                        Display title\n    --cols <n>                             Initial terminal columns\n    --rows <n>                             Initial terminal rows\n    --attach                               Attach interactively after starting\n    --json                                 Print the created terminal session\n\n  bb thread terminal list <id>             List running terminals for a thread\n\n  bb thread terminal attach <terminal-id> <id>\n                                            Attach interactively; Ctrl-B d detaches\n\n  bb thread terminal send <terminal-id> <id>\n    --text <text>                          Text to send\n    --stdin                                Read text from stdin\n    --enter                                Append a newline\n\n  bb thread terminal output <terminal-id> <id>\n    --since-seq <n>                        Read output chunks from a sequence\n    --tail-bytes <n>                       Bound output to latest N bytes\n    --limit-chunks <n>                     Bound output to latest N chunks\n    --json                                 Print chunks, nextSeq, and truncated\n\n  bb thread terminal wait <terminal-id> <id>\n    --contains <text>                      Wait for new output containing text\n    --regex <pattern>                      Wait for new output matching regex\n    --exit                                 Wait until the terminal exits\n    --from-start                           Include existing scrollback\n    --timeout <seconds>                    Timeout\n    --poll-interval <ms>                   Polling interval\n\n  bb thread terminal resize <terminal-id> <id> --cols <n> --rows <n>\n  bb thread terminal stop <terminal-id> <id>\n\n  Terminal commands require an explicit thread ID.\n\n  For a dev server, prefer:\n\n    bb thread terminal start <thread-id> --title \"pnpm dev\" --command \"pnpm dev\"\n    bb thread terminal wait <terminal-id> <thread-id> --contains \"Local:\" --timeout 120\n\n  Do not run long-lived servers as one-off foreground commands when the user will\n  need to inspect logs, refresh the page, or stop the process later.\n\nMessaging:\n\n  bb thread tell <id> <message>            Send a follow-up message\n    --mode <mode>                          Message mode: queue (default), steer, or auto\n    --model <model>                        Model override for this turn\n    --reasoning-level <level>              Reasoning level override\n\n  bb thread stop [id]                      Stop an active or provisioning thread\n    --self                                 Stop current thread\n\nOwnership:\n\n  bb thread update [id]                    Update thread metadata\n    --self                                 Target current thread\n    --title <title>                        Set title\n    --parent-thread <id>                   Assign to a parent thread\n    --clear-parent-thread                  Remove parent assignment\n\nLifecycle:\n\n  bb thread archive [id]                   Archive a thread\n    --self                                 Archive current thread\n\n  bb thread unarchive [id]                 Unarchive a thread\n    --self                                 Unarchive current thread\n\n  bb thread delete <id>                    Delete permanently\n    --yes                                  Skip confirmation\n\nRead-only commands require a thread ID or --self where supported.\nMutating thread lifecycle and messaging commands require an explicit ID or --self.\nTerminal commands require an explicit thread ID.",
     "fileName": "bb-guide-threads.md",
     "kind": "instruction",
     "title": "bb Guide — Threads",

packages/templates/src/templates/bb-guide-threads.md

@@ -27,6 +27,7 @@ Spawning:
     --permission-mode <mode>       Permission mode: full, workspace-write, or readonly
 
   Execution defaults resolve from explicit flags, live parent execution, project defaults, then product defaults.
+  When spawning a subagent, pass --permission-mode full unless the user or task explicitly requests restricted access.
   Parenting is opt-in. Inside a thread, pass --parent-self to parent the new thread to the current thread.
 
 Listing: